Cloudanix VulnDB

CVE-2017-6964

High · 7.8

CVSS

7.8

EPSS

0.5%

Published

Mar 28, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A disk-handling program on older Linux computers can let an ordinary user gain complete control of the machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes dmcrypt-get-device to skip dropping privileges when setuid or setgid return failure, allowing code that should run unprivileged to execute with root rights.

Why it matters to the business

Local attackers can obtain full administrative control of affected Linux systems, risking data theft, service disruption, or persistent unauthorized access on servers and workstations still running old eject packages.

How an attack unfolds

An authenticated local user invokes dmcrypt-get-device; because the script does not verify that setuid and setgid succeeded, subsequent operations run with root privileges instead of the caller's unprivileged context.

How to fix it

Upgrade the eject package to a fixed release on each distribution (Debian after 2.1.5+deb1+cvs20081104-13.1, Ubuntu 16.10 after 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1, Ubuntu 16.04 after 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1, Ubuntu 14.04 after 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1, Ubuntu 12.04 after 2.1.5+deb1+cvs20081104-9ubuntu0.1) and restart any dependent services.

How to confirm the fix worked

Confirm the installed eject package version is newer than the listed vulnerable releases, then run the binary under a non-root account and verify that setuid/setgid failures cause immediate exit rather than continued root execution.

Typical attack path

  1. Obtain a local shell on the target system
  2. Locate and execute dmcrypt-get-device
  3. Trigger the unchecked setuid/setgid path to retain root rights
  4. Perform privileged actions such as installing backdoors or exfiltrating data

How to detect it

Search authentication and process execution logs for invocations of dmcrypt-get-device or eject binaries that result in root-owned child processes; correlate with unexpected root shells or setuid binaries appearing after local user activity.

  • dmcrypt-get-device
  • eject[0-9a-f]*: setuid failed

What your security team should do

  • Patch eject on all Debian and Ubuntu systems to the fixed package versions
  • Inventory hosts still running eject <= 2.1.5+deb1+cvs20081104-13.1 and prioritize them for remediation
  • Remove or restrict local accounts that do not require the eject utility

The record

dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might cause dmcrypt-get-device to execute code, which was intended to run as an unprivileged user, as root. This affects eject through 2.1.5+deb1+cvs20081104-13.1 on Debian, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS, and eject before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS.

Affected packages

Ecosystem Package Introduced Fixed
Debian:7 eject 0 2.1.5+deb1+cvs20081104-13+deb7u1
Debian:8 eject 0 2.1.5+deb1+cvs20081104-13.1+deb8u1
Ubuntu:14.04:LTS eject 0 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1
Ubuntu:16.04:LTS eject 0 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1

Related vulnerabilities