Vulnerabilities > CVE-2017-0358 - Improper Privilege Management vulnerability in multiple products

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
tuxera
debian
CWE-269
nessus
exploit available
metasploit

Summary

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.

Vulnerable Configurations

Part Description Count
Application
Tuxera
1
OS
Debian
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.

Exploit-Db

  • fileexploits/linux/local/41356.txt
    idEDB-ID:41356
    last seen2018-11-30
    modified2017-02-14
    platformlinux
    port
    published2017-02-14
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/41356
    titlentfs-3g - Unsanitized modprobe Environment Privilege Escalation
    typelocal
  • descriptionntfs-3g (Debian 9) - Privilege Escalation. CVE-2017-0358. Local exploit for Linux platform
    fileexploits/linux/local/41240.sh
    idEDB-ID:41240
    last seen2017-02-04
    modified2017-02-03
    platformlinux
    port
    published2017-02-03
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/41240/
    titlentfs-3g (Debian 9) - Privilege Escalation
    typelocal

Metasploit

descriptionntfs-3g mount helper in Ubuntu 16.04, 16.10, Debian 7, 8, and possibly 9 does not properly sanitize the environment when executing modprobe. This can be abused to load a kernel module and execute a binary payload as the root user.
idMSF:EXPLOIT/LINUX/LOCAL/NTFS3G_PRIV_ESC
last seen2020-06-08
modified2018-10-10
published2017-02-26
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/local/ntfs3g_priv_esc.rb
titleDebian/Ubuntu ntfs-3g Local Privilege Escalation

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3587-1.NASL
    descriptionThis update for ntfs-3g_ntfsprogs fixes the following issues : CVE-2017-0358: Missing sanitization of the environment during a call to modprobe allowed local users to escalate fo root privilege (bsc#1022500) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id118587
    published2018-11-01
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118587
    titleSUSE SLED12 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2018:3587-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-815.NASL
    descriptionJann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation. For Debian 7
    last seen2020-03-17
    modified2017-02-03
    plugin id96963
    published2017-02-03
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96963
    titleDebian DLA-815-1 : ntfs-3g security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-1376.NASL
    descriptionThis update for ntfs-3g_ntfsprogs fixes the following issues : - CVE-2017-0358: Missing sanitization of the environment during a call to modprobe allowed local users to escalate fo root privilege (bsc#1022500) This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2018-11-10
    plugin id118874
    published2018-11-10
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118874
    titleopenSUSE Security Update : ntfs-3g_ntfsprogs (openSUSE-2018-1376)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3182-1.NASL
    descriptionJann Horn discovered that NTFS-3G incorrectly filtered environment variables when using the modprobe utility. A local attacker could possibly use this issue to load arbitrary kernel modules. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96951
    published2017-02-02
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96951
    titleUbuntu 16.04 LTS / 16.10 : ntfs-3g vulnerability (USN-3182-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201702-10.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201702-10 (NTFS-3G: Privilege escalation) The NTFS-3G driver does not properly clear environment variables before invoking mount or umount. This flaw is similar to the vulnerability described in “GLSA-201701-19” and “GLSA-201603-04” referenced below but is now implemented in the NTFS-3G driver itself. Impact : A local user could gain root privileges. Workaround : There is no known workaround at this time. However, on Gentoo when the “suid” USE flag is not set (which is the default) an attacker cannot exploit the flaw.
    last seen2020-06-01
    modified2020-06-02
    plugin id97253
    published2017-02-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97253
    titleGLSA-201702-10 : NTFS-3G: Privilege escalation
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3587-2.NASL
    descriptionThis update for ntfs-3g_ntfsprogs fixes the following issues : CVE-2017-0358: Missing sanitization of the environment during a call to modprobe allowed local users to escalate fo root privilege (bsc#1022500) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id119672
    published2018-12-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119672
    titleSUSE SLED12 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2018:3587-2)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3780.NASL
    descriptionJann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
    last seen2020-06-01
    modified2020-06-02
    plugin id96933
    published2017-02-02
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96933
    titleDebian DSA-3780-1 : ntfs-3g - security update

