{"id":103125,"date":"2022-01-29T15:37:09","date_gmt":"2022-01-29T13:37:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx"},"modified":"2022-01-29T15:37:09","modified_gmt":"2022-01-29T13:37:09","slug":"uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","title":{"rendered":"Vulnerabilities in OpenSSL, Glibc, util-linux, i915, and vmwgfx drivers","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information has been disclosed regarding a vulnerability (CVE-2021-4160) in the OpenSSL cryptographic library, caused by an error in the implementation of the summation in the BN_mod_exp function, leading to the incorrect result of the squaring operation. The issue occurs only on devices based on MIPS32 and MIPS64 architectures, and may compromise algorithms based on elliptic curves, including those defaulted in TLS 1.3. The issue has been resolved in the December updates of OpenSSL 1.1.1m and 3.0.1. <\/p>\n
It is noted that the implementation of actual attacks to gain information about private keys using the identified issue is considered possible but unlikely for RSA, DSA, and the Diffie-Hellman algorithm (DH) due to its complexity and the enormous computational resources required. At the same time, an attack on TLS is ruled out, as the use of a shared private DH key by clients was prohibited in 2016 when the CVE-2016-0701 vulnerability was addressed. <\/p>\n
Additionally, several recently identified vulnerabilities in open projects can be noted: <\/p>\n
\n
Several vulnerabilities (CVE-2022-0330) in the i915 graphics driver, related to the lack of TLB reset for the GPU. If IOMMU (address translation) is not used, the vulnerability allows access to random memory pages from user space. This issue can be exploited to corrupt or read data from random memory areas. The problem manifests on all Intel integrated and discrete GPUs. The fix has been implemented by adding a mandatory TLB reset prior to each operation that returns a GPU buffer to the system, which will lead to performance degradation. The impact on performance depends on the GPU, GPU operations performed, and system load. The fix is currently available only as a patch.\n
A vulnerability (CVE-2022-22942) in the vmwgfx graphics driver, used for 3D acceleration in VMware environments. The issue allows an unprivileged user to access files opened by other processes in the system. To carry out the attack, access to the device \/dev\/dri\/card0 or \/dev\/dri\/rendererD128 is required, as well as the ability to perform an ioctl() call with the obtained file descriptor.\n
Vulnerabilities (CVE-2021-3996, CVE-2021-3995) in the libmount library, provided in the util-linux package, allowing an unprivileged user to unmount disk partitions without authorization. The issue was identified during an audit of the SUID-root programs umount and fusermount.\n
Vulnerabilities in the standard C library Glibc, affecting the functions realpath (CVE-2021-3998) and getcwd (CVE-2021-3999).\n
\n
The issue in realpath() is caused by returning an incorrect value under certain conditions, which contains uncleaned residual data from the stack. For the SUID-root program fusermount, the vulnerability can be exploited to obtain confidential information from the process's memory, such as pointer information.\n
The issue in getcwd() allows for a buffer overflow of one byte. This problem stems from a bug present since 1995. To trigger the overflow, it is sufficient to call chdir() for the directory \"\/\" in a separate namespace of mount points. It is not reported whether the vulnerability is limited only to crashing the process, but in the past, there have been cases of working exploits for similar vulnerabilities despite developers' skepticism. <\/ul>\n
The vulnerability (CVE-2022-23220) in the usbview package allows local users who have logged in via SSH to execute code with root privileges due to the presence of PolKit rules (allow_any=yes) enabling the usbview utility to run as root without authentication. Exploitation involves using the \"--gtk-module\" option to load their library into usbview. The issue has been resolved in usbview version 2.2. <\/ul>\n