Thousands of sites running the WordPress content management system have been hacked by a prolific threat actor that exploited a recently patched vulnerability in a widely used plugin.

The vulnerable plugin, known as tagDiv Composer, is a mandatory requirement for using two WordPress themes: Newspaper and Newsmag. The themes are available through the Theme Forest and Envato marketplaces and have more than 155,000 downloads.

Tracked as CVE-2023-3169, the vulnerability is what’s known as a cross-site scripting (XSS) flaw that allows hackers to inject malicious code into webpages. Discovered by Vietnamese researcher Truoc Phan, the vulnerability carries a severity rating of 7.1 out of a possible 10. It was partially fixed in tagDiv Composer version 4.1 and fully patched in 4.2.

According to a post authored by security researcher Denis Sinegubko, threat actors are exploiting the vulnerability to inject web scripts that redirect visitors to various scam sites. The redirections lead to sites pushing fake tech support, fraudulent lottery wins, and push notification scams, the latter of which trick visitors into subscribing to push notifications by displaying fake captcha dialogs.

Sucuri, the security firm Sinegubko works for, has been tracking the malware campaign since 2017 and has named it Balada. Sucuri estimates that in the past six years, Balada has compromised more than 1 million sites. Last month, Sucuri detected Balada injections on more than 17,000 sites, almost double the number the firm had seen the month before. More than 9,000 of the new infections were the result of injections made possible by exploiting CVE-2023-3169.

Sinegubko wrote:

We observed a rapid cycle of modifications to their injected scripts alongside new techniques and approaches. We saw randomized injections and obfuscation types, simultaneous use of multiple domains and subdomains, abuse of CloudFlare, and multiple approaches to attack administrators of infected WordPress sites.

September was also a very challenging month for thousands of users of the tagDiv Newspaper theme. The Balada Injector malware campaign performed a series of attacks targeting both the vulnerability in the tagDiv Composer plugin and blog administrators of already infected sites.

Sucuri has tracked no fewer than six waves of injections that leverage the vulnerability. While each wave is distinct, all contain a telltale script injected inside of these tags:

<style id="tdw-css-placeholder"></style><script>...malicious injection…</script><style></style>

The malicious injection uses obfuscated code to make it hard to detect. It can be found in the database used by WordPress sites, specifically in the “td_live_css_local_storage” option of the wp_options table.

The Balada threat actor has always attempted to gain persistent control over the websites it compromises. The most common way it does this is by injecting scripts that create accounts with administrator privileges. If real admins detect and remove the redirection scripts but allow the fake admin accounts to remain, the threat actor uses its administrative control to add a new set of malicious redirect scripts.

The researcher wrote:

Balada Injector hackers always aim for persistent control over compromised sites by uploading backdoors, adding malicious plugins, and creating rogue blog administrators. In this case, the [CVE-2023-3169] vulnerability doesn’t allow them to easily achieve this goal. However, this never stopped Balada from trying to completely take over the sites with stored XSS vulnerabilities.

Balada is long known for injecting malicious scripts that target logged-in site administrators. The idea is when a blog administrator logs into a website, their browser contains cookies that allow them to do all their administrative tasks without having to authenticate themselves on every new page. So, if their browser loads a script that tries to emulate administrator activity, it will be able to do almost anything that can be done via the WordPress admin interface.

Anyone administering a site that uses the WordPress themes Newspaper or Newsmag should carefully inspect both their site and event logs for signs of infection using the many indicators of compromise included in the Sucuri post. As mentioned, the Balada threat actors attempt to gain persistent access to the sites they compromise. In addition to removing any malicious scripts added, it’s also important to check for backdoor code and the addition of any admin accounts.

https://arstechnica.com/?p=1974522

The maintainers of the cURL data transfer project are working on patching two vulnerabilities in the software, including a high-severity bug impacting both libcurl and curl.

cURL provides both a library (libcurl) and command-line tool (curl) for transferring data with URL syntax, supporting various network protocols, including SSL, TLS, HTTP, FTP, SMTP, and more.

The two issues are tracked as CVE-2023-38545 and CVE-2023-38546, and the maintainers are warning that the former has a ‘high severity’ rating and could be considered one of the most severe flaws in the open source tool.

“We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW. The one rated HIGH is probably the worst curl security flaw in a long time,” the maintainers note in an advisory.

Details on the vulnerability itself and on the affected curl versions have yet to be disclosed, but the maintainers say that all iterations released over the “last several years” are vulnerable.