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/141882/ntfs3g_priv_esc.rb.txt
idPACKETSTORM:141882
last seen2017-04-10
published2017-04-04
reporterh00die
sourcehttps://packetstormsecurity.com/files/141882/Debian-Ubuntu-ntfs-3g-Local-Privilege-Escalation.html
titleDebian/Ubuntu ntfs-3g Local Privilege Escalation

Seebug

bulletinFamilyexploit
descriptionSource: [https://bugs.chromium.org/p/project-zero/issues/detail?id=1072](https://bugs.chromium.org/p/project-zero/issues/detail?id=1072) ntfs-3g is installed by default e.g. on Ubuntu and comes with a setuid root program /bin/ntfs-3g. When this program is invoked on a system whose kernel does not support FUSE filesystems (detected by get_fuse_fstype()), ntfs-3g attempts to load the "fuse" module using /sbin/modprobe via load_fuse_module(). The issue is that /sbin/modprobe is not designed to run in a setuid context. As the manpage of modprobe explicitly points out: The MODPROBE_OPTIONS environment variable can also be used to pass arguments to modprobe. Therefore, on a system that does not seem to support FUSE filesystems, an attacker can set the environment variable MODPROBE_OPTIONS to something like "-C /tmp/evil_config -d /tmp/evil_root" to force modprobe to load its configuration and the module from attacker-controlled directories. This allows a local attacker to load arbitrary code into the kernel. In practice, the FUSE module is usually already loaded. However, the issue can still be attacked because a failure to open /proc/filesystems (meaning that get_fuse_fstype() returns FSTYPE_UNKNOWN) always causes modprobe to be executed, even if the FUSE module is already loaded. An attacker can cause an attempt to open /proc/filesystems to fail by exhausting the global limit on the number of open file descriptions (/proc/sys/fs/file-max). I have attached an exploit for the issue. I have tested it in a VM with Ubuntu Server 16.10. To reproduce, unpack the attached file, compile the exploit and run it: ```bash user@ubuntu:~$ tar xf ntfs-3g-modprobe-unsafe.tar user@ubuntu:~$ cd ntfs-3g-modprobe-unsafe/ user@ubuntu:~/ntfs-3g-modprobe-unsafe$ ./compile.sh make: Entering directory '/usr/src/linux-headers-4.8.0-32-generic' CC [M] /home/user/ntfs-3g-modprobe-unsafe/rootmod.o Building modules, stage 2. MODPOST 1 modules CC /home/user/ntfs-3g-modprobe-unsafe/rootmod.mod.o LD [M] /home/user/ntfs-3g-modprobe-unsafe/rootmod.ko make: Leaving directory '/usr/src/linux-headers-4.8.0-32-generic' depmod: WARNING: could not open /home/user/ntfs-3g-modprobe-unsafe/depmod_tmp//lib/modules/4.8.0-32-generic/modules.order: No such file or directory depmod: WARNING: could not open /home/user/ntfs-3g-modprobe-unsafe/depmod_tmp//lib/modules/4.8.0-32-generic/modules.builtin: No such file or directory user@ubuntu:~/ntfs-3g-modprobe-unsafe$ ./sploit looks like we won the race got ENFILE at 198088 total Failed to open /proc/filesystems: Too many open files in system yay, modprobe ran! modprobe: ERROR: ../libkmod/libkmod.c:514 lookup_builtin_file() could not open builtin file '/tmp/ntfs_sploit.u48sGO/lib/modules/4.8.0-32-generic/modules.builtin.bin' modprobe: ERROR: could not insert 'rootmod': Too many levels of symbolic links Error opening '/tmp/ntfs_sploit.u48sGO/volume': Is a directory Failed to mount '/tmp/ntfs_sploit.u48sGO/volume': Is a directory we have root privs now... root@ubuntu:~/ntfs-3g-modprobe-unsafe# id uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lxd),123(libvirt),127(sambashare),128(lpadmin),1000(user) ``` Note: The exploit seems to work relatively reliably in VMs with multiple CPU cores, but not in VMs with a single CPU core. If you test this exploit in a VM, please ensure that the VM has at least two CPU cores. Proof of Concept:[https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41356.zip](https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41356.zip)
idSSV:92684
last seen2017-11-19
modified2017-02-15
published2017-02-15
reporterRoot
titlentfs-3g - Unsanitized modprobe mention the right Vulnerability( CVE-2017-0358)