{"id":114603,"date":"2024-03-27T12:25:57","date_gmt":"2024-03-27T10:25:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd"},"modified":"2024-03-27T12:25:57","modified_gmt":"2024-03-27T10:25:58","slug":"uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","title":{"rendered":"Zranitelnosti v j\u00e1dru Linux, kter\u00e9 umo\u017e\u0148uj\u00ed zv\u00fd\u0161it sv\u00e9 privilegium prost\u0159ednictv\u00edm nf_tables a ksmbd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V Netfilteru, subsyst\u00e9mu j\u00e1dra Linux pou\u017e\u00edvan\u00e9ho k filtrov\u00e1n\u00ed a modifikaci s\u00ed\u0165ov\u00fdch paket\u016f, byla objevena zranitelnost (CVE-2024-1086), kter\u00e1 umo\u017e\u0148uje m\u00edstn\u00edmu u\u017eivateli vykonat k\u00f3d na \u00farovni j\u00e1dra a zv\u00fd\u0161it sv\u00e9 privilegium v syst\u00e9mu. Probl\u00e9m je zp\u016fsoben dvojit\u00fdm uvoln\u011bn\u00edm pam\u011bti (double-free) v modulu nf_tables, kter\u00fd zaji\u0161\u0165uje pr\u00e1ci paketov\u00e9ho filtru nftables. V\u00fdzkumn\u00edk v oblasti bezpe\u010dnosti, kter\u00fd zranitelnost objevil, vyvinul a publikoval funk\u010dn\u00ed prototyp exploit. <\/p>\n

Funkce exploit\u016f byla prok\u00e1z\u00e1na v aktu\u00e1ln\u00edch verz\u00edch Debianu a Ubuntu s j\u00e1dry Linux 5.14 a\u017e 6.6, jako\u017e i v prost\u0159ed\u00ed s j\u00e1drem KernelCTF (Capture the Flag), kter\u00e9 zahrnuje dodate\u010dn\u00e9 z\u00e1platy pro blokaci b\u011b\u017en\u00fdch metod fungov\u00e1n\u00ed exploit\u016f a je vyu\u017e\u00edv\u00e1no spole\u010dnost\u00ed Google v programu pro odm\u011b\u0148ov\u00e1n\u00ed za objevov\u00e1n\u00ed zranitelnost\u00ed. \u00dasp\u011b\u0161nost fungov\u00e1n\u00ed exploitu je hodnocena na 99,4 %. V prov\u00e1zej\u00edc\u00edm \u010dl\u00e1nku je podrobn\u011b rozebr\u00e1n proces vytv\u00e1\u0159en\u00ed slo\u017eit\u00e9ho v\u00edcestup\u0148ov\u00e9ho exploitu a obch\u00e1zen\u00ed ochrann\u00fdch mechanism\u016f a opat\u0159en\u00ed proti exploity p\u0159\u00edtomn\u00fdch v j\u00e1d\u0159e.

\"Zranitelnosti<\/center> <\/p>\n

Probl\u00e9m souvis\u00ed s chybou ve funkci nft_verdict_init(), kter\u00e1 povoluje pou\u017eit\u00ed kladn\u00fdch hodnot jako k\u00f3du chyby pro odm\u00edtnut\u00ed paket\u016f (DROP) v hook-\u00e1ch, co\u017e m\u016f\u017ee b\u00fdt pou\u017eito pro vyvol\u00e1n\u00ed ve funkci nf_hook_slow() opakovan\u00e9ho uvoln\u011bn\u00ed pam\u011bti pro buffer, pro kter\u00fd ji\u017e byla vyvol\u00e1na funkce free(). Probl\u00e9m nast\u00e1v\u00e1, kdy\u017e je operace NF_DROP formov\u00e1na chybou a j\u00e1dro nejprve interpretuje NF_DROP, ale pot\u00e9 uvol\u0148uje buffer a vrac\u00ed status NF_ACCEPT. Tato situace vede k tomu, \u017ee navzdory uvoln\u011bn\u00ed souvisej\u00edc\u00edho bufferu s paketem, jeho zpracov\u00e1n\u00ed nekon\u010d\u00ed, ale je p\u0159ed\u00e1no jin\u00e9mu zpracovatel, kter\u00fd znovu vyvol\u00e1v\u00e1 funkci uvoln\u011bn\u00ed pam\u011bti. <\/p>\n

