Path traversal in networkd-dispatcher - CVE-2022-29799
Published: April 28, 2022
Vulnerability identifier: #VU62689
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-29799
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in OperationalState or the AdministrativeState. Since the states are used to build the script path, it is possible that a
state would contain directory traversal patterns (e.g. “../../”) to escape from the “/etc/networkd-dispatcher” base directory. A local user can abuse this vulnerability to bypass implemented security restrictions.
Affected software
networkd-dispatcher
Ubuntu
networkd-dispatcher (Ubuntu package)
Ubuntu
networkd-dispatcher (Ubuntu package)
How to mitigate CVE-2022-29799
Install update from vendor's website.
networkd-dispatcher - update to 2.2
networkd-dispatcher (Ubuntu package) - addressed in versions 1.7-0ubuntu3.4, 1.7-0ubuntu3.5, 2.1-2ubuntu0.21.10.1, 2.1-2ubuntu0.21.10.2, 2.1-2ubuntu0.22.04.1, 2.1-2ubuntu0.22.04.2, 2.1-2~ubuntu20.04.2, 2.1-2~ubuntu20.04.3
networkd-dispatcher (Ubuntu package) - addressed in versions 1.7-0ubuntu3.4, 1.7-0ubuntu3.5, 2.1-2ubuntu0.21.10.1, 2.1-2ubuntu0.21.10.2, 2.1-2ubuntu0.22.04.1, 2.1-2ubuntu0.22.04.2, 2.1-2~ubuntu20.04.2, 2.1-2~ubuntu20.04.3