{"id":41582,"date":"2020-02-12T16:19:30","date_gmt":"2020-02-12T13:19:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii"},"modified":"2020-02-12T16:19:30","modified_gmt":"2020-02-12T13:19:30","slug":"uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"systemd-d\u0259 \u00f6z imtiyazlar\u0131n\u0131 art\u0131rmas\u0131na imkan ver\u0259n z\u0259iflik a\u015fkar edildi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

systemd sistem menecerind\u0259 k\u0259\u015ff edilib<\/a><\/noindex> a\u00e7\u0131kl\u0131\u011f\u0131 (CVE-2020-1712<\/a><\/noindex>), bu, DBus avtobusuna x\u00fcsusi haz\u0131rlanm\u0131\u015f bir sor\u011fu g\u00f6nd\u0259r\u0259r\u0259k, y\u00fcks\u0259ldilmi\u015f h\u00fcquqlarla \u00f6z kodunun icras\u0131n\u0131 t\u0259min etm\u0259y\u0259 imkan verir. Problemin h\u0259lli test burax\u0131l\u0131\u015f\u0131nda yer al\u0131r systemd 245-rc1<\/a><\/noindex> (problemi h\u0259ll ed\u0259n yamalar: 1<\/a><\/noindex>, 2<\/a><\/noindex>, 3<\/a><\/noindex>). Z\u0259iflik, Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex>, RHEL<\/a><\/noindex> (RHEL 8-d\u0259 g\u00f6r\u00fcn\u00fcr, lakin RHEL 7-ni t\u0259sir etmir), CentOS<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> v\u0259 ROSA<\/a><\/noindex>, amma x\u0259b\u0259rin yaz\u0131ld\u0131\u011f\u0131 vaxtda h\u0259l\u0259 d\u0259 Debian<\/a><\/noindex> v\u0259 Arch Linux<\/a><\/noindex>. <\/p>\n

Z\u0259iflik, Polkit-\u0259 DBus mesajlar\u0131 il\u0259 i\u015fl\u0259y\u0259rk\u0259n asinxron sor\u011fularla ba\u011fl\u0131 olaraq, art\u0131q azad olunmu\u015f yadda\u015f sah\u0259sin\u0259 (use-after-free) m\u00fcraci\u0259t edilm\u0259si n\u0259tic\u0259sind\u0259 yaran\u0131r. B\u0259zi DBus interfeysl\u0259ri obyektl\u0259ri q\u0131sa m\u00fcdd\u0259t \u00fc\u00e7\u00fcn saxlamaq \u00fc\u00e7\u00fcn ke\u015fd\u0259n istifad\u0259 edir v\u0259 DBus avtobusu dig\u0259r sor\u011fular\u0131 i\u015fl\u0259y\u0259 bil\u0259n\u0259 q\u0259d\u0259r ke\u015fi t\u0259mizl\u0259yir. \u018fg\u0259r DBus metodunun emal\u00e7\u0131s\u0131 bus_verify_polkit_async() istifad\u0259 edirs\u0259, Polkit-d\u0259ki \u0259m\u0259liyyat\u0131n tamamlanmas\u0131n\u0131 g\u00f6zl\u0259m\u0259y\u0259 ehtiyac ola bil\u0259r. Polkit haz\u0131r olduqda, emal\u00e7\u0131 yenid\u0259n \u00e7a\u011f\u0131r\u0131l\u0131r v\u0259 daha \u0259vv\u0259l ayr\u0131lm\u0131\u015f yadda\u015f m\u0259lumatlar\u0131na m\u00fcraci\u0259t edir. \u018fg\u0259r Polkit-\u0259 olan sor\u011fu \u00e7ox uzun \u00e7\u0259k\u0259rs\u0259, o zaman ke\u015fteki elementl\u0259r DBus metodunun emal\u00e7\u0131s\u0131n\u0131n ikinci d\u0259f\u0259 \u00e7a\u011f\u0131r\u0131lmas\u0131ndan \u0259vv\u0259l t\u0259mizl\u0259n\u0259 bil\u0259r. <\/p>\n

Z\u0259ifliyi istismar etm\u0259y\u0259 imkan ver\u0259n xidm\u0259tl\u0259rd\u0259n biri, DBus API org.freedesktop.machine1.Image.Clone t\u0259qdim ed\u0259n systemd-machined-dir ki, bu da m\u0259lumatlar\u0131n ke\u00e7mi\u015fi saxlama\u011fa g\u0259tirib \u00e7\u0131xar\u0131r v\u0259 Polkit-\u0259 asinxron m\u00fcraci\u0259t etm\u0259y\u0259 s\u0259b\u0259b olur. Interfeys
\norg.freedesktop.machine1.Image.Clone b\u00fct\u00fcn qeyri-privilegiyal\u0131 sistem istifad\u0259\u00e7il\u0259rin\u0259 a\u00e7\u0131qd\u0131r ki, bu da sistemin systemd xidm\u0259tl\u0259rinin \u00e7\u00f6k\u00fc\u015f\u00fcn\u00fc ba\u015flatma\u011fa v\u0259 potensial olaraq root h\u00fcquqlar\u0131 il\u0259 kod icra etm\u0259y\u0259 imkan tan\u0131y\u0131r (istismar\u0131n prototipi h\u0259l\u0259 d\u0259 n\u00fcmayi\u015f etdirilm\u0259yib). Z\u0259ifliyi istismar etm\u0259y\u0259 imkan ver\u0259n kod, \u0259lav\u0259 edilib<\/a><\/noindex> 2015-ci ild\u0259 versionu il\u0259 systemd-machined-d\u0259 systemd 220<\/a><\/noindex> (RHEL 7.x-d\u0259 systemd 219 istifad\u0259 olunur). <\/p>\n

<\/a><\/noindex><\/p>\n

M\u0259nb\u0259: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 systemd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1712), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0448\u0438\u043d\u0435 DBus. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 systemd 245-rc1 (\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043f\u0430\u0442\u0447\u0438: 1, 2, 3). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Ubuntu, Fedora, RHEL (\u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 RHEL 8, \u043d\u043e \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 RHEL 7), CentOS, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41582","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47systemd-d\u0259 z\u0259iflik, potensial olaraq h\u00fcquqlar\u0131 art\u0131rma\u011fa imkan verir | ProHoster","description":"systemd sistem menecerind\u0259 z\u0259iflik a\u015fkarlan\u0131b (","canonical_url":"https:\/\/prohoster.info\/az\/blog\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 systemd, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 systemd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/az\/blog\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-12T13:19:30+00:00","article:modified_time":"2020-02-12T13:19:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41582","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:14:28","updated":"2022-09-30 17:11:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/41582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=41582"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/41582\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=41582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=41582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=41582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}