Taiwanese hardware vendor QNAP warns that most of its Network Attached Storage (NAS) devices are affected by a very serious Linux vulnerability called “Dirty Pipe” that allows attackers with local access to gain root privileges.
The ‘Dirty Pipe’ security bug affects Linux Kernel 5.8 and later versions, even on Android devices. If exploited successfully, unprivileged users can inject and overwrite data in read-only files, including SUID processes running as root.
Security researcher Max Kellermann who discovered and reported the bug also released a proof-of-concept (PoC) exploit that allows local users to change configurations and gain higher privileges and access.
Dirty COW, a similar Linux vulnerability that was fixed in 2016, was previously used by malware to root Android devices and install backdoors, although it was more difficult to exploit.
Although a patch was released a week ago for the security flaw with Linux kernels versions 5.16.11, 5.15.25 and 5.10.102, QNAP says its customers will have to wait for the company to release its own security updates.
“If exploited, this vulnerability allows an unauthorized user to gain administrative privileges and inject malicious code,” QNAP explained in a security advisory released today.
“There is currently no fix for this vulnerability. We encourage users to come back and install security updates as they become available.”
Affects NAS devices with kernel version 5.10.60
The company says the bug affects devices running QTS 5.0.x and QuTS hero h5.0.x, including:
QTS 5.0.x on all QNAP x86-based NAS and select QNAP ARM-based NAS QuTS hero h5.0.x on all QNAP x86-based NAS and select QNAP ARM-based NAS
You can find a full list of all affected models on this kernel listing page under the entry “Kernel Version 5.10.60”. QNAP added that none of its NAS devices with QTS 4.x are affected and vulnerable to attack.
Until QNAP releases security updates to address the Dirty Pipe vulnerability, make sure your NAS device is not exposed to internet attacks to block local access attempts.
Customers with NAS devices exposed to the Internet should take the following measures to protect against attacks:
To disable the router’s Port Forwarding feature: Go to your router’s management interface, check the Virtual Server, NAT, or Port Forwarding settings, and disable the port forwarding setting of the NAS management service port (default port 8080 and 433). Disable the UPnP function of the QNAP NAS: Go to myQNAPcloud in the QTS menu, click “Auto Router Configuration” and uncheck “Enable UPnP Port forwarding”.
QNAP also provides detailed steps for disabling SSH and Telnet connections and changing the system port number, changing device passwords, and enabling IP and account access protection.
This post QNAP Warns Serious Linux Bug Affects Most NAS Devices
was original published at “https://www.bleepingcomputer.com/news/security/qnap-warns-severe-linux-bug-affects-most-of-its-nas-devices/”
