{"id":103489,"date":"2022-03-07T21:36:38","date_gmt":"2022-03-07T19:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya"},"modified":"2022-03-07T21:36:38","modified_gmt":"2022-03-07T19:36:38","slug":"uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","title":{"rendered":"A vulnerability in the Linux kernel that allows for the corruption of files that are read-only.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the Linux kernel (CVE-2022-0847) that allows for overwriting the contents of the page cache for any files, including those in read-only mode, opened with the O_RDONLY flag or located on file systems mounted in read-only mode. Practically, the vulnerability can be used to inject code into arbitrary processes or corrupt data in opened files. For instance, it can alter the contents of the authorized_keys file for the sshd process. A prototype exploit is available for testing. <\/p>\n
The issue has been assigned the codename Dirty Pipe, analogous to the critical vulnerability Dirty COW discovered in 2016. It is noted that Dirty Pipe poses a danger level comparable to Dirty COW but is significantly easier to exploit. The vulnerability was identified during the investigation of complaints about periodic corruption of network-loaded files in a system that loads compressed archives from a log server (37 corruptions over 3 months on a heavily loaded system), using the splice() operation and unnamed pipes. <\/p>\n
The vulnerability emerges starting from Linux kernel 5.8, released in August 2020, meaning it is present in Debian 11 but does not affect the base kernel in Ubuntu 20.04 LTS. RHEL 8.x and openSUSE\/SUSE 15 kernels are initially based on older branches, but it is possible that the problematic change has been backported into them (no exact data available yet). Updates on package releases in the distributions can be tracked on these pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. A fix for the vulnerability has been proposed in releases 5.16.11, 5.15.25, and 5.10.102. The fix is also included in the kernel used in the Android platform. <\/p>\n
The vulnerability is caused by the lack of initialization of the value in the code of the functions copy_page_to_iter_pipe() and push_pipe(), where the allocated structure's memory is not cleared. As a result, under certain manipulations with unnamed pipes, the value in might contain data from another operation. By exploiting this feature, an unprivileged local user could trigger the PIPE_BUF_FLAG_CAN_MERGE flag, which allows for overwriting data in the page cache by simply writing new data to a specially prepared unnamed pipe. <\/p>\n
To execute the attack, the target file must be readable. Since access rights are not checked when writing to the pipe, the replacement in the page cache can also occur for files located in read-only mounted sections (for example, files on a CD-ROM). After replacing the information in the page cache, when reading data from the file, the process will receive substituted data instead of the actual data. <\/p>\n
The exploitation involves creating an unnamed pipe and filling it with arbitrary data to trigger the PIPE_BUF_FLAG_CAN_MERGE flag in all associated ring structures. Data is then read from the pipe, but the flag remains set in all instances of the pipe_buffer structure within the ring structures of pipe_inode_info. A splice() call is subsequently made to read data from the target file into the unnamed pipe, beginning at the specified offset. When writing data to this unnamed pipe, due to the PIPE_BUF_FLAG_CAN_MERGE flag, data in the page cache will be overwritten instead of creating a new pipe_buffer structure instance. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"