Pierluigi Paganini
November 22, 2023
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Looney Tunables Linux vulnerability to its .
The vulnerability (CVSS score 7.8), aka Looney Tunables, is a buffer overflow issue that resides in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. An attacker can trigger the vulnerability to execute code with elevated privileges.
“A buffer overflow was discovered in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.” .
Researchers at Qualys’ Threat Research Unit disclosed the vulnerability, also named Looney Tunables, last week and published a .
The buffer overflow affects multiple Linux distros, including Debian, Fedora, and Ubuntu.
The researchers highlighted the widespread nature of this vulnerability.
“We have successfully identified and exploited this vulnerability (a local privilege escalation that grants full root privileges) on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13.” reads the published by Qualys. “It’s likely that other distributions are similarly susceptible, although we’ve noted that Alpine Linux remains an exception due to its use of musl libc instead of glibc. This vulnerability was introduced in April 2021.”
Multiple security researchers have already developed their own proof-of-concept exploits for this flaw.
According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix these vulnerabilities by December 12, 2023.
Researchers from Aqua Nautilus spotted experimental incursions into cloud environments by Kinsing actors. The attackers used a rudimentary yet PHPUnit vulnerability exploit, they attempted to manipulate the Looney Tunables vulnerability (). The experts pointed out that this marks the first documented instance of such an exploit.
“This marks the first documented instance of such an exploit, to the best of our knowledge.” reads the published by Aqua firm. “Intriguingly, the attacker is also broadening the horizons of their cloud-native attacks by extracting credentials from the Cloud Service Provider (CSP).”
The discovery demonstrates that Kinsing actors are rapidly adding new exploits to their arsenal, expanding the potential targets. Recently, observers noticed Kinsing actors .
Kinsing actors often exploited the PHPUnit vulnerability () and it engaged in fully automated attacks as part of mining cryptocurrency. With the recent discovery, the experts observed Kinsing conducting manual tests, which marks a deviation from their usual modus operandi.
Experts noted the attackers using a Python-based Linux local privilege escalation exploit published by the researcher
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, CISA)
