Tailscale up to 1.38.1 on FreeBSD SSH privileges management

Summaryinfo

A vulnerability was found in Tailscale up to 1.38.1 on FreeBSD. It has been declared as critical. This vulnerability affects unknown code of the component SSH. Such manipulation leads to privileges management. This vulnerability is traded as CVE-2023-28436. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Tailscale up to 1.38.1 on FreeBSD and classified as critical. Affected by this issue is some unknown processing of the component SSH. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules. Tailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria: the destination node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users; and a non-interactive SSH session was used. Affected users should upgrade to version 1.38.2 to remediate the issue.

The weakness was shared 03/24/2023 as GHSA-vfgq-g5x8-g595. The advisory is available at github.com. This vulnerability is handled as CVE-2023-28436 since 03/15/2023. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 1.38.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d00c046b723dff6e3775d7d35f891403ac21a47d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Tailscale

Version

• 1.38.0
• 1.38.1

License

• open-source

Website

• Product: https://github.com/tailscale/tailscale/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion