Dropbear: privilege escalation via unix domain socket forwardings
Résumé
Dropbear: privilege escalation via unix domain socket forwardings
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the remote client as root,
only switching to the logged-in user upon spawning a shell or performing
some operations like reading the user's files.
With the recent ability of also using unix domain sockets as the forwarding destination any user able to log in via ssh can connect to any unix socket with the root's credentials, bypassing both file system restrictions and any SO_PEERCRED / SO_PASSCRED checks performed by the peer.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2025-14282 dropbear Corrigé dans: 2025.89-r0
- Debian DEBIAN-CVE-2025-14282 dropbear Corrigé dans: 2025.89-1~deb13u1
- Ubuntu UBUNTU-CVE-2025-14282 dropbear
Références
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- report bugzilla.redhat.com
- web openwall.com
- web openwall.com
- web github.com
- web lists.ucc.gu.uwa.edu.au