{"id":103411,"date":"2022-02-22T15:37:00","date_gmt":"2022-02-22T13:37:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2022-02-22T15:37:00","modified_gmt":"2022-02-22T13:37:00","slug":"uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"Zranitelnost v podsyst\u00e9mu netfilter, kter\u00e1 umo\u017e\u0148uje vykon\u00e1vat k\u00f3d na \u00farovni j\u00e1dra Linuxu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V Netfilter, subsyst\u00e9mu j\u00e1dra Linux pou\u017e\u00edvan\u00e9m pro filtrov\u00e1n\u00ed a modifikaci s\u00ed\u0165ov\u00fdch paket\u016f, byla odhalena zranitelnost (CVE-2022-25636), kter\u00e1 umo\u017e\u0148uje proveden\u00ed k\u00f3du na \u00farovni j\u00e1dra. Bylo ozn\u00e1meno, \u017ee byl p\u0159ipraven p\u0159\u00edklad exploitu, kter\u00fd umo\u017e\u0148uje m\u00edstn\u00edmu u\u017eivateli zv\u00fd\u0161it sv\u00e9 privilegium v Ubuntu 21.10 s vypnut\u00fdm ochrann\u00fdm mechanismem KASLR. Probl\u00e9m se projevuje od j\u00e1dra 5.4. Oprava je zat\u00edm dostupn\u00e1 ve form\u011b patche (spr\u00e1vn\u00e9 verze j\u00e1dra zat\u00edm nebyly vytvo\u0159eny). Sledovat publikaci aktualizac\u00ed bal\u00ed\u010dk\u016f v distribuc\u00edch lze na t\u011bchto str\u00e1nk\u00e1ch: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n
Zranitelnost je zp\u016fsobena chybou p\u0159i v\u00fdpo\u010dtu velikosti pole flow->rule->action.entries ve funkci nft_fwd_dup_netdev_offload (definovan\u00e9 v souboru net\/netfilter\/nf_dup_netdev.c), co\u017e m\u016f\u017ee v\u00e9st k z\u00e1pisu dat \u0159\u00edzen\u00fdch \u00fato\u010dn\u00edkem do oblasti pam\u011bti mimo vyhrazen\u00fd vyrovn\u00e1vac\u00ed prostor. Chyba se projevuje p\u0159i nastavov\u00e1n\u00ed pravidel 'dup' a 'fwd' v \u0159et\u011bzc\u00edch, pro kter\u00e9 se aplikuje hardwarov\u00e1 akcelerace zpracov\u00e1n\u00ed paket\u016f (offload). Vzhledem k tomu, \u017ee p\u0159ete\u010den\u00ed nast\u00e1v\u00e1 v etap\u011b p\u0159ed vytvo\u0159en\u00edm pravidla paketov\u00e9ho filtru a kontrolou podpory offload, zranitelnost je tak\u00e9 pou\u017eiteln\u00e1 pro s\u00ed\u0165ov\u00e1 za\u0159\u00edzen\u00ed, kter\u00e1 hardwarovou akceleraci nepodporuj\u00ed, jako je loopback rozhran\u00ed. <\/p>\n
Je uvedeno, \u017ee probl\u00e9m je pom\u011brn\u011b snadno zneu\u017eiteln\u00fd, proto\u017ee hodnoty vych\u00e1zej\u00edc\u00ed za mez buferu mohou p\u0159epsat ukazatel na strukturu net_device a p\u0159epsan\u00e9 hodnoty se vracej\u00ed do u\u017eivatelsk\u00e9ho prostoru, co\u017e umo\u017e\u0148uje zjistit pot\u0159ebn\u00e9 adresy v pam\u011bti pro proveden\u00ed \u00fatoku. K vyu\u017eit\u00ed zranitelnosti je nutn\u00e9 vytvo\u0159it ur\u010dit\u00e1 pravidla v nftables, co\u017e je mo\u017en\u00e9 pouze s opr\u00e1vn\u011bn\u00edmi CAP_NET_ADMIN, kter\u00e1 mohou b\u00fdt z\u00edsk\u00e1na neprivilegovan\u00fdm u\u017eivatelem v odd\u011blen\u00e9m s\u00ed\u0165ov\u00e9m jmenn\u00e9m prostoru (network namespaces). Zranitelnost m\u016f\u017ee b\u00fdt tak\u00e9 vyu\u017eita pro \u00fatoky na syst\u00e9my kontejnerov\u00e9 izolace. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"