• Search for:
    10May, 2023
    A Linux NetFilter kernel flaw allows escalating privileges to ‘root’

    A Linux NetFilter kernel flaw, tracked as CVE-2023-32233, can be exploited by unprivileged local users to escalate their privileges to root.

    Netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers. Netfilter offers various functions and operations for packet filtering, network address translation, and port translation, which provide the functionality required for directing packets through a network and prohibiting packets from reaching sensitive locations within a network.

    The Linux NetFilter kernel is affected by a vulnerability, tracked as CVE-2023-32233, that can allow unprivileged local users to escalate their privileges to ‘root,’ potentially leading to the complete compromise of the system.

    “In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory.” reads the advisory. “Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.”

    The root cause of the problem resides in how tfilter nf_tables handles batch requests, allowing a local authenticated attacker to gain elevated privileges by sending a specially crafted request that causes the corruption of the internal state of Netfilter nf_tables.

    “Netfilter nf_tables allows updating its configuration with batch requests that group multiple basic operations into atomic transactions. In a specific scenario, an invalid batch request may contain an operation that implicitly deletes an existing nft anonymous set followed by another operation that attempts to act on the same nft anonymous set after it is deleted.” wrote Piotr Krysiuk on SecLists.

    Researchers Patryk Sondej and Piotr Krysiuk developed an PoC exploit code that allows unprivileged local users to start a root shell by abusing this vulnerability.

    “That exploit was shared privately with to assist with fix development. Somebody from the Linux kernel team then emailed the proposed fix to and that email also included a link to download our description of exploitation techniques and our exploit source code.” continues Krysiuk. ” Therefore, according to the linux-distros list policy, the exploit must be published within 7 days from this advisory. In order to comply with
    that policy, I intend to publish both the description of exploitation techniques and also the exploit source code on Monday 15th by email to this list. The fix is available from mainline kernel git repository:
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=c1592a89942e9678f7d9c8030efa777c0d57edab “

    The two researchers shared their exploit privately with the Linux kernel team to allow the development of a patch to solve the issue.

    The engineer Pablo Neira Ayuso addressed the flaw by deactivating anonymous set from preparation. phase preventing users to perform any update on it.

    Resource : https://securityaffairs.com/145989/security/linux-netfilter-kernel-flaw.html

    10Dec, 2022
    Linux-ready Launch Heavy is a $300 mechanical keyboard for number crunchers

    Prebuilt mechanical keyboards often neglect Linux support. Users frequently report success in getting a mechanical keyboard’s basic functions to work, but many of these peripherals don’t accommodate software for controlling advanced features, like macros, with Linux. Since last year, System76’s Launch keyboard has been trying to address that problem. But number crunchers will be much more interested in the new Launch Heavy.

    Released this week, the Launch Heavy is a numpad-equipped version of the 84-key Launch. As detailed in our System76 Launch review, the keyboard is one of the most customizable Linux-focused mechanical keyboards one can find. However, an absent numpad made the Launch an immediate ‘no’ for many. Now, the newly released Launch Heavy is addressing many, but not all, of its smaller counterpart’s shortcomings.

    As you can see, the Launch Heavy’s 105 keys aren’t a traditional layout. System76 had its way with the keys to the left of the numpad, getting rid of some completely. But compared to the Launch, the Launch Heavy adds keys above the numpad for media control. Unfortunately, there are still no buttons for controlling the volume out of the box.

    System76 was gracious enough to update the mechanical switches offered with its keyboards since we reviewed the Launch in March. In addition to the supremely stiff clicky Kailh Box Jades and tactile Box Royals (each require 75 grams of force to actuate), you can get the Launch Heavy and the rest of the lineup with quieter, tactile Kailh Box Silent Browns (50 g) or lighter, linear Silent Pinks (35 g).

    You don’t have to stick with any of those, though, since the keyboard’s switches are easily removable sans soldering iron. But for $300, you’ll probably want to start off with switches you’re happy to use right away.

    Oh, did we forget to mention the Launch Heavy’s price? It’s only $14 more than the smaller Launch but still a massive ask for a keyboard. Many will prefer one of the best wireless mechanical keyboards, something with volume keys, or building their own mechanical keyboard for that price range instead.

    Still, the Launch Heavy (2.8 lbs, to be exact) has some standout features for those willing to spend the money.

    System76’s Launch mechanical keyboards, which also include the 70-key Launch Lite, represent some of the few mechanical keyboards that claim Linux support (they work with Windows and macOS, too). The vendor pushes its Pop!_OS Linux distribution by having the Launch Heavy support keyboard shortcuts within it, such as organizing tiled windows without a mouse or opening apps.