The advisory was published ahead of patches to warn organizations of the bug’s severity, so that they can prepare for the upcoming updates. Member distributions were also notified, so they can prepare patches.

“No one else gets details about these problems before October 11 without a support contract and a good reason,” curl’s maintainers say.

“Organizations should urgently inventory and scan all systems utilizing curl and libcurl, anticipating identifying potentially vulnerable versions once details are disclosed with the release of Curl 8.4.0 on October 11. Immediate update implementation upon release is essential to safeguard systems against these pressing vulnerabilities,” Qualys product manager Saeed Abbasi points out.

According to curl’s maintainers, the vulnerability potentially impacts all projects relying on libcurl, although some software may use it in a way that does not allow exploitation. 

“Updating the shared libcurl library should be enough to fix this issue on all operating systems,” the maintainers point out.

Related: Google Proposes More Transparent Vulnerability Management Practices

Related: Information Disclosure, DoS Flaws Patched in libcurl

Related: cURL Security Audit Reveals Several Vulnerabilities

https://www.securityweek.com/patches-prepared-for-probably-worst-curl-vulnerability/

Google has announced the expansion of its vulnerability rewards program with two events focused on Chrome’s V8 JavaScript rendering engine and on Kernel-based Virtual Machine (KVM).

The v8CTF, which has already started, allows security researchers to earn monetary rewards for successfully exploiting a V8 version running on Google’s infrastructure.

The challenge is meant to complement Google’s VRP, allowing researchers who identify vulnerabilities in the JavaScript engine to earn additional rewards by submitting exploits to the v8CTF. However, participating researchers can also submit exploits for already known V8 vulnerabilities.

“If the bug that led to the initial memory corruption was found by you, i.e. reported from the same email address as used in the v8CTF submission, we will consider the exploit a 0-day submission. All other exploits are considered n-day submissions,” Google explains.

Researchers who identify a new vulnerability are encouraged to report it first to the Chrome VRP. Next, they can use the exploit in the v8CTF, to exfiltrate the flag from Google’s infrastructure.

According to the program’s rules, security researchers submitting valid exploits are eligible for a reward of $10,000.

“This is on top of any existing rewards for the vulnerabilities themselves. For example, if you find a vulnerability in V8 and then write an exploit for it, it can be eligible under both the Chrome VRP and the v8CTF,” Google explains.

Set to be launched later this year, kvmCTF will reward researchers for exploits targeting zero-day and one-day vulnerabilities in KVM, the open-source virtualization module in the Linux kernel that allows it to function as a hypervisor.

The event will focus on the LTS kernel and will reward successful guest-to-host attacks. QEMU exploits or vulnerabilities are not within the event’s scope for now.

Google promises rewards of up to $99,999 for exploits leading to a full VM escape, but it will also reward arbitrary memory write/read ($34,999 and $24,999, respectively) and denial-of-service (DoS) exploits ($14,999).

“Note that the above rewards do not stack. For example if you submit a full VM escape exploit that uses an arbitrary memory write, you will be compensated with the reward for the VM escape ($99,999) and not with two separate rewards ($99,999 + $34,999),” Google explains.

Security researchers interested in participating are encouraged to read the rules for v8CTF and kvmCTF, exploit an identified vulnerability to grab the flag, and send the flag to Google, as specified in the rules.

“If you’re successful, you’ll not only earn a reward, but you’ll also help us make our products more secure for everyone. This is also a good opportunity to learn about technologies and gain hands-on experience exploiting them,” Google notes.

Related: Google Announces New Rating System for Android and Device Vulnerability Reports

Related: Google Launches Bug Bounty Program for Mobile Applications

Related: Google Paid Out $12 Million via Bug Bounty Programs in 2022

https://www.securityweek.com/google-expands-bug-bounty-program-with-chrome-cloud-ctf-events/

The US cybersecurity agency CISA has removed several Owl Labs product flaws from its Known Exploited Vulnerabilities (KEV) Catalog after SecurityWeek privately called into question its decision.

In mid-September, CISA added to its KEV catalog four vulnerabilities affecting Owl Labs’ Meeting Owl smart video conferencing product, a device shaped like an owl that features a 360° conference camera, a mic, and a speaker. Another Meeting Owl flaw was previously added to the KEV list. 

The Meeting Owl vulnerabilities, discovered last year by researchers at Swiss cybersecurity firm Modzero, include inadequate encryption, hardcoded credentials, missing authentication, and improper authentication issues. An attacker can use them to take control of the targeted Meeting Owl device and turn it into a rogue access point, but exploitation would require an attacker to be in Bluetooth range of the targeted Meeting Owl device. 

