ZDNet reports that Linux desktops could be exploited using vulnerabilities within a commonly used system component to allow privilege escalation and malware installation.
Threat actors could use the Nimbuspwn flaws, tracked as CVE-2022-29799 and CVE-2022-29800, to facilitate root backdoor installation, as well as arbitrary code execution, according to Microsoft.
"Moreover, the Nimbuspwn vulnerabilities could potentially be leveraged as a vector for root access by more sophisticated threats, such as malware or ransomware, to achieve greater impact on vulnerable devices," said Microsoft.
Both bugs have been identified within the networkd-dispatcher service for systemd-networkd network connection status changes. Microsoft researchers were able to determine the flaws through System Bus messages heard during code reviews and service analysis. Malicious actors have long been attracted to attacking D-Bus components used on Linux distributions to compromise System Bus, according to Microsoft 365 Defender Research Team Lead Jonathan Bar Or.
"D-Bus exposes a global System Bus and a per-session Session Bus. From an attacker's perspective, the System Bus is more attractive since it will commonly have services that run as root listening to it," Or said.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.