    The Launch series is also an admirably tinker-friendly one, from its open source, QMK-based software for programming its keys and open source chassis and PCB to the hot-swappable switches, which include two for the split spacebar. Perhaps the series’ handiest feature is the hub on the top of the keyboard’s edge with four increasingly omitted USB-A ports.

    While the Launch Heavy’s price is still overwhelming, there’s enough here for it to be a unique consideration for number crunchers, especially Linux users, seeking a customizable mechanical keyboard.

    Resource :https://arstechnica.com/gadgets/2022/12/one-of-the-best-linux-ready-mechanical-keyboards-gets-a-numpad/

    3Dec, 2022
    A new Linux flaw can be chained with other two bugs to gain full root privileges

    Qualys researchers demonstrated how to chain a new Linux flaw with two other two issues to gain full root privileges on an impacted system.

    Researchers at the Qualys’ Threat Research Unit demonstrated how to chain a new Linux vulnerability, tracked as CVE-2022-3328, with two other flaws to gain full root privileges on an affected system.

    The vulnerability resides in the snap-confine function on Linux operating systems, a SUID-root program installed by default on Ubuntu.

    The snap-confine is used internally by snapd to construct the execution environment for snap applications, an internal tool for confining snappy applications. 

    The CVE-2022-3328 is a Snapd race condition issue that can lead to local privilege escalation and arbitrary code execution.

    “In February 2022, Qualys Threat Research Unit (TRU) published CVE-2021-44731 in our “Lemmings” advisory. The vulnerability (CVE-2022-3328) was introduced in February 2022 by the patch for CVE-2021-44731).” reads the post published by Qualys.

    “The Qualys Threat Research Unit (TRU) exploited this bug in Ubuntu Server by combining it with two vulnerabilities in multipathd called Leeloo Multipath (an authorization bypass and a symlink attack, CVE-2022-41974 and CVE-2022-41973), to obtain full root privileges.”

    The experts chained the CVE-2022-3328 flaw with two recently discovered flaws in Multipathd, which is a daemon in charge of checking for failed paths.

    Multipathd runs as root in the default installation of several distributions, including Ubuntu.

    The two vulnerabilities in the Multipathd are:

    • CVE-2022-41974 (CVSS 7.8) – The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
    • CVE-2022-41973 (CVSS 7.0) – The device-mapper-multipath allows local users to obtain root access, in conjunction with CVE-2022-41974. Local users that are able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which may lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

    “Successful exploitation of the three vulnerabilities lets any unprivileged user gain root privileges on the vulnerable device. Qualys security researchers have verified the vulnerability, developed an exploit and obtained full root privileges on default installations of Ubuntu.” Qualys added.

    The FAQ section included in the advisory confirms that the vulnerability is not remotely exploitable.

    Resource: https://securityaffairs.co/wordpress/139209/hacking/three-linux-bugs-full-root-privileges.html

    22Jul, 2022
    Technology – How to Compress and Extract Files Using the tar Command on Linux

    The tar command on Linux is often used to create .tar.gz or .tgz archive files, also called  “tar balls.” This command has a large number of options, but you just need to remember a few letters to quickly create archives with tar. The tar command can extract the resulting archives, too.

    The GNU tar command, included with Linux distributions, has integrated compression. It can create a .tar archive and then compress it with gzip or bzip2 compression in a single command. That’s why the resulting file is a .tar.gz file or .tar.bz2 file.

    Compress an Entire Directory or a Single File

    Use the following command to compress an entire directory or a single file on Linux. It’ll also compress every other directory inside a directory you specify–in other words, it works recursively.

    tar -czvf name-of-archive.tar.gz /path/to/directory-or-file

    Here’s what those switches actually mean:

    • -c: Create an archive.
    • -z: Compress the archive with gzip.
    • -v: Display progress in the terminal while creating the archive, also known as “verbose” mode. The v is always optional in these commands, but it’s helpful.
    • -f: Allows you to specify the filename of the archive.

    Let’s say you have a directory named “stuff” in the current directory and you want to save it to a file named archive.tar.gz. You’d run the following command:

    tar -czvf archive.tar.gz stuff

    Or, let’s say there’s a directory at /usr/local/something on the current system and you want to compress it to a file named archive.tar.gz. You’d run the following command:

    tar -czvf archive.tar.gz /usr/local/something
    Run "tar -czvf" on the desired folder to bundle and compress all of the contents.