CISA announced this week that it has removed the Meeting Owl vulnerabilities, citing insufficient evidence of exploitation.

“CISA is continually collaborating with partners across government and the private sector. As a result of this collaboration, CISA has concluded that there is insufficient evidence to keep the [five Meeting Owl] CVEs in the catalog and has removed them,” the agency said.

When the vulnerabilities were added to the KEV list, SecurityWeek reached out to both CISA and the vendor for confirmation of malicious exploitation, given that there were no public reports about exploitation and the fact that the vulnerabilities seemed unlikely to be considered useful by threat actors as they require the attacker to be in Bluetooth range. Malicious hackers exploiting vulnerabilities via Bluetooth is — as far as we know — unheard of. 

However, when faced with similar inquiries in the past, CISA insisted that only flaws for which it has reliable evidence of exploitation in the wild are added to the KEV catalog. In this case, it would have meant that the vulnerabilities were likely exploited by a highly motivated and sophisticated attacker as part of a targeted espionage campaign rather than as part of opportunistic operations.  

CISA has still not responded to SecurityWeek’s inquiry. When contacted in mid-September, Owl Labs’ response suggested that the company had not been aware of any attacks. The vendor informed SecurityWeek of CISA’s decision to remove the CVEs from its catalog on Thursday, but did not say why the cybersecurity agency thought the vulnerabilities were exploited. 

When the flaws were added to the KEV catalog, Tenable’s Ben Smith noted in a blog post, “I’m not currently aware of any [Bluetooth Low Energy (BLE)] vulnerabilities actually exploited in the wild. I’m also not aware of any malware that contains Bluetooth or BLE functionality. Evidence would probably look like either logs from the device or a sample of the malware with this capability. If this is true, it likely marks the first time we have such evidence of exploitation of BLE vulnerabilities.”

Smith explained at the time that there are two primary paths for exploiting these types of vulnerabilities: by directly targeting a device from close range via Bluetooth or by using a remotely compromised device that is in the target’s vicinity. 

A Bluetooth attack can theoretically be launched from up to 330 feet in the case of the Owl Labs device, which could possibly be achieved in some scenarios from a parking lot or sidewalk near the building housing the targeted device. In the scenario involving a compromised device, it’s not easy to achieve.

“Attackers could use BLE enumeration apps or install command-line tools like hcitool or gatttool to dive deeper into BLE exploration, but these are not installed by default on most laptops or mobile devices. So, malware wanting to exploit BLE vulnerabilities in a remote device would need to include such capabilities or an attacker would need to write some code to use BLE APIs exposed on the compromised device. These vary across operating systems and architectures,” Smith explained. 

Related: Faster Patching Pace Validates CISA’s KEV Catalog Initiative

Related: CISA Unveils New HBOM Framework to Track Hardware Components

https://www.securityweek.com/cisa-reverses-course-on-malicious-exploitation-of-video-conferencing-device-flaws/

A remotely exploitable vulnerability in the Cisco Emergency Responder software could allow an unauthenticated attacker to log in to an affected device using the root account, according to a warning from the U.S. tech vendor.

The vulnerability, tracked as CVE-2023-20101, carries a CVSS severity score of 9.8/10 and a “critical” tag from Cisco’s security response team.

From the Cisco advisory:

“A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.”

“This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.”

Cisco said the security defect affects only Cisco Emergency Responder Release 12.5(1)SU4.

The San Jose, Calif. company is urging Cisco Emergency Responder users to immediately apply the available patches, warning that there are no workarounds that address this vulnerability.

The Cisco Emergency Responder software works in tandem with the Cisco Unified Communications Manager to send emergency calls to the appropriate Public Safety Answering Point (PSAP) for a caller’s location.

Available in the US and Canadian markets, the software is used to route emergency calls to a local public-safety answering point (PSAP), alert personnel by email or phone of an emergency call to respond to locally, keep logs of all emergency calls and provide the PSAP with accurate geolocation of the caller in need.

Related: Chinese Gov Hackers Caught Hiding in Cisco Router Firmware

Related: Cisco Warns of WebEx Player Security Vulnerabilities

Related: Live Exploits Underscore Urgency to Patch WS-FTP Server Flaw

Related: US Gov Warning: Firmware Security a ‘Single Point of Failure’

https://www.securityweek.com/cisco-plugs-gaping-hole-in-emergency-responder-software/

If your organization uses servers that are equipped with baseboard management controllers from Supermicro, it may be time, once again, to patch seven high-severity vulnerabilities that attackers could exploit to gain control of them. And sorry, but the fixes must be installed manually.