Zranitelnost se projevuje od verze j\u00e1dra Linux 3.15, ale exploit funguje s j\u00e1dry od verze 5.14. Oprava zranitelnosti byla navr\u017eena ve vyd\u00e1n\u00ed j\u00e1dra Linux 6.8-rc1 a na konci \u00fanora byla p\u0159enesena do stabiln\u00edch v\u011btv\u00ed 5.15.149, 6.1.76 a 6.6.15. V distribuc\u00edch je mo\u017en\u00e9 sledovat opravu zranitelnosti na str\u00e1nk\u00e1ch: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

D\u00e1le je t\u0159eba zm\u00ednit s\u00e9rii zranitelnost\u00ed v modulu ksmbd, kter\u00fd poskytuje integrovanou implementaci souborov\u00e9ho syst\u00e9mu v j\u00e1d\u0159e Linux na z\u00e1klad\u011b protokolu SMB. serveru<\/a> Zranitelnost CVE-2024-26592 umo\u017e\u0148uje vzd\u00e1len\u00e9 proveden\u00ed vlastn\u00edho k\u00f3du s pr\u00e1vy j\u00e1dra na syst\u00e9mech s aktivn\u00edm modulem ksmbd bez nutnosti autentizace. Probl\u00e9m je zp\u016fsoben z\u00e1vodem ve k\u00f3du zpracov\u00e1n\u00ed TCP spojen\u00ed, kter\u00fd vznik\u00e1 nedostatkem vhodn\u00fdch z\u00e1mk\u016f p\u0159i pr\u00e1ci s objektem. <\/p>\n

Zranitelnost CVE-2023-52440 tak\u00e9 umo\u017e\u0148uje vzd\u00e1len\u00e9 proveden\u00ed vlastn\u00edho k\u00f3du s pr\u00e1vy j\u00e1dra, av\u0161ak je zp\u016fsobena p\u0159ete\u010den\u00edm bufferu p\u0159i zpracov\u00e1n\u00ed neplatn\u00fdch session key, v d\u016fsledku nedostate\u010dn\u00e9 kontroly velikosti dat z\u00edskan\u00fdch od u\u017eivatele p\u0159ed jejich zkop\u00edrov\u00e1n\u00edm do bufferu pevn\u00e9 velikosti. <\/p>\n

Zranitelnosti (1, 2, 3) CVE-2024-26594, CVE-2023-52442 a CVE-2023-52441 v ksmbd umo\u017e\u0148uj\u00ed vzd\u00e1len\u011b ur\u010dit obsah j\u00e1drov\u00e9 pam\u011bti bez nutnosti autentizace. Zranitelnost CVE-2024-26594 je zp\u016fsobena nespr\u00e1vnou kontrolou dat p\u0159i zpracov\u00e1n\u00ed p\u0159ijat\u00fdch token\u016f SMB2 Mech, co\u017e m\u016f\u017ee v\u00e9st k vracen\u00ed dat z oblasti za hranicemi bufferu. Zranitelnost CVE-2023-52442 je zp\u016fsobena nedostatkem vhodn\u00e9 kontroly vstupn\u00edch dat p\u0159i zpracov\u00e1n\u00ed souvisej\u00edc\u00edch \u0159et\u011bzcov\u00fdch (chained) po\u017eadavk\u016f. Zranitelnost CVE-2023-52441 je zp\u016fsobena nedostate\u010dnou kontrolou vstupn\u00edch dat p\u0159i zpracov\u00e1n\u00ed po\u017eadavk\u016f na nav\u00e1z\u00e1n\u00ed spojen\u00ed SMB2. <\/p>\n

