Bash2Shell

Summary

Security researchers have discovered a critical vulnerability dubbed Bash2Shell, which allows an attacker with root access to a Linux system to execute arbitrary code with root privileges.

The vulnerability is caused by a fundamental flaw in the Linux privilege model: users who already have complete administrative control over a system can perform actions requiring complete administrative control.

Technical Details

Successful exploitation requires the attacker to:

1. Obtain root access to the target system.
2. Open a shell.
3. Execute arbitrary commands.

No authentication bypass, privilege escalation, memory corruption, or sophisticated exploitation techniques are required.

Researchers confirmed a 100% success rate across all tested systems where the attacker already had root privileges.

Proof of Concept

sudo -i
bash
whoami
# root

Researchers describe the exploit as "trivial to reproduce, impossible to mitigate, and deeply concerning to anyone who has misunderstood the threat model."

Impact

Successful exploitation may result in:

• Arbitrary code execution as root.
• Complete system compromise.
• Unauthorized modification of system files.
• Installation of persistent backdoors.
• Unscheduled changes to /etc/motd.
• Uncontrollable feelings of superiority over non-root users.

Mitigation

The following mitigations are recommended:

• Immediate: Revoke root access from anyone who has root access.
• Short term: Avoid executing commands as root.
• Long term: Consider migrating to a system where attackers cannot obtain root access, even after obtaining root access.
• Emergency workaround: Remove Bash. Then discover that /bin/sh exists.

Vendor Response

The Linux community has acknowledged the report and classified the issue as working as intended.

GNU maintainers have reportedly responded:

"If an attacker already has root, they can execute arbitrary code as root. We consider this a feature, not a bug."

Credits

Discovered by the Center for Extremely Obvious Vulnerabilities (CEOV) during a routine penetration test in which the tester was accidentally given full administrative access.