Typically abbreviated as BMCs, baseboard management controllers are small chips that are soldered onto the motherboard of servers inside data centers. Administrators rely on these powerful controllers for various remote management capabilities, including installing updates, monitoring temperatures and setting fan speeds accordingly, and reflashing the UEFI system firmware that allows servers to load their operating systems during reboots. BMCs provide these capabilities and more, even when the servers they’re connected to are turned off.

Code execution inside the BMC? Yup

The potential for vulnerabilities in BMCs to be exploited and used to take control of servers hasn’t been lost on hackers. In 2021, hackers exploited a vulnerability in BMCs from HP Enterprise and installed a custom rootkit, researchers from Amnpardaz, a security firm in Iran, reported that year. ILObleed, as the researchers named the rootkit, hid inside the iLO, a module in HPE BMCs that’s short for Integrated Lights-Out.

ILObleed was programmed to destroy data stored on disk. If admins reinstalled the operating system, iLObleed would remain intact and reactivate the disk-wiping attack repeatedly. The unknown attackers responsible took control of the BMCs by exploiting a vulnerability HPE had fixed four years earlier. In June, the National Security Agency urged admins to follow guidance to prevent such incidents.

Researchers from security firm Binarly on Tuesday disclosed seven high-severity vulnerabilities in the IPMI (Intelligent Platform Management Interface) firmware for older Supermicro BMCs. Supermicro said in an advisory that the vulnerabilities affect “select X11, H11, B11, CMM, M11, and H12 motherboards.” The advisory also thanked Binarly and provided patching information. There’s no automated way to install the updates. Supermicro said it’s unaware of any malicious exploitation of the vulnerabilities in the wild.

One of the seven vulnerabilities, tracked as CVE-2023-40289, allows for the execution of malicious code inside the BMC, but there’s a catch: Exploiting the flaw requires already obtained administrative privileges in the web interface used to configure and control the BMCs. That’s where the remaining six vulnerabilities come in. All six of them allow cross-site scripting, or XSS, attacks on machines used by admins. The exploit scenario is to use one or more of them in combination with CVE-2023-40289.

In an email, Binarly founder and CEO Alex Matrosov wrote:

Exploiting this vulnerability requires already obtained administrative privileges in the BMC Web Interface. To achieve it, a potential attacker can utilize any of the XSS vulnerabilities we found. In such a case, the exploitation path will look like this potential scenario:

1. an attacker prepares a malicious link with the malicious payload
2. includes it in phishing emails (for example)
3. when this click is opened, the malicious payload will be executed inside BMC OS.

Admins can remotely communicate with Supermicro BMCs through various protocols, including SSH, IPMI, SNMP, WSMAN, and HTTP/HTTPS. The vulnerabilities Binarly discovered can be exploited using HTTP. While the NSA and many other security practitioners strongly urge that BMC interfaces be isolated from the Internet, there’s evidence that this advice is routinely ignored. A recent query to the Shodan search engine revealed more than 70,000 instances of Supermicro BMC that have their IPMI web interface publicly available.

The road map for exploiting the vulnerabilities against servers with Supermicro interfaces exposed this way is illustrated below:

In Tuesday’s post, Binarly researchers wrote:

First, it is possible to remotely compromise the BMC system by exploiting vulnerabilities in the Web Server component exposed to the Internet. An attacker can then gain access to the Server’s operating system via legitimate iKVM remote control BMC functionality or by flashing the UEFI of the target system with malicious firmware that allows persistent control of the host OS. From there, nothing prevents an attacker from lateral movement within the internal network, compromising other internal hosts.

All the vulnerabilities Binarly discovered originate in IPMI firmware third-party developer ATEN developed for Supermicro. While ATEN patched CVE-2023-40289 six months ago, the fix never made its way into the firmware.

“This is a supply chain problem because it can be other BMC vendors that can be potentially impacted by these vulnerabilities,” Matrosov wrote.

https://arstechnica.com/?p=1973415

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

The Cupertino device maker on Wednesday rushed out a new patch to cover a pair of serious vulnerabilities and warned that one of the issues has already been exploited as zero-day in the wild.

In a barebones advisory, Apple said the exploited CVE-2023-42824 kernel vulnerability allows a local attacker to elevate privileges, suggesting it was used in an exploit chain in observed attacks.

“Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6,” the company said without providing additional details.

