{"id":100548,"date":"2021-06-20T10:22:54","date_gmt":"2021-06-20T08:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm"},"modified":"2021-06-20T10:22:54","modified_gmt":"2021-06-20T08:22:55","slug":"uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","title":{"rendered":"Zranitelnost v j\u00e1d\u0159e Linuxu, kter\u00e1 se t\u00fdk\u00e1 s\u00ed\u0165ov\u00e9ho protokolu CAN BCM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V j\u00e1d\u0159e Linux byla zji\u0161t\u011bna zranitelnost (CVE-2021-3609), kter\u00e1 umo\u017e\u0148uje m\u00edstn\u00edmu u\u017eivateli zv\u00fd\u0161it sv\u00e9 privilegium v syst\u00e9mu. Probl\u00e9m je zp\u016fsoben stavem z\u00e1vodu v implementaci protokolu CAN BCM a projevuje se ve verz\u00edch j\u00e1dra Linux od 2.6.25 po 5.13-rc6. V distribuc\u00edch z\u016fst\u00e1v\u00e1 probl\u00e9m zat\u00edm neopraven\u00fd (RHEL, Fedora, Debian, Ubuntu, SUSE, Arch). <\/p>\n
V\u00fdzkumn\u00edk, kter\u00fd zranitelnost odhalil, dok\u00e1zal p\u0159ipravit exploit pro z\u00edsk\u00e1n\u00ed pr\u00e1v root na syst\u00e9mech s j\u00e1dry Linux 5.4 a nov\u011bj\u0161\u00edmi, v\u010detn\u011b mo\u017enosti \u00fasp\u011b\u0161n\u00e9ho proveden\u00ed \u00fatoku na Ubuntu 20.04.02 LTS. Nen\u00ed vylou\u010deno, \u017ee exploit bude p\u0159epracov\u00e1n i pro star\u0161\u00ed j\u00e1dra (v j\u00e1d\u0159e 5.4 byl k\u00f3d CAN BCM (net\/can\/bcm.c) p\u0159enesen z hrtimer_tasklet na HRTIMER_MODE_SOFT). <\/p>\n
Protokol CAN BCM umo\u017e\u0148uje registrovat vlastn\u00ed zpracovatel zpr\u00e1v, kter\u00e9 p\u0159ich\u00e1zej\u00ed p\u0159es sb\u011brnici CAN (controller area network), a p\u0159ipojit ho k ur\u010dit\u00e9mu s\u00ed\u0165ov\u00e9mu socketu. P\u0159i p\u0159ijet\u00ed p\u0159\u00edchoz\u00ed zpr\u00e1vy je vyvol\u00e1na funkce bcm_rx_handler(). \u00dato\u010dn\u00edk m\u016f\u017ee vyu\u017e\u00edt stav z\u00e1vodu a dos\u00e1hnout uzav\u0159en\u00ed s\u00ed\u0165ov\u00e9ho socketu sou\u010dasn\u011b s vykon\u00e1v\u00e1n\u00edm bcm_rx_handler(). P\u0159i uzav\u0159en\u00ed socketu se vol\u00e1 funkce bcm_release(), ve kter\u00e9 je uvoln\u011bna pam\u011b\u0165 alokovan\u00e1 pro struktury bcm_op a bcm_sock, kter\u00e9 se st\u00e1le pou\u017e\u00edvaj\u00ed v je\u0161t\u011b vykon\u00e1van\u00e9m zpracovateli bcm_rx_handler(). Vznik\u00e1 situace vedouc\u00ed k p\u0159\u00edstupu k ji\u017e uvoln\u011bn\u00e9mu bloku pam\u011bti (use-after-free). <\/p>\n
\u00datok spo\u010d\u00edv\u00e1 v otev\u0159en\u00ed dvou socket\u016f CAN BCM a jejich p\u0159ipojen\u00ed k rozhran\u00ed vcan. V prvn\u00edm socketu se provede vol\u00e1n\u00ed sendmsg() s flagem RX_SETUP pro nastaven\u00ed zpracovatele p\u0159\u00edchoz\u00edch zpr\u00e1v CAN, a ve druh\u00e9m socketu se provede vol\u00e1n\u00ed sendmsg() pro odesl\u00e1n\u00ed zpr\u00e1vy do prvn\u00edho socketu. Po p\u0159ijet\u00ed zpr\u00e1vy se spust\u00ed vol\u00e1n\u00ed bcm_rx_handler(), a \u00fato\u010dn\u00edk si vybere spr\u00e1vn\u00fd okam\u017eik a uzav\u0159e prvn\u00ed socket, co\u017e vede k vyvol\u00e1n\u00ed bcm_release() a uvoln\u011bn\u00ed struktur bcm_op a bcm_sock, p\u0159esto\u017ee pr\u00e1ce bcm_rx_handler() je\u0161t\u011b nen\u00ed dokon\u010dena. <\/p>\n
Manipulac\u00ed s obsahem bcm_sock m\u016f\u017ee \u00fato\u010dn\u00edk p\u0159epsat ukazatel na funkci sk->sk_data_ready(sk), p\u0159esm\u011brovat prov\u00e1d\u011bn\u00ed a pomoc\u00ed technik orientovan\u00fdch na n\u00e1vrat (ROP - Return-Oriented Programming) zorganizovat p\u0159eps\u00e1n\u00ed parametru modprobe_path a dos\u00e1hnout v\u00fdkonu sv\u00e9ho k\u00f3du s pr\u00e1vy root. P\u0159i pou\u017eit\u00ed techniky ROP \u00fato\u010dn\u00edk nesna\u017e\u00ed um\u00edstit sv\u016fj k\u00f3d do pam\u011bti, ale pracuje ji\u017e existuj\u00edc\u00edmi kusy strojov\u00fdch instrukc\u00ed ve na\u010dten\u00fdch knihovn\u00e1ch, kter\u00e9 kon\u010d\u00ed instrukc\u00ed pro n\u00e1vrat \u0159\u00edzen\u00ed (obvykle se jedn\u00e1 o konce knihovn\u00edch funkc\u00ed). Pr\u00e1ce exploit\u016f se soust\u0159ed\u00ed na sestaven\u00ed \u0159et\u011bzce vol\u00e1n\u00ed podobn\u00fdch blok\u016f (\u201egadgets\u201c) pro z\u00edsk\u00e1n\u00ed po\u017eadovan\u00e9 funk\u010dnosti.
<\/center> <\/p>\n
K proveden\u00ed \u00fatoku je zapot\u0159eb\u00ed m\u00edt p\u0159\u00edstup k vytv\u00e1\u0159en\u00ed CAN socket\u016f a nastaven\u00e9 s\u00ed\u0165ov\u00e9 rozhran\u00ed vcan. Nezbytn\u00e1 opr\u00e1vn\u011bn\u00ed pro proveden\u00ed \u00fatoku m\u016f\u017ee z\u00edskat neprivilegovan\u00fd u\u017eivatel v kontejnerech vytv\u00e1\u0159en\u00fdch v syst\u00e9mech s aktivovanou podporou prostor\u016f jmen identifik\u00e1tor\u016f u\u017eivatel\u016f (user namespaces). Nap\u0159\u00edklad, user namespaces jsou ve v\u00fdchoz\u00edm nastaven\u00ed aktivov\u00e1ny v Ubuntu a Fedo\u0159e, ale nejsou povoleny v Debi\u00e1nu a RHEL. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Zranitelnost](\"\/wp-content\/uploads\/2021\/06\/60534f0194a819c8401abf2ec53b3a9a.png\")
<\/center> <\/p>\n