{"id":103645,"date":"2022-03-29T15:37:18","date_gmt":"2022-03-29T13:37:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec"},"modified":"2022-03-29T15:37:18","modified_gmt":"2022-03-29T13:37:19","slug":"v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","title":{"rendered":"V j\u00e1d\u0159e Linuxu byly objeveny exploitable zranitelnosti v nf_tables, watch_queue a IPsec","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V j\u00e1d\u0159e Linuxu byly odhaleny v\u00e1\u017en\u00e9 zranitelnosti, kter\u00e9 umo\u017e\u0148uj\u00ed m\u00edstn\u00edmu u\u017eivateli zv\u00fd\u0161it sv\u00e9 privilegium v syst\u00e9mu. Pro v\u0161echny zva\u017eovan\u00e9 probl\u00e9my byly p\u0159ipraveny pracovn\u00ed prototypy exploit\u016f. <\/p>\n
\n
Zranitelnost (CVE-2022-0995) v subsyst\u00e9mu sledov\u00e1n\u00ed ud\u00e1lost\u00ed watch_queue, kter\u00e1 vede k z\u00e1pisu dat do oblasti pam\u011bti j\u00e1dra mimo vyhrazen\u00fd buffer. \u00datok m\u016f\u017ee prov\u00e9st jak\u00fdkoli neprivilegovan\u00fd u\u017eivatel a m\u016f\u017ee v\u00e9st k spu\u0161t\u011bn\u00ed vlastn\u00edho k\u00f3du s pr\u00e1vy j\u00e1dra. Zranitelnost se nach\u00e1z\u00ed ve funkci watch_queue_set_size() a souvis\u00ed s pokusem o vy\u010di\u0161t\u011bn\u00ed v\u0161ech ukazatel\u016f v seznamu, i kdy\u017e pro n\u011b nebyla vyhrazena pam\u011b\u0165. Probl\u00e9m se projevuje p\u0159i sestaven\u00ed j\u00e1dra s volbou \"CONFIG_WATCH_QUEUE=y\", kter\u00e1 je pou\u017e\u00edv\u00e1na ve v\u011bt\u0161in\u011b distribuc\u00ed Linuxu.\n
Zranitelnost byla odstran\u011bna v \u00faprav\u011b p\u0159idan\u00e9 do j\u00e1dra 11. b\u0159ezna. Informace o publikaci aktualizac\u00ed bal\u00edk\u016f v distribuc\u00edch lze sledovat na t\u011bchto str\u00e1nk\u00e1ch: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. Prototyp exploit\u016f je ji\u017e ve\u0159ejn\u011b dostupn\u00fd a umo\u017e\u0148uje z\u00edskat root p\u0159\u00edstup p\u0159i spu\u0161t\u011bn\u00ed v Ubuntu 21.10 s j\u00e1drem 5.13.0-37.
<\/center> <\/p>\n
Zranitelnost (CVE-2022-27666) v j\u00e1drov\u00fdch modulech esp4 a esp6, kter\u00e9 implementuj\u00ed ESP transformace (Encapsulating Security Payload) pro IPsec, pou\u017e\u00edvan\u00e9 p\u0159i pou\u017eit\u00ed IPv4 a IPv6. Zranitelnost umo\u017e\u0148uje m\u00edstn\u00edmu u\u017eivateli s b\u011b\u017en\u00fdmi privilegii p\u0159epsat objekty v pam\u011bti j\u00e1dra a zv\u00fd\u0161it sv\u00e1 privilegium v syst\u00e9mu. Probl\u00e9m je zp\u016fsoben absenc\u00ed porovn\u00e1n\u00ed vyhrazen\u00e9 velikosti pam\u011bti a fakticky z\u00edskan\u00fdch dat, kdy\u017e maxim\u00e1ln\u00ed velikost zpr\u00e1vy mohla p\u0159ekro\u010dit maxim\u00e1ln\u00ed velikost pam\u011bti vyhrazen\u00e9 pro strukturu skb_page_frag_refill.\n
Zranitelnost byla odstran\u011bna v j\u00e1d\u0159e 7. b\u0159ezna (opraveno v 5.17, 5.16.15 atd.). Informace o publikaci aktualizac\u00ed bal\u00edk\u016f v distribuc\u00edch lze sledovat na t\u011bchto str\u00e1nk\u00e1ch: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. Pracovn\u00ed prototyp exploit\u016f, umo\u017e\u0148uj\u00edc\u00ed b\u011b\u017en\u00e9mu u\u017eivateli z\u00edskat root p\u0159\u00edstup v Ubuntu Desktop 21.10 s v\u00fdchoz\u00ed konfigurac\u00ed, ji\u017e byl um\u00edst\u011bn na GitHub. Tvrd\u00ed se, \u017ee s drobn\u00fdmi \u00fapravami bude exploit tak\u00e9 fungovat v Fedo\u0159e a Debi\u00e1nu. Je zaj\u00edmav\u00e9, \u017ee exploit byl p\u016fvodn\u011b p\u0159ipraven pro sout\u011b\u017e pwn2own 2022, ale v\u00fdvoj\u00e1\u0159i j\u00e1dra odhalili a opravili s n\u00edm spojenou chybu, tak\u017ee bylo rozhodnuto zve\u0159ejnit podrobnosti o zranitelnosti.
![\"V](\"\/wp-content\/uploads\/2022\/03\/9cdfd5bdf66d257757d1a4c600b96249.jpg\")
<\/center> <\/p>\n