This is the 16th documented in-the-wild zero-day against Apple’s iOS, iPadOS and macOS-powered devices, according to data tracked by SecurityWeek. The majority of these attacks have been attributed to mercenary spyware vendors selling surveillance products.

The newest iOS 17.0.3 and iPadOS 17.0.3 updates also cover a buffer overflow vulnerability in WebRTC that exposes mobile devices to arbitrary code execution attacks. The issue was addressed by updating to libvpx 1.13.1, Apple said. 

Apple is encouraging oft-targeted users to enable Lockdown Mode to reduce exposure to mercenary spyware exploits.

Related: Atlassian Ships Urgent Patch for Exploited Confluence Zero-Day

Related: Qualcomm Patches 3 Zero-Days Reported by Google

Related: Can ‘Lockdown Mode’ Solve Apple’s Mercenary Spyware Problem?

Related: Apple Patches Actively Exploited iOS, macOS Zero-Days

https://www.securityweek.com/apple-warns-of-newly-exploited-ios-17-kernel-zero-day/

Business software maker Atlassian on Wednesday called immediate attention to a major security defect in its Confluence Data Center and Server products and warned that the issue has already been exploited as zero-day in the wild.

An urgent advisory from Atlassian confirms that “a handful of customers” were hit by exploits targeting a remotely exploitable flaw in Confluence Data Center and Server instances.

“Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances,” the Australian company said.

The vulnerability, tracked as CVE-2023-22515, is described as a remotely exploitable privilege escalation issue  affecting on-prem instances of Confluence Server and Confluence Data Center.

“Instances on the public internet are particularly at risk, as this vulnerability is exploitable anonymously,” Atlassian warned.  “If an instance has already been compromised, upgrading will not remove the compromise.”

The company said Atlassian Cloud sites are not vulnerable to this issue.

Security vendor Rapid7 is underscoring the urgency for businesses to apply available patches and mitigations.

“Atlassian’s advisory implies that the vulnerability is remotely exploitable, which is typically more consistent with an authentication bypass or remote code execution chain than a privilege escalation issue by itself,” Rapid7’s Caitlin Condon said. 

Atlassian has published an FAQ urging business users to immediately check all affected Confluence instances for the following indicators of compromise:

• Unexpected members of the confluence-administrator group
• Unexpected newly created user accounts
• Requests to /setup/*.action in network access logs
• Presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory

“If it is determined that your instance has been compromised, our advice is to immediately shut down and disconnect the server from the network/Internet. Also, you may want to immediately shut down any other systems which potentially share a user base or have common username/password combinations with the compromised system,” Atlassian added.

Security problems in Atlassian’s software products have been targeted in the past by both cybercriminal and state-sponsored threat actors. In CISA’s KEV (Known Exploited Vulnerabilities) catalog, there are six distinct Confluence vulnerabilities marked for urgent attention.

Related: Atlassian Ships Urgent Patch for Critical Bitbucket Flaw

Related: Expects Confluence App Exploitation After Password Leak

Related: Atlassian Patches Remote Vulnerabilities in Confluence, Bamboo

Related: Cybercriminals, State-Sponsored APTs Exploiting Confluence Flaw

https://www.securityweek.com/atlassian-ships-urgent-patch-for-exploited-confluence-zero-day/

Server and computer hardware giant Supermicro has released updates to address multiple vulnerabilities in Baseboard Management Controllers (BMC) IPMI firmware.

The issues (tracked as CVE-2023-40284 to CVE-2023-40290) could allow remote attackers to gain root access to the BMC system, firmware supply chain security firm Binarly, which identified the bugs, explains.

A special chip on server motherboards that support remote management, the BMC allows administrators to monitor various hardware variables and even update the UEFI system firmware. The BMC chips remain operational even if the system’s power is turned off.

The most severe of these bugs are three cross-site scripting (XSS) vulnerabilities in the BMC server frontend that could be exploited remotely, without authentication, to execute arbitrary JS code.

The flaws are tracked as CVE-2023-40284, CVE-2023-40287, and CVE-2023-40288 and, according to Supermicro’s advisory, have a CVSS score of 8.3.

“An attacker could send a phishing link that does not require login, tricking BMC administrators to click on that link while they are still logged in and thus authenticated by BMC Web UI,” Supermicro notes.

Binarly, however, considers these issues ‘critical severity’, with a CVSS score of 9.6. The security firm assumes that the attacker knows the BMC web server’s IP address and the administrator’s email address, which it uses to send a phishing email.

