{"id":103125,"date":"2022-01-29T15:37:09","date_gmt":"2022-01-29T13:37:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx"},"modified":"2022-01-29T15:37:09","modified_gmt":"2022-01-29T13:37:09","slug":"uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","title":{"rendered":"Zranitelnosti v OpenSSL, Glibc, util-linux, ovlada\u010d\u00edch i915 a vmwgfx","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Byly zve\u0159ejn\u011bny informace o zranitelnosti (CVE-2021-4160) v kryptografick\u00e9 knihovn\u011b OpenSSL, zp\u016fsoben\u00e9 chybou v implementaci sou\u010dtu v funkci BN_mod_exp, kter\u00e1 vede k vracen\u00ed nespr\u00e1vn\u00e9ho v\u00fdsledku operace umocn\u011bn\u00ed. Probl\u00e9m se projevuje pouze na za\u0159\u00edzen\u00edch zalo\u017een\u00fdch na architektur\u00e1ch MIPS32 a MIPS64 a m\u016f\u017ee v\u00e9st k ohro\u017een\u00ed algoritm\u016f pou\u017e\u00edvan\u00fdch na z\u00e1klad\u011b eliptick\u00fdch k\u0159ivek, v\u010detn\u011b t\u011bch, kter\u00e9 jsou ve v\u00fdchoz\u00edm nastaven\u00ed pou\u017e\u00edv\u00e1ny v TLS 1.3. Probl\u00e9m byl odstran\u011bn v prosincov\u00fdch aktualizac\u00edch OpenSSL 1.1.1m a 3.0.1. <\/p>\n
Je uvedeno, \u017ee realizace skute\u010dn\u00fdch \u00fatok\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed informac\u00ed o priv\u00e1tn\u00edch kl\u00ed\u010d\u00edch pomoc\u00ed identifikovan\u00e9 chyby je pova\u017eov\u00e1na pro RSA, DSA a algoritmus Diffie-Hellman (DH) za mo\u017enou, ale nepravd\u011bpodobnou, p\u0159\u00edli\u0161 slo\u017eitou na proveden\u00ed a vy\u017eaduj\u00edc\u00ed obrovsk\u00e9 v\u00fdpo\u010detn\u00ed zdroje. \u00datok na TLS je v\u0161ak vylou\u010den, proto\u017ee v roce 2016, p\u0159i oprav\u011b zranitelnosti CVE-2016-0701, bylo zak\u00e1z\u00e1no sd\u00edlen\u00ed jednoho priv\u00e1tn\u00edho kl\u00ed\u010de DH mezi klienty. <\/p>\n
D\u00e1le je t\u0159eba zm\u00ednit n\u011bkolik ned\u00e1vno odhalen\u00fdch zranitelnost\u00ed v otev\u0159en\u00fdch projektech: <\/p>\n
\n
N\u011bkolik zranitelnost\u00ed (CVE-2022-0330) v grafick\u00e9m ovlada\u010di i915, souvisej\u00edc\u00edch s absenc\u00ed resetov\u00e1n\u00ed TLB pro GPU. Pokud nen\u00ed pou\u017e\u00edv\u00e1no IOMMU (p\u0159eklad adres), zranitelnost umo\u017e\u0148uje p\u0159\u00edstup z u\u017eivatelsk\u00e9ho prostoru k n\u00e1hodn\u00fdm pam\u011b\u0165ov\u00fdm str\u00e1nk\u00e1m. Probl\u00e9m m\u016f\u017ee b\u00fdt vyu\u017eit k po\u0161kozen\u00ed nebo \u010dten\u00ed dat z n\u00e1hodn\u00fdch oblast\u00ed pam\u011bti. Probl\u00e9m se projevuje na v\u0161ech integrovan\u00fdch a diskr\u00e9tn\u00edch GPU Intel. Oprava byla realizov\u00e1na p\u0159id\u00e1n\u00edm povinn\u00e9ho resetov\u00e1n\u00ed TLB p\u0159ed ka\u017edou operac\u00ed vr\u00e1cen\u00ed GPU bufferu do syst\u00e9mu, co\u017e povede ke sn\u00ed\u017een\u00ed v\u00fdkonu. Dopad na v\u00fdkon z\u00e1vis\u00ed na GPU, prov\u00e1d\u011bn\u00fdch operac\u00edch na GPU a zat\u00ed\u017een\u00ed syst\u00e9mu. Oprava je zat\u00edm k dispozici pouze ve form\u011b z\u00e1platy.\n
