shadow 4.5 newgidmap /proc/self/setgroups 7pk security

Summaryinfo

A vulnerability classified as critical has been found in shadow 4.5. Affected is an unknown function of the file /proc/self/setgroups of the component newgidmap. This manipulation causes 7pk security. This vulnerability is tracked as CVE-2018-7169. The attack is possible to be carried out remotely. No exploit exists. This vulnerability has a historic impact because of its background and how it was received. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in shadow 4.5. It has been declared as critical. Affected by this vulnerability is some unknown processing of the file /proc/self/setgroups of the component newgidmap. The manipulation with an unknown input leads to a 7pk security vulnerability. The CWE definition for the vulnerability is CWE-254. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

The bug was discovered 11/01/2017. The weakness was disclosed 02/15/2018 (Website). The advisory is shared at bugs.launchpad.net. This vulnerability is known as CVE-2018-7169 since 02/15/2018. The attack can be launched remotely. Required for exploitation is a single authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/06/2020). MITRE ATT&CK project uses the attack technique T1211 for this issue. Due to its background and reception, this vulnerability has a historic impact.

The vulnerability was handled as a non-public zero-day exploit for at least 106 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 108509 (SUSE SLED12 / SLES12 Security Update : shadow (SUSE-SU-2018:0662-1)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 170934 (SUSE Enterprise Linux Security Update for shadow (SUSE-SU-2018:0662-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 4 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (108509). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• shadow

Version

• 4.5

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion