{"id":118544,"date":"2024-07-29T09:43:08","date_gmt":"2024-07-29T07:43:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii"},"modified":"2024-07-29T09:43:08","modified_gmt":"2024-07-29T07:43:08","slug":"oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","title":{"rendered":"Ein Fehler im LSM-Modul Landlock erm\u00f6glichte es, zur\u00fcckgesetzte Berechtigungen erneut zu erhalten.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jann Horn von Google Project Zero, der einst die Schwachstellen Spectre und Meltdown entdeckte, fand einen logischen Fehler in der Implementierung des Sicherheitsmoduls Linux (LSM) Landlock, der es einem Programm erm\u00f6glicht, bereits zur\u00fcckgegebene Berechtigungen wiederzuerlangen, sofern das Programm Zugang zu den Systemaufrufen fork() und keyctl() hat. <\/p>\n

Der Mechanismus Landlock erm\u00f6glicht es unprivilegierten Programmen, nicht ben\u00f6tigte Berechtigungen abzulegen, indem sie ihren weiteren Zugriff auf das System freiwillig einschr\u00e4nken, um die Sicherheit zu erh\u00f6hen, beispielsweise zum Schutz im Falle eines Versuchs, Schwachstellen im Programm auszunutzen. Zum Beispiel kann ein Programm den Zugriff auf Dateien au\u00dferhalb des Arbeitsverzeichnisses verbieten. <\/p>\n

Wie der Ingenieur von Google entdeckte, waren einige Situationen von den Entwicklern des Moduls nicht vorhergesehen, was es einem Programm erm\u00f6glicht, die zur\u00fcckgegebenen Berechtigungen unter bestimmten Bedingungen erneut zu erhalten. Der Fehler tritt in allen Versionen des Kernels mit dem LSM-Modul Landlock auf, da er in der urspr\u00fcnglichen Implementierung dieses Moduls vorhanden ist. Eine Korrektur zur Behebung des identifizierten Problems ist in der heutigen Testversion des Kernels 6.11-rc1 enthalten, wurde jedoch noch nicht in die stabilen Versionen \u00fcbernommen.
\n
Quelle: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f\u043d\u043d \u0425\u043e\u0440\u043d (Jann Horn) \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero, \u0432 \u0441\u0432\u043e\u0451 \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Spectre \u0438 Meltdown, \u043d\u0430\u0448\u0451\u043b \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u043e\u0434\u0443\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux (LSM) Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0443\u0436\u0435 \u0441\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u0430\u043c fork() \u0438 keyctl(). \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c Landlock \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u043c \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0442\u044c \u043d\u0435\u043d\u0443\u0436\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-118544","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ein Fehler im LSM-Modul Landlock erlaubte die erneute Erlangung bereits zur\u00fcckgegebener Berechtigungen | ProHoster","description":"Jann Horn von Google Project Zero, der einst die Schwachstellen Spectre und Meltdown entdeckte, fand einen logischen Fehler in der Implementierung des Sicherheitsmoduls Linux (LSM) Landlock, der es einem Programm erm\u00f6glicht,.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 LSM-\u043c\u043e\u0434\u0443\u043b\u0435 Landlock \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u0430\u043d\u043e\u0432\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u042f\u043d\u043d \u0425\u043e\u0440\u043d (Jann Horn) \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero, \u0432 \u0441\u0432\u043e\u0451 \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Spectre \u0438 Meltdown, \u043d\u0430\u0448\u0451\u043b \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u043e\u0434\u0443\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux (LSM) Landlock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-29T07:43:08+00:00","article:modified_time":"2024-07-29T07:43:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"118544","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 05:02:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:02:19","updated":"2026-01-23 05:02:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/118544","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=118544"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/118544\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=118544"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=118544"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=118544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}