Information has been disclosed regarding a vulnerability (CVE-2021-4160) in the OpenSSL cryptographic library, caused by an error in the implementation of the summation in the BN_mod_exp function, leading to the incorrect result of the squaring operation. The issue occurs only on devices based on MIPS32 and MIPS64 architectures, and may compromise algorithms based on elliptic curves, including those defaulted in TLS 1.3. The issue has been resolved in the December updates of OpenSSL 1.1.1m and 3.0.1.
It is noted that the implementation of practical attacks to obtain information about private keys using the identified issue is considered possible but unlikely for RSA, DSA, and the Diffie-Hellman (DH) algorithm, as it requires massive computational resources and is overly complex to execute. An attack on TLS is excluded because, during the resolution of the CVE-2016-0701 vulnerability in 2016, the sharing of a single DH private key among clients was prohibited.
Additionally, several recently identified vulnerabilities in open projects can be noted:
- Several vulnerabilities (CVE-2022-0330) in the i915 graphics driver, related to the lack of TLB reset for the GPU. If IOMMU (address translation) is not used, the vulnerability allows access to random memory pages from user space. This issue can be exploited to corrupt or read data from random memory areas. The problem manifests on all Intel integrated and discrete GPUs. The fix has been implemented by adding a mandatory TLB reset prior to each operation that returns a GPU buffer to the system, which will lead to performance degradation. The impact on performance depends on the GPU, GPU operations performed, and system load. The fix is currently available only as a patch.
- A vulnerability (CVE-2022-22942) in the vmwgfx graphics driver, used for 3D acceleration in VMware environments. The issue allows an unprivileged user to access files opened by other processes in the system. To carry out the attack, access to the device /dev/dri/card0 or /dev/dri/rendererD128 is required, as well as the ability to perform an ioctl() call with the obtained file descriptor.
- Vulnerabilities (CVE-2021-3996, CVE-2021-3995) in the libmount library, provided in the util-linux package, allowing an unprivileged user to unmount disk partitions without authorization. The issue was identified during an audit of the SUID-root programs umount and fusermount.
- Vulnerabilities in the standard C library Glibc, affecting the functions realpath (CVE-2021-3998) and getcwd (CVE-2021-3999).
- The issue in realpath() is caused by returning an incorrect value under certain conditions, which contains uncleaned residual data from the stack. For the SUID-root program fusermount, the vulnerability can be exploited to obtain confidential information from the process's memory, such as pointer information.
- The issue in getcwd() allows for a one-byte buffer overflow. This problem has existed since 1995. To trigger the overflow, it is sufficient to call chdir() for the "\/" directory in a separate mount namespace. It is not reported whether the vulnerability is limited to process crashes, but in the past, there have been instances of working exploits for similar vulnerabilities despite developersā skepticism.
- Vulnerability (CVE-2022-23220) in the usbview package, allowing local users logged in via SSH to execute code with root privileges due to the presence of the PolKit setting (allow_any=yes) for running the usbview utility as the root user without authentication. Exploitation involves using the āāgtk-moduleā option to load their library into usbview. The issue has been fixed in usbview version 2.2.
Source: opennet.ru