Zranitelnosti CVE-2024-26594 a CVE-2024-26592 byly opraveny v j\u00e1d\u0159e 6.8 a v opravn\u00fdch aktualizac\u00edch minul\u00fdch stabiln\u00edch v\u011btv\u00ed 6.1.75, 6.6.14, 6.7.2. Ostatn\u00ed zranitelnosti byly odstran\u011bny v j\u00e1d\u0159e 6.5 a aktualizac\u00edch 5.15.145, 6.1.53, 6.4.16. <\/p>\n

Na z\u00e1v\u011br lze zm\u00ednit aktivaci nov\u00e9 v\u00fdvoj\u00e1\u0159sk\u00e9 skupiny pro j\u00e1dro Linux, vytvo\u0159en\u00e9 pro anal\u00fdzu zranitelnost\u00ed a hodnocen\u00ed vztahu mezi opravami v j\u00e1d\u0159e a bezpe\u010dnostn\u00edmi probl\u00e9my. V \u00fanoru byla v\u00fdvoj\u00e1\u0159i j\u00e1dra zalo\u017eena vlastn\u00ed slu\u017eba CNA (CVE Numbering Authority), kter\u00e1 z\u00edskala pravomoc samostatn\u011b p\u0159id\u011blovat CVE identifik\u00e1tory pro zranitelnosti. P\u0159edt\u00edm bylo p\u0159id\u011blov\u00e1n\u00ed CVE a anal\u00fdza vztahu oprav s mo\u017en\u00fdmi zranitelnostmi na bedrech v\u00fdvoj\u00e1\u0159\u016f distribuc\u00ed, a v j\u00e1d\u0159e potenci\u00e1ln\u00ed zranitelnosti nebyly vy\u010dlen\u011bny a figurovaly na \u00farovni b\u011b\u017en\u00fdch oprav. V\u00fdsledky nov\u00e9 slu\u017eby p\u0159ed\u010dily v\u0161echna o\u010dek\u00e1v\u00e1n\u00ed \u2013 denn\u011b je v j\u00e1d\u0159e ozna\u010deno a\u017e n\u011bkolik des\u00edtek nov\u00fdch zranitelnost\u00ed, kter\u00e9 dosud nebyly ozna\u010deny jako bezpe\u010dnostn\u00ed probl\u00e9my. Nap\u0159\u00edklad 26. b\u0159ezna byly nov\u00e9 CVE identifik\u00e1tory p\u0159id\u011bleny 14 zranitelnostem, kter\u00e9 se dosud nepova\u017eovaly za bezpe\u010dnostn\u00ed probl\u00e9my, a 25. b\u0159ezna \u2013 41 zranitelnost\u00ed.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v j\u00e1d\u0159e Linux, kter\u00e9 umo\u017e\u0148uj\u00ed zv\u00fd\u0161it opr\u00e1vn\u011bn\u00ed p\u0159es nf_tables a ksmbd | ProHoster","description":"Ve Netfilteru, subsyst\u00e9mu j\u00e1dra Linux, kter\u00fd se pou\u017e\u00edv\u00e1 pro filtrov\u00e1n\u00ed a modifikaci s\u00ed\u0165ov\u00fdch paket\u016f, byla objevena zranitelnost (CVE-2024-1086), kter\u00e1 umo\u017e\u0148uje lok\u00e1ln\u00edmu u\u017eivateli vykonat k\u00f3d na \u00farovni j\u00e1dra a zv\u00fd\u0161it sv\u00e9 opr\u00e1vn\u011bn\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 nf_tables \u0438 ksmbd | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-27T10:25:58+00:00","article:modified_time":"2024-03-27T10:25:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:46","updated":"2026-02-22 15:29:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=114603"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114603\/revisions"}],"predecessor-version":[{"id":162202,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114603\/revisions\/162202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/114604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=114603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=114603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=114603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}