boneIOのblack_debian_imagesに権限昇格の脆弱性、1.6.0で修正
Summary
boneIO向けDebianイメージのサービス用アカウントに、パスワードなしのsudoとdockerグループ所属が付いており、rootへの権限昇格につながります。1.2.0以上1.6.0未満のイメージを使う機器が対象で、1.6.0への更新で解消します。稼働中の機器を洗い出し、計画を立てて更新してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
boneIO向けDebianイメージのサービス用アカウントに、パスワードなしのsudoとdockerグループ所属が付いており、rootへの権限昇格につながります。1.2.0以上1.6.0未満のイメージを使う機器が対象で、1.6.0への更新で解消します。稼働中の機器を洗い出し、計画を立てて更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| boneIO | black_debian_images |
≥ 1.2.0, < 1.6.0 |
1.6.0 |
Original description The description as published by the source.
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.
This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web cvd@cert.pl
- web cvd@cert.pl
- web nvd.nist.gov
- web github.com