CVE-2023-40289, which is described as a command injection bug in the BMC server backend, should also be considered critical severity, with a CVSS score of 9.1, Binarly says.

“The vulnerability is critical because it allows authenticated attackers to gain root access and completely compromise the BMC system. This privilege makes it possible to make the attack persistent even while the BMC component is rebooted and to move laterally within the compromised infrastructure, infecting other endpoints,” the security firm notes.

Supermicro, however, rates the issue with a CVSS score of 7.2, noting that it requires for the attacker to be logged into the BMC with administrator privileges.

Binarly also identified two XSS flaws (CVE-2023-40285 and CVE-2023-40286) in the Supermicro BMC IPMI firmware that could lead to the execution of malicious code every time a specific action is triggered. The complexity of the attack is low, with no circumstances preventing successful exploitation, Binarly says.

Both vulnerabilities can be exploited by sending phishing emails and tricking BMC administrators into clicking a link while they are still logged in to the BMC web UI.

CVE-2023-40290, another high-severity XSS flaw, can only be exploited using the Internet Explorer 11 browser on Windows.

According to Supermicro, the vulnerability impacts the BMC IPMI firmware of select B11, CMM, H11, H12, M11, and X11 motherboards.

The company says it is not aware of any malicious exploitation of these vulnerabilities.

Binarly’s research focused on the web server component due to it being the most accessible and most likely attack vector. The company has seen more than 70,000 instances of internet-exposed Supermicro IPMI web interfaces.

Related: New AMI BMC Flaws Allowing Takeover and Physical Damage Could Impact Millions of Devices

Related: Security Flaws in AMI BMC Can Expose Many Data Centers, Clouds to Attacks

Related: BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks

https://www.securityweek.com/new-supermicro-bmc-vulnerabilities-could-expose-many-servers-to-remote-attacks/

Major Linux distributions such as Debian, Fedora, and Ubuntu are affected by a GNU C Library (glibc) vulnerability that could provide an attacker with full root privileges.

The C library present in GNU and most systems running the Linux kernel, glibc defines system calls and other functionality that a program typically requires.

The identified issue, named ‘Looney Tunables’ and tracked as CVE-2023-4911 (CVSS score of 7.8), impacts glibc’s dynamic loader, which is responsible for loading into memory the libraries that a program needs, linking them with the executable at runtime.

When performing these operations, the dynamic loader resolves symbol references, preparing everything for the program’s execution.

CVE-2023-4911 impacts the dynamic loader’s processing of GLIBC_TUNABLES environment variables (also referred to as ‘tunables’), which allow users to change the library’s behavior at runtime, by adjusting different parameters.

“The dynamic loader is extremely security sensitive, because its code runs with elevated privileges when a local user executes a set-user-ID program, a set-group-ID program, or a program with capabilities,” security firm Qualys, which identified the vulnerability, notes.

According to Qualys, the glibc dynamic loader’s processing of the tunables variables is susceptible to a buffer overflow that can be exploited to obtain full root privileges on an impacted system.

The issue was introduced in April 2021, with the release of glibc 2.34, and has been successfully tested on Debian 12 and 13, Fedora 37 and 38, and Ubuntu 22.04 and 23.04. Other Linux distributions might be impacted as well, except for Alpine Linux, which uses musl libc, instead of glibc.

The issue resides in the way the dynamic loader’s processing function sanitizes tunables. Because the function removes all dangerous tunables but keeps specific ones, supplying a specifically crafted environment variable (in the form name=name=val) results in the tunable being processed twice, overflowing the buffer.

Because the vulnerability can lead to full root privileges and is relatively easy to exploit, Qualys is not sharing its proof-of-concept (PoC) code, although it has provided an extensive technical analysis.

“Our successful exploitation, leading to full root privileges on major distributions like Fedora, Ubuntu, and Debian, highlights this vulnerability’s severity and widespread nature. Although we are withholding our exploit code for now, the ease with which the buffer overflow can be transformed into a data-only attack implies that other research teams could soon produce and release exploits,” Qualys notes.

The vulnerability was resolved in upstream glibc, with Debian, Gentoo Linux, Red Hat, and Ubuntu already releasing patches as well.

Related: StackRot Linux Kernel Vulnerability Shows Exploitability of UAFBR Bugs

Related: CISA: Several Old Linux Vulnerabilities Exploited in Attacks

Related: Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges

https://www.securityweek.com/severe-glibc-privilege-escalation-vulnerability-impacts-major-linux-distributions/