    Compress Multiple Directories or Files at Once

    While tar is frequently used to compress a single directory, you could also use it to compress multiple directories, multiple individual files, or both. Just provide a list of files or directories instead of a single one. For example, let’s say you want to compress the /home/ubuntu/Downloads directory, the /usr/local/stuff directory, and the /home/ubuntu/Documents/notes.txt file. You’d just run the following command:

    tar -czvf archive.tar.gz /home/ubuntu/Downloads /usr/local/stuff /home/ubuntu/Documents/notes.txt

    Just list as many directories or files as you want to back up.

    Ubuntu Terminal compressing multiple directories at once with the "tar" command.

    Exclude Directories and Files

    In some cases, you may wish to compress an entire directory, but not include certain files and directories. You can do so by appending an --exclude switch for each directory or file you want to exclude.

    For example, let’s say you want to compress /home/ubuntu, but you don’t want to compress the /home/ubuntu/Downloads and /home/ubuntu/.cache directories. Here’s how you’d do it:

    tar -czvf archive.tar.gz /home/ubuntu --exclude=/home/ubuntu/Downloads --exclude=/home/ubuntu/.cache

    The --exclude switch is very powerful. It doesn’t take names of directories and files–it actually accepts patterns. There’s a lot more you can do with it. For example, you could archive an entire directory and exclude all .mp4 files with the following command:

    tar -czvf archive.tar.gz /home/ubuntu --exclude=*.mp4
    The "tar" command can be tuned to selectively ignore some files.

    Use bzip2 Compression Instead

    While gzip compression is most frequently used to create .tar.gz or .tgz files, tar also supports bzip2 compression. This allows you to create bzip2-compressed files, often named .tar.bz2, .tar.bz, or .tbz files. To do so, just replace the -z for gzip in the commands here with a -j for bzip2.

    Gzip is faster, but it generally compresses a bit less, so you get a somewhat larger file. Bzip2 is slower, but it compresses a bit more, so you get a somewhat smaller file. Gzip is also more common, with some stripped-down Linux systems including gzip support by default, but not bzip2 support. In general, though, gzip and bzip2 are practically the same thing, and both will work similarly.

    For example, instead of the first example we provided for compressing the stuff directory, you’d run the following command:

    tar -cjvf archive.tar.bz2 stuff
    Terminal running bzip2 compression instead of gzip.

    Extract an Archive

    Once you have an archive, you can extract it with the tar command. The following command will extract the contents of archive.tar.gz to the current directory.

    tar -xzvf archive.tar.gz

    It’s the same as the archive creation command we used above, except the -x switch replaces the -c switch. This specifies you want to extract an archive instead of create one.

    You may want to extract the contents of the archive to a specific directory. You can do so by appending the -C switch to the end of the command. For example, the following command will extract the contents of the archive.tar.gz file to the /tmp directory.

    tar -xzvf archive.tar.gz -C /tmp

    If the file is a bzip2-compressed file, replace the “z” in the above commands with a “j”.

    Run "tar" with"-xzvf" instead of the "-czvf" argument to extract files from a tarball archive.

    This is the simplest possible usage of the tar command. The command includes a large number of additional options, so we can’t possibly list them all here. For more information. run the info tar command at the shell to view the tar command’s detailed information page. Press the q key to quit the information page when you’re done. You can also read tar’s manual online.

    If you’re using a graphical Linux desktop, you could also use the file-compression utility or file manager included with your desktop to create or extract .tar files. On Windows, you can extract and create .tar archives with the free 7-Zip utility.

    Linux Commands
    Filestar · pv · cat · tac · chmod · grep ·  diff · sed · ar · man · pushd · popd · fsck · testdisk
    · seq · fd · pandoc · cd · $PATH · awk · join · jq · fold · uniq · journalctl · tail · stat 
    · ls · fstab · echo · less · chgrp · chown · rev · look · strings · type · rename · zip 
    · unzip · mount · umount · install · fdisk · mkfs · rm · rmdir · rsync · df · gpg · vi 
    · nano · mkdir · du · ln · patch · convert 
    · rclone · shred · srm
    Processesalias · screen · top · nice · renice · progress · strace · systemd · tmux · chsh · history · at 
    · batch · free · which · dmesg · chfn · usermod · ps · chroot · xargs · tty · pinky · lsof 
    · vmstat · timeout · wall · yes · kill · sleep · sudo · su · time · groupadd · usermod 
    · groups · lshw · shutdown · reboot · halt · poweroff · passwd · lscpu · crontab 
    · date · bg · fg
    Networkingnetstat · ping · traceroute · ip · ss · whois · fail2ban · bmon · dig · finger · nmap 
    · ftp · curl · wget · who · whoami · w · iptables · ssh-keygen · ufw

    Resource : https://www.howtogeek.com/248780/how-to-compress-and-extract-files-using -the-tar-command-on-linux/