Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Ubuntu 24.04 features for root privilege escalation

snyk.io

Post reply on HN
Print view View original

11–20 of 83 posts

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#11

Post by cherryteastain »

justmarc wrote: post #10
nneonneo wrote: post #8

Earlier quoted context omitted.

To be precise: you don't need to be in the sudo group, but in the lpadmin group. I'm not familiar with how Ubuntu groups are set up, but I guess it's likely that lpadmin is only granted to administrators by default. That said, I'm guessing people aren't expecting lpadmin to mean a full privilege escalation to root. There are two bugs here: one in cups, which allows it to chmod anything 777 (doesn't properly check for…

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

And that new solution will have only 70% of cups' features 15 years in with tons of gotchas in everyday use cases, like wayland

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#12

Post by pzmarzly »

cherryteastain wrote: post #11
justmarc wrote: post #10

Earlier quoted context omitted.

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

And that new solution will have only 70% of cups' features 15 years in with tons of gotchas in everyday use cases, like wayland

> new solution will have only 70% of cups' features 15 years

Which sounds fine? Most people don't want LPT printers support, they want AirPrint and WSD to just work.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#13

Post by withinboredom »

rlpb wrote: post #9
LeifCarrotson wrote: post #6

Earlier quoted context omitted.

They can execute anything they like as root... by entering their password. This post shows a way that clever code can execute anything it likes as root without knowing the user's password. That seems pretty significant to me.

> They can execute anything they like as root... by entering their password. If it has control of your user account, then it can just arrange to wrap your shell prompt and wait for you to sudo something else. The sudo password prompt in its default arrangement doesn't really provide much security there and isn't expected to.

On a server, you may be waiting months for that human to login and use sudo. Maybe even years.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#14

Post by compsciphd »

justmarc wrote: post #10
nneonneo wrote: post #8

Earlier quoted context omitted.

To be precise: you don't need to be in the sudo group, but in the lpadmin group. I'm not familiar with how Ubuntu groups are set up, but I guess it's likely that lpadmin is only granted to administrators by default. That said, I'm guessing people aren't expecting lpadmin to mean a full privilege escalation to root. There are two bugs here: one in cups, which allows it to chmod anything 777 (doesn't properly check for…

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

or just sandbox cups. There's no reason cups needs to write anything beyond its "configuration" and its "print spool". And hence, shouldn't have access to anything beyond what it needs to configure itself and print.

thing like cups should be easy to sandbox, especially if we allow dbus like APIs as a means to cross sandbox boundaries (i.e. RPC mechanism).

and by sandbox, I dont mean simply use apparmor type rules (though that can work), but a cups that lives within its own file system and nothing else is even visible.

i.e. programs will always be buggy, even if we get rid of all language oriented bugs, there will still be logic bugs that will result in security holes. We just need to make it easy to isolate programs (and services) into their own sandboxes while retaining the ability for them to interact (as otherwise, lose much of the value of modern systems).

In practice, I would argue, a lot of modern systems do this already (ala ios/android). The apps run sandboxed and only have restricted abilities to interact with each other.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#15

Post by samlinnfer »

24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config.

See here: https://news.ycombinator.com/item?id=42133181

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#16

Post by ale42 »

pzmarzly wrote: post #12
cherryteastain wrote: post #11

Earlier quoted context omitted.

And that new solution will have only 70% of cups' features 15 years in with tons of gotchas in everyday use cases, like wayland

> new solution will have only 70% of cups' features 15 years Which sounds fine? Most people don't want LPT printers support, they want AirPrint and WSD to just work.

How many percent is "most" people? What about enterprise users with complex setups/requirements, will they be supported or out-of-luck? Typically you'll have print servers with centralized authentication, possibly logging/auditing/billing, any this might depend on "the" component they'll leave out in the new product because, well, most people don't care about it...

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#17

Post by rlpb »

withinboredom wrote: post #13
rlpb wrote: post #9

Earlier quoted context omitted.

> They can execute anything they like as root... by entering their password. If it has control of your user account, then it can just arrange to wrap your shell prompt and wait for you to sudo something else. The sudo password prompt in its default arrangement doesn't really provide much security there and isn't expected to.

On a server, you may be waiting months for that human to login and use sudo. Maybe even years.

That's not really relevant nowadays. Most attacks are done indiscriminately and en-masse, so an attacker wouldn't have to wait very long in practice.

Only in "advanced persistent thread" territory is your point really relevant, but the attack I describe is much more widely applicable. Having to wait a while is therefore not in any way a mitigation. In practice then, one cannot assume any security from sudo requiring a password.

https://en.wikipedia.org/wiki/Advanced_persistent_threat

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#18

Post by dTal »

BonusPlay wrote: post #4

Linux Local Privilege Escalation, but the attacker has to be in sudo group in the first place. Great read, but this feels like academic research. Technically correct, but impractical at best.

If that is your attitude, why bother with the sudo group at all? Just run as root.

(For what it's worth, I think most people would not lose much security from running as root, and the obsession with sudo is so much security theater, for exactly this sort of reason.)

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#19

Post by [deleted] »

justmarc wrote: post #10
nneonneo wrote: post #8

Earlier quoted context omitted.

To be precise: you don't need to be in the sudo group, but in the lpadmin group. I'm not familiar with how Ubuntu groups are set up, but I guess it's likely that lpadmin is only granted to administrators by default. That said, I'm guessing people aren't expecting lpadmin to mean a full privilege escalation to root. There are two bugs here: one in cups, which allows it to chmod anything 777 (doesn't properly check for…

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

[deleted]

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#20

Post by nikanj »

justmarc wrote: post #10
nneonneo wrote: post #8

Earlier quoted context omitted.

To be precise: you don't need to be in the sudo group, but in the lpadmin group. I'm not familiar with how Ubuntu groups are set up, but I guess it's likely that lpadmin is only granted to administrators by default. That said, I'm guessing people aren't expecting lpadmin to mean a full privilege escalation to root. There are two bugs here: one in cups, which allows it to chmod anything 777 (doesn't properly check for…

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

Using modern tools and standards? So build with node.js, runs like a pig, only supports the three models made by the sponsoring company?
Post reply on HN