{"id":102952,"date":"2022-01-12T21:36:50","date_gmt":"2022-01-12T19:36:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d0%bf%d0%be%d0%b4%d1%81%d0%b8%d1%81%d1%82%d0%b5%d0%bc%d0%b5-ebpf-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0"},"modified":"2022-01-12T21:36:50","modified_gmt":"2022-01-12T19:36:50","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d0%bf%d0%be%d0%b4%d1%81%d0%b8%d1%81%d1%82%d0%b5%d0%bc%d0%b5-ebpf-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d0%bf%d0%be%d0%b4%d1%81%d0%b8%d1%81%d1%82%d0%b5%d0%bc%d0%b5-ebpf-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0","title":{"rendered":"En s\u00e5rbarhed i eBPF-subsystemet, der muligg\u00f8r udf\u00f8relse af kode p\u00e5 Linux-kernens niveau.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
I eBPF-subsystemen, der g\u00f8r det muligt at k\u00f8re h\u00e5ndteringsprogrammer inden i Linux-kernen i en speciel virtuel maskine med JIT, er der opdaget en s\u00e5rbarhed (CVE-2021-4204), som giver en lokal ikke-privilegeret bruger mulighed for at opn\u00e5 forh\u00f8jet privilegium og udf\u00f8re sin kode p\u00e5 kernel-niveau i Linux. Problemet optr\u00e6der fra Linux-kernel 5.8 og er endnu ikke blevet rettet (det p\u00e5virker ogs\u00e5 version 5.16). Status for oprettelse af opdateringer, der l\u00f8ser problemet i distributionerne, kan f\u00f8lges p\u00e5 disse sider: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. Der er meldt om oprettelsen af et fungerende exploit, som forventes offentliggjort den 18. januar (brugere og udviklere har f\u00e5et en uge til at afhj\u00e6lpe s\u00e5rbarheden). <\/p>\n
S\u00e5rbarheden skyldes en ukorrekt kontrol af de eBPF-programmer, der sendes til udf\u00f8relse. eBPF-subsystemet leverer hj\u00e6lpefunktioner, hvis korrekthed verificeres af en speciel verifier. Nogle funktioner kr\u00e6ver, at der sendes en v\u00e6rdi af PTR_TO_MEM som argument, og for at forhindre mulige buffer-overl\u00f8b skal verifieren kende st\u00f8rrelsen p\u00e5 det hukommelse, der er relateret til argumentet. For funktionerne bpf_ringbuf_submit og bpf_ringbuf_discard blev oplysninger om st\u00f8rrelsen af den overf\u00f8rte hukommelse ikke givet til verifieren, hvilket kunne anvendes til at overskrive hukommelsesomr\u00e5der uden for bufferen, n\u00e5r der blev k\u00f8rt specielt formateret eBPF-kode. <\/p>\n
For an attack to be conducted, the user must have the capability to upload their BPF program, and many recent Linux distributions block this ability by default (including unprivileged access to eBPF, which is now prohibited by default in the kernel starting with the 5.16 release). For example, the vulnerability can be exploited in the default configuration of Ubuntu 20.04 LTS, but in environments like Ubuntu 22.04-dev, Debian 11, openSUSE 15.3, RHEL 8.5, SUSE 15-SP4, and Fedora 33, it only manifests if the administrator has set the kernel.unprivileged_bpf_disabled parameter to 0. As a workaround to block the vulnerability, the execution of BPF programs by unprivileged users can be prohibited with the command \u00absysctl -w kernel.unprivileged_bpf_disabled=1\u00bb. \n Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"