Taiwanese hardware vendor QNAP warns most of its Network Attached Storage (NAS) devices are impacted by a high severity Linux vulnerability dubbed ‘Dirty Pipe’ that allows attackers with local access to gain root privileges.
The ‘Dirty Pipe’ security bug affects Linux Kernel 5.8 and later versions, even on Android devices. If successfully exploited, it allows non-privileged users to inject and overwrite data in read-only files, including SUID processes that run as root.
Security researcher Max Kellermann who found and reported the bug, also released a proof-of-concept (PoC) exploit that enables local users to modify configurations and gain higher privileges and access.
Dirty COW, a similar Linux vulnerability fixed in 2016, was previously used by malware to root Android devices and plant backdoors, although it was harder to exploit.
While a patch was released for the security flaw one week ago with Linux kernels versions 5.16.11, 5.15.25, and 5.10.102, QNAP says that its customers will have to wait until the company releases its own security updates.
“If exploited, this vulnerability allows an unprivileged user to gain administrator privileges and inject malicious code,” QNAP explained in a security advisory released today.
“Currently there is no mitigation available for this vulnerability. We recommend users to check back and install security updates as soon as they become available.”
Impacts NAS devices running kernel version 5.10.60
The company says that the bug impacts devices running QTS 5.0.x and QuTS hero h5.0.x, including:
- QTS 5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS
- QuTS hero h5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS
You can find a complete list of all affected models on this kernel list page under the “Kernel Version 5.10.60” entry. QNAP added that none of its NAS devices running QTS 4.x are affected and vulnerable to attacks.
Until QNAP releases security updates to address the Dirty Pipe vulnerability, you should ensure that your NAS device is not exposed to Internet attacks to block attempts to gain local access.
Customers who have Internet-exposed NAS devices should take the following measures to defend from attacks:
- Disable the Port Forwarding function of the router: Go to the management interface of your router, check the Virtual Server, NAT, or Port Forwarding settings, and disable the port forwarding setting of NAS management service port (port 8080 and 433 by default).
- Disable the UPnP function of the QNAP NAS: Go to myQNAPcloud on the QTS menu, click the “Auto Router Configuration,” and unselect “Enable UPnP Port forwarding.”
QNAP also provides detailed steps on how to toggle off SSH and Telnet connections and change the system port number, change device passwords and enable IP and account access protection.
