PCP (Performance Co-Pilot) al\u0259tind\u0259, sistemin performans\u0131 haqq\u0131nda statistik m\u0259lumat toplamaq \u00fc\u00e7\u00fcn istifad\u0259 edil\u0259n (m\u0259s\u0259l\u0259n, Cockpit interfeysind\u0259) iki t\u0259hl\u00fck\u0259sizlik z\u0259ifliyi a\u015fkarlan\u0131b. Birinci z\u0259iflik (CVE-2024-45770) pmpost yard\u0131m proqram\u0131nda m\u00f6vcuddur, bu proqram loga mesaj g\u00f6nd\u0259rm\u0259k m\u0259qs\u0259dini g\u00fcd\u00fcr v\u0259 m\u00fc\u0259yy\u0259n i\u015f\u0259 salma \u015f\u0259raitind\u0259 art\u0131r\u0131lm\u0131\u015f imtiyazlarla i\u015f\u0259 sal\u0131na bil\u0259r. Z\u0259ifliyin exploit edilm\u0259si, root h\u00fcquqlar\u0131 il\u0259 kodun icras\u0131n\u0131 m\u00fcmk\u00fcn edir, amma h\u00fccum \u00fc\u00e7\u00fcn PCP hesab\u0131na \u00e7\u0131x\u0131\u015fa malik olmaq laz\u0131md\u0131r. H\u00fccum, «\/var\/log\/pcp\/NOTICES» fayl\u0131n\u0131 simvolik linkl\u0259 \u0259v\u0259z etm\u0259kl\u0259 h\u0259yata ke\u00e7irilir ki, burada root h\u00fcquqlar\u0131 il\u0259 yaz\u0131 realla\u015f\u0131r v\u0259 fayl a\u00e7\u0131ld\u0131qda O_NOFOLLOW flaq\u0131 istifad\u0259 edilmir. <\/p>\n
\u0130kinci z\u0259iflik PCP-d\u0259 (CVE-2024-45769) pcmd arxa prosesini t\u0259sir edir v\u0259 x\u00fcsusi formatl\u0131 m\u0259lumatlar\u0131n g\u00f6nd\u0259rilm\u0259si zaman\u0131 tampon xaricind\u0259ki yadda\u015fa m\u00fcraci\u0259t edir. Z\u0259ifliyin t\u0259hl\u00fck\u0259si, pcmd-d\u0259 \u015f\u0259b\u0259k\u0259 sor\u011fular\u0131n\u0131n dig\u0259r sisteml\u0259rd\u0259n q\u0259bul edilm\u0259sinin deaktiv edilm\u0259si il\u0259 azald\u0131l\u0131r. Z\u0259iflikl\u0259r PCP 6.3.1 versiyas\u0131nda aradan qald\u0131r\u0131l\u0131b. Probleml\u0259r SUSE layih\u0259sinin inki\u015faf etdiricil\u0259ri t\u0259r\u0259find\u0259n h\u0259yata ke\u00e7iril\u0259n audit zaman\u0131 a\u015fkar edilib. <\/p>\n
Bundan \u0259lav\u0259, Nix paket menecerind\u0259 (NixOS paylanmas\u0131nda istifad\u0259 olunur) a\u015fkar edilmi\u015f bir z\u0259iflik (CVE-2024-45593) var. Z\u0259iflik, x\u00fcsusi formatda NAR (Nix Archive) fayllar\u0131n\u0131 a\u00e7ark\u0259n, icra\u00e7\u0131 h\u00fcquqlar\u0131n\u0131 n\u0259z\u0259r\u0259 alaraq fayl sistemind\u0259 ist\u0259nil\u0259n sah\u0259l\u0259r\u0259 yaz\u0131 icras\u0131na imkan verir. Problem Nix 2.24 versiyas\u0131nda \u00f6z\u00fcn\u00fc g\u00f6st\u0259rir v\u0259 2.24.6 versiyas\u0131nda aradan qald\u0131r\u0131l\u0131r. <\/p>\n
Bundan \u0259lav\u0259, GNU\/Linux distributivl\u0259rini t\u0259sir ed\u0259n v\u0259 uzaqdan, autentifikasiya ke\u00e7m\u0259d\u0259n sistemd\u0259 kod icrac\u0131na s\u0259b\u0259b olan kritik z\u0259ifliyin a\u015fkarland\u0131\u011f\u0131na dair x\u0259b\u0259rdarl\u0131\u011f\u0131 xat\u0131rlamaq olar. Hal-haz\u0131rda problemin mahiyy\u0259ti v\u0259 onun t\u0259sir etdiyi alt sisteml\u0259r haqq\u0131nda he\u00e7 bir m\u0259lumat verilmir, yaln\u0131z deyilir ki, distributiv inki\u015faf etdiricil\u0259ri il\u0259 raz\u0131la\u015fma \u0259sas\u0131nda problemin ilkin hesabat\u0131 30 sentyabrda, tam hesabat is\u0259 6 oktyabrda n\u0259\u015fr edil\u0259c\u0259k. CVE problem\u0259 h\u0259l\u0259 verilm\u0259yib. Problemi a\u015fkarlayan t\u0259dqiqat\u00e7\u0131n\u0131n b\u0259yanat\u0131na g\u00f6r\u0259, Canonical v\u0259 Red Hat bu z\u0259ifliy\u0259 kritik t\u0259hl\u00fck\u0259 s\u0259viyy\u0259si (10-dan 9.9) t\u0259yin edibl\u0259r. \u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 PCP (Performance Co-Pilot), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Cockpit), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-45770) \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pmpost, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u043b\u043e\u0433 \u0438 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u043e\u0439 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043d\u043e \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119929","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PCP v\u0259 Nix-d\u0259 imtiyazlar\u0131n art\u0131r\u0131lmas\u0131na imkan ver\u0259n z\u0259iflikl\u0259r | ProHoster","description":"PCP (Performance Co-Pilot) al\u0259tind\u0259, sistemin performans statistikalar\u0131n\u0131 toplamaq \u00fc\u00e7\u00fcn istifad\u0259 olunan (m\u0259s\u0259l\u0259n, Cockpit interfeysind\u0259 istifad\u0259 olunur), iki z\u0259iflik a\u015fkar edilmi\u015fdir.","canonical_url":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PCP \u0438 Nix, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 PCP (Performance Co-Pilot), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Cockpit), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-24T07:43:11+00:00","article:modified_time":"2024-09-24T07:43:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119929","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 06:47:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:47:22","updated":"2026-01-23 06:47:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/119929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=119929"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/119929\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=119929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=119929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=119929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
M\u0259nb\u0259: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"