{"id":102971,"date":"2022-01-16T03:36:38","date_gmt":"2022-01-16T01:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82"},"modified":"2022-01-16T03:36:38","modified_gmt":"2022-01-16T01:36:38","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","title":{"rendered":"Zranitelnost v cryptsetup umo\u017e\u0148uj\u00edc\u00ed vypnout \u0161ifrov\u00e1n\u00ed v LUKS2 odd\u00edlech.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V bal\u00ed\u010dku Cryptsetup, pou\u017e\u00edvan\u00e9m pro \u0161ifrov\u00e1n\u00ed diskov\u00fdch odd\u00edl\u016f v Linuxu, byla zji\u0161t\u011bna zranitelnost (CVE-2021-4122), kter\u00e1 umo\u017e\u0148uje deaktivaci \u0161ifrov\u00e1n\u00ed v odd\u00edlech ve form\u00e1tu LUKS2 (Linux Unified Key Setup) prost\u0159ednictv\u00edm modifikace metadat. Pro zneu\u017eit\u00ed t\u00e9to zranitelnosti mus\u00ed \u00fato\u010dn\u00edk m\u00edt fyzick\u00fd p\u0159\u00edstup k za\u0161ifrovan\u00e9mu m\u00e9diu, co\u017e \u010din\u00ed tuto metodu v z\u00e1sad\u011b relevantn\u00ed p\u0159edev\u0161\u00edm pro \u00fatoky na za\u0161ifrovan\u00e9 extern\u00ed \u00falo\u017en\u00e9 za\u0159\u00edzen\u00ed, jako jsou USB flash disky, ke kter\u00fdm m\u00e1 \u00fato\u010dn\u00edk p\u0159\u00edstup, ale nezn\u00e1 heslo pro de\u0161ifrov\u00e1n\u00ed dat. <\/p>\n

\u00datok je pou\u017eiteln\u00fd pouze pro form\u00e1t LUKS2 a je spojen s manipulac\u00ed s metadaty odpov\u00eddaj\u00edc\u00edmi aktivaci roz\u0161\u00ed\u0159en\u00ed \u201eonline reencryption\u201c, kter\u00e9 umo\u017e\u0148uje p\u0159i pot\u0159eby zm\u011bnit p\u0159\u00edstupov\u00fd kl\u00ed\u010d zah\u00e1jit proces p\u0159en\u00e1\u0161en\u00ed dat na pozad\u00ed bez p\u0159eru\u0161en\u00ed pr\u00e1ce s odd\u00edlem. Vzhledem k tomu, \u017ee proces de\u0161ifrov\u00e1n\u00ed a \u0161ifrov\u00e1n\u00ed s nov\u00fdm kl\u00ed\u010dem trv\u00e1 del\u0161\u00ed dobu, \u201eonline reencryption\u201c poskytuje mo\u017enost nep\u0159eru\u0161it pr\u00e1ci s odd\u00edlem a p\u0159en\u00e1\u0161et data na pozad\u00ed, postupn\u011b \u0161ifruj\u00edc\u00ed data z jednoho kl\u00ed\u010de na druh\u00fd. V\u010detn\u011b toho je mo\u017en\u00e9 zvolit pr\u00e1zdn\u00fd c\u00edlov\u00fd kl\u00ed\u010d, co\u017e umo\u017e\u0148uje p\u0159ev\u00e9st odd\u00edl do de\u0161ifrovan\u00e9ho stavu. <\/p>\n

\u00dato\u010dn\u00edk m\u016f\u017ee prov\u00e9st zm\u011bny v metadatech LUKS2, kter\u00e9 simuluj\u00ed havarijn\u00ed p\u0159eru\u0161en\u00ed prov\u00e1d\u011bn\u00ed operace de\u0161ifrov\u00e1n\u00ed v d\u016fsledku selh\u00e1n\u00ed a dos\u00e1hnout de\u0161ifrov\u00e1n\u00ed \u010d\u00e1sti odd\u00edlu po aktivaci a pou\u017eit\u00ed modifikovan\u00e9ho \u00falo\u017ei\u0161t\u011b vlastn\u00edkem. U\u017eivatel, kter\u00fd p\u0159ipoj\u00ed modifikovan\u00e9 \u00falo\u017ei\u0161t\u011b a odemkne ho spr\u00e1vn\u00fdm heslem, p\u0159itom nedostane \u017e\u00e1dn\u00e9 varov\u00e1n\u00ed o prov\u00e1d\u011bn\u00ed procesu obnoven\u00ed p\u0159eru\u0161ovan\u00e9 operace p\u0159en\u00e1\u0161en\u00ed a m\u016f\u017ee se o pr\u016fb\u011bhu t\u00e9to operace dozv\u011bd\u011bt pouze pomoc\u00ed p\u0159\u00edkazu \u201eluks Dump\u201c. Mno\u017estv\u00ed dat, kter\u00e9 m\u016f\u017ee \u00fato\u010dn\u00edk de\u0161ifrovat, z\u00e1vis\u00ed na velikosti hlavi\u010dky LUKS2, ale p\u0159i v\u00fdchoz\u00ed velikosti (16 MiB) m\u016f\u017ee p\u0159es\u00e1hnout 3 GB. <\/p>\n

