CVE-2022-1804
📋 TL;DR
CVE-2022-1804 is a privilege escalation vulnerability in accountsservice where the service fails to drop elevated permissions when writing to .pam_environment files. This allows local attackers to write arbitrary content to user-specific environment files, potentially leading to privilege escalation. Affected systems are Linux distributions using accountsservice, particularly Ubuntu.
💻 Affected Systems
- accountsservice
📦 What is this software?
Accountsservice by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges by manipulating environment files to execute arbitrary code with elevated permissions.
Likely Case
Local user modifies another user's environment configuration to gain unauthorized access or disrupt operations.
If Mitigated
Attack limited to environment file manipulation without direct privilege escalation if proper file permissions are enforced.
🎯 Exploit Status
Exploitation requires local access and understanding of pam_environment file manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: accountsservice 22.07.5-2ubuntu1.3 for Ubuntu 22.04, 0.6.55-0ubuntu12~20.04.5 for Ubuntu 20.04
Vendor Advisory: https://ubuntu.com/security/notices/USN-5439-1
Restart Required: No
Instructions:
1. Update package: sudo apt update && sudo apt install accountsservice. 2. Verify version matches patched version.
🔧 Temporary Workarounds
Restrict accountsservice permissions
linuxLimit accountsservice access through systemd or permissions to reduce attack surface.
sudo systemctl mask accountsservice
sudo chmod 600 /etc/pam.d/*
🧯 If You Can't Patch
- Monitor and audit .pam_environment file modifications for suspicious activity.
- Implement strict user privilege separation and limit local user access where possible.
🔍 How to Verify
Check if Vulnerable:
Check accountsservice version: dpkg -l | grep accountsserviceCheck Version:
dpkg -l | grep accountsserviceVerify Fix Applied:
Verify installed version matches patched version from vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to .pam_environment files in user home directories
- Accountsservice process spawning unexpected file writes
Network Indicators:
- None - local exploit only
SIEM Query:
source="syslog" AND "accountsservice" AND ("write" OR "modify") AND ".pam_environment"