Zranitelnost (CVE-2022-22942) v grafick\u00e9m ovlada\u010di vmwgfx, pou\u017e\u00edvan\u00e9m pro implementaci 3D akcelerace v prost\u0159ed\u00edch VMware. Probl\u00e9m umo\u017e\u0148uje neprivilegovan\u00e9mu u\u017eivateli p\u0159\u00edstup k soubor\u016fm, kter\u00e9 otev\u00edraj\u00ed jin\u00e9 procesy v syst\u00e9mu. K \u00fatoku je nutn\u00fd p\u0159\u00edstup k za\u0159\u00edzen\u00ed \/dev\/dri\/card0 nebo \/dev\/dri\/rendererD128 a mo\u017enost prov\u00e9st vol\u00e1n\u00ed ioctl() s z\u00edskan\u00fdm popisova\u010dem souboru.\n
Zranitelnosti (CVE-2021-3996, CVE-2021-3995) v knihovn\u011b libmount dod\u00e1van\u00e9 v bal\u00ed\u010dku util-linux, kter\u00e9 umo\u017e\u0148uj\u00ed nep\u0159ihl\u00e1\u0161en\u00e9mu u\u017eivateli odpojit diskov\u00e9 odd\u00edly bez pot\u0159ebn\u00fdch opr\u00e1vn\u011bn\u00ed. Probl\u00e9m byl odhalen b\u011bhem auditu program\u016f SUID-root umount a fusermount.\n
Zranitelnosti ve standardn\u00ed C knihovn\u011b Glibc, t\u00fdkaj\u00edc\u00ed se funkc\u00ed realpath (CVE-2021-3998) a getcwd (CVE-2021-3999).\n
\n
Probl\u00e9m v realpath() zp\u016fsobuje n\u00e1vrat neplatn\u00e9 hodnoty obsahuj\u00edc\u00ed neupraven\u00e9 zbytkov\u00e9 \u00fadaje ze z\u00e1sobn\u00edku za ur\u010dit\u00fdch podm\u00ednek. U SUID-root programu fusermount lze zranitelnost vyu\u017e\u00edt k z\u00edsk\u00e1n\u00ed citliv\u00fdch informac\u00ed z pam\u011bti procesu, nap\u0159\u00edklad k z\u00edsk\u00e1n\u00ed informac\u00ed o ukazatel\u00edch.\n
Probl\u00e9m v getcwd() umo\u017e\u0148uje p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku o jeden bajt. Probl\u00e9m je zp\u016fsoben chybou p\u0159\u00edtomnou od roku 1995. K vyvol\u00e1n\u00ed p\u0159ete\u010den\u00ed sta\u010d\u00ed v odd\u011blen\u00e9m jmenn\u00e9m prostoru montovac\u00edch bod\u016f prov\u00e9st vol\u00e1n\u00ed chdir() pro adres\u00e1\u0159 \"\/\". Nen\u00ed hl\u00e1\u0161eno, zda je zranitelnost omezena pouze na havarijn\u00ed ukon\u010den\u00ed procesu, ale v minulosti byly u podobn\u00fdch zranitelnost\u00ed p\u0159\u00edpady vytvo\u0159en\u00ed funk\u010dn\u00edch exploit\u016f, navzdory skepticismu v\u00fdvoj\u00e1\u0159\u016f. <\/ul>\n
Zranitelnost (CVE-2022-23220) v bal\u00ed\u010dku usbview, kter\u00e1 umo\u017e\u0148uje m\u00edstn\u00edm u\u017eivatel\u016fm p\u0159ihl\u00e1\u0161en\u00fdm p\u0159es SSH vykon\u00e1vat k\u00f3d s pr\u00e1vy root, z d\u016fvodu nastaven\u00ed v pravidlech PolKit (allow_any=yes) pro spu\u0161t\u011bn\u00ed utility usbview pod u\u017eivatelem root bez autentifikace. Vyu\u017eit\u00ed se omezuje na pou\u017eit\u00ed volby \"--gtk-module\" k na\u010dten\u00ed sv\u00e9 knihovny do usbview. Probl\u00e9m byl opraven ve verzi usbview 2.2. <\/ul>\n