Probl\u00e9m je zp\u016fsoben t\u00edm, \u017ee i kdy\u017e de\u0161ifrov\u00e1n\u00ed vy\u017eaduje v\u00fdpo\u010det a kontrolu hash\u016f nov\u00fdch a star\u00fdch kl\u00ed\u010d\u016f, pro zah\u00e1jen\u00ed de\u0161ifrov\u00e1n\u00ed hash nen\u00ed pot\u0159eba, pokud nov\u00e9 stavy p\u0159edpokl\u00e1daj\u00ed absenci kl\u00ed\u010de pro \u0161ifrov\u00e1n\u00ed (\u010dist\u00fd text). Nav\u00edc metadata LUKS2, v nich\u017e je definov\u00e1n \u0161ifrovac\u00ed algoritmus, nejsou chr\u00e1n\u011bna p\u0159ed modifikac\u00ed, pokud se dostanou do rukou \u00fato\u010dn\u00edka. Aby se zranitelnost zablokovala, v\u00fdvoj\u00e1\u0159i p\u0159idali do LUKS2 dodate\u010dnou ochranu metadat, kde se nyn\u00ed kontroluje dal\u0161\u00ed hash, kter\u00fd se po\u010d\u00edt\u00e1 na z\u00e1klad\u011b zn\u00e1m\u00fdch kl\u00ed\u010d\u016f a obsahu metadat, tak\u017ee \u00fato\u010dn\u00edk nyn\u00ed nem\u016f\u017ee nen\u00e1padn\u011b zm\u011bnit metadata, ani\u017e by znal heslo pro de\u0161ifrov\u00e1n\u00ed. <\/p>\n

Standardn\u00ed sc\u00e9n\u00e1\u0159 \u00fatoku vy\u017eaduje, aby \u00fato\u010dn\u00edk m\u011bl mo\u017enost n\u011bkolikr\u00e1t z\u00edskat \u00falo\u017ei\u0161t\u011b do sv\u00fdch rukou. Zpo\u010d\u00e1tku \u00fato\u010dn\u00edk, kter\u00fd nezn\u00e1 p\u0159\u00edstupov\u00e9 heslo, prov\u00e1d\u00ed zm\u011bny v oblasti metadat, kter\u00e9 iniciuj\u00ed de\u0161ifrov\u00e1n\u00ed \u010d\u00e1sti dat p\u0159i p\u0159\u00ed\u0161t\u00edm aktivaci \u00falo\u017ei\u0161t\u011b. Pot\u00e9 je \u00falo\u017ei\u0161t\u011b vr\u00e1ceno na m\u00edsto a \u00fato\u010dn\u00edk \u010dek\u00e1, a\u017e jej u\u017eivatel p\u0159ipoj\u00ed, zad\u00e1 heslo. B\u011bhem aktivace za\u0159\u00edzen\u00ed u\u017eivatelem se spust\u00ed pozad\u00ed procesu p\u0159e\u0161ifrov\u00e1n\u00ed, b\u011bhem n\u011bho\u017e se \u010d\u00e1st za\u0161ifrovan\u00fdch dat nahrad\u00ed na de\u0161ifrovan\u00e1 data. D\u00e1le, pokud \u00fato\u010dn\u00edk op\u011bt z\u00edsk\u00e1 za\u0159\u00edzen\u00ed, \u010d\u00e1st dat na \u00falo\u017ei\u0161ti bude ve de\u0161ifrovan\u00e9 podob\u011b. <\/p>\n

Probl\u00e9m byl identifikov\u00e1n spr\u00e1vcem projektu cryptsetup a byl odstran\u011bn v aktualizac\u00edch cryptsetup 2.4.3 a 2.3.7. Stav vytv\u00e1\u0159en\u00ed aktualizac\u00ed odstran\u011bn\u00ed probl\u00e9mu v distribuc\u00edch lze sledovat na n\u00e1sleduj\u00edc\u00edch str\u00e1nk\u00e1ch: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. Zranitelnost se projevuje pouze od verze cryptsetup 2.2.0, ve kter\u00e9 byla p\u0159id\u00e1na podpora pro operaci \u201eonline reencryption\u201c. Jako obran\u00fd prost\u0159edek m\u016f\u017ee b\u00fdt pou\u017eito spu\u0161t\u011bn\u00ed s volbou \u201e--disable-luks2-reencryption\u201c.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2 (Linux Unified Key Setup). \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044e, \u0442.\u0435. \u043c\u0435\u0442\u043e\u0434 \u0438\u043c\u0435\u0435\u0442 \u0441\u043c\u044b\u0441\u043b \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u0438, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Flash-\u0434\u0438\u0441\u043a\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102971","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v cryptsetup, kter\u00e1 umo\u017e\u0148uje deaktivaci \u0161ifrov\u00e1n\u00ed v LUKS2 odd\u00edlech | ProHoster","description":"V bal\u00ed\u010dku Cryptsetup, kter\u00fd se pou\u017e\u00edv\u00e1 pro \u0161ifrov\u00e1n\u00ed diskov\u00fdch odd\u00edl\u016f v Linuxu, byla zji\u0161t\u011bna zranitelnost (CVE-2021-4122), kter\u00e1 umo\u017e\u0148uje prost\u0159ednictv\u00edm modifikace metadat dos\u00e1hnout deaktivace \u0161ifrov\u00e1n\u00ed v odd\u00edlech form\u00e1tu LUKS2.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cryptsetup, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 LUKS2-\u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-01-16T01:36:38+00:00","article:modified_time":"2022-01-16T01:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102971","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-01-16 01:37:39","updated":"2022-09-28 07:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102971"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102971\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}