{"uuid": "a0b07220-b38f-453e-b470-8062f8956dbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3939", "type": "seen", "source": "https://t.me/hacking_Attack/34888", "content": "Black Hat Ethical Hacking\nAttackers can get root by crashing Ubuntu\u2019s AccountsService\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Attackers can get root by crashing Ubuntu\u2019s AccountsServicePost Views: 190 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA local privilege escalation security vulnerability could allow attackers to gain root access on Ubuntu systems by exploiting a double-free memory corruption bug in GNOME\u2019s AccountsService component. AccountsService\u00a0is a D-Bus service that helps manipulate and query information attached to the user accounts available on a device.\n\nThe security flaw (a memory management bug tracked as CVE-2021-3939) was accidentally spotted by GitHub security researcher Kevin Backhouse while testing an exploit demo for another AccountsService bug that also made it possible to escalate privileges to root\u00a0on vulnerable devices.\n\n\u201cAccountsService could be made to crash or run programs as an administrator if it received a specially crafted command,\u201d an Ubuntu security advisory explains.\n\nBackhouse found that AccountsService incorrectly handled memory during some language setting operations, a flaw that local attackers could abuse to escalate privileges.\n\nThe bug only affects Ubuntu\u2019s fork of AccountsService. Versions impacted by this vulnerability include Ubuntu 21.10, Ubuntu 21.04, and Ubuntu 20.04 LTS.\n\nThis privilege escalation flaw was fixed by Canonical\u00a0in November when AccountsService versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1 were released. After applying the updates, you will also need to restart the computer to apply the changes.\nSee Also: Complete Offensive Security and Ethical Hacking Course Not the fastest, but definitely reliableAs he explains, his CVE-2021-3939 proof of concept exploit\u00a0is slow (could that several hours) and will not work every time. However, it doesn\u2019t matter since it can be executed until successful, seeing that the double-free bug allows crashing AccountsService as many times as needed.\n\nThe only restriction to successfully exploiting this bug is that the AccountsService crashes are rate-limited by systemd, blocking attempts to restart it more than five times every 10 seconds.\nPoC video for Ubuntu accountsservice CVE-2021-3939. It's not quick, but it gets you a root shell eventually. https://t.co/YBQStkalNY pic.twitter.com/RRs2vF3vdH\n\n\u2014 Kevin Backhouse (@kevin_backhouse) December 13, 2021\nSee Also: New Windows zero-day with public exploit lets you become an admin\n\u201cIt relies on chance and the fact that I can keep crashing accountsservice until it\u2019s successful. But would an attacker care? It gets you a root shell, even if you have to wait a few hours,\u201d Backhouse said.\n\n\u201cTo me, it feels like magic that it\u2019s even possible to exploit such a small bug, especially considering all the mitigations that have been added to make memory corruption vulnerabilities harder to exploit. Sometimes, all it takes to get root is a little wishful thinking!\u201d\n\nFurther details on how the vulnerability was found and the exploit developed are available in Backhouse\u2019s CVE-2021-3939 writeup.\nSee Also: Offensive Security Tool: Cobalt Strike\nEarlier this year, the researcher found an authentication bypass vulnerability in the polkit Linux system service that enabled unprivileged attackers to get a root shell on most modern distros.\nSee Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nSource: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled[...]", "creation_timestamp": "2026-09-01T20:02:04.385281Z"}