Proof of Concept Published for Vulnerability Affecting Ubuntu, Other Linux Distributions

In mid-February, a vulnerability was widely reported affecting Ubuntu and some other Linux distributions that allows hackers to conduct a local privilege escalation on compromised machines. The security researcher discovered and responsibly disclosed the vulnerability in a daemon API--which he named “Dirty Sock”--in January 2019, but waited until February 13th to publish his proofs-of-concept (PoCs) demonstrating use of the vulnerability. The company behind the daemon, Snapd, released a new version of the daemon in January, and Canonical, the company behind Ubuntu, released a patch on February 13th. The vulnerability does not enable hacking of Ubuntu systems, but should a system become compromised, it allows hackers to create root-level accounts. This vulnerability can be tracked by CVE-2019-7304.

Recommendations

This vulnerability is not with the Ubuntu operating system itself but rather an Ubuntu daemon, Snapd, that manages certain types of apps. Canonical has already released a patch for the Ubuntu system, and Snapd released an updated version of the daemon, Snapd version 2.37.1. Other Linux distributions, including Arch, Debian, Fedora, OpenSUSE, and Solus, have released patches.

Users of Linux distributions should:

• Immediately patch their system and update their Snapd version;
• Always take caution to only download packages from known and trusted developers in the Snap store, as malicious code related to this vulnerability can be hidden inside malicious Snap packages; and
• Configure the ZeroFOX platform to monitor for and alert on Linux updates and other software information relevant to your enterprise.

Details

In January 2019, security researcher Chris Moberly discovered a vulnerability in the Snapd daemon API, and in February, demonstrated two PoCs employing this vulnerability. This Snapd daemon manages “snaps,” a new app format used on some Linux distributions, including Ubuntu. Moberly stated that Snapd exposed a local REST API server, and he identified a way to bypass the access control restrictions on this API to gain access to all functions, including administrative functions. Moberly’s PoCs demonstrate two ways to bypass the access controls and create root-level accounts on a machine.

Although this vulnerability does not enable the initial access to a system, it provides local privilege escalation once a machine is compromised. The malicious code exploiting the API server can be run on an infected machine directly, or a hacker could hide this code in a malicious snap package available on the Ubuntu Snap Store.