{"id":119988,"date":"2024-09-30T09:21:07","date_gmt":"2024-09-30T07:21:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux"},"modified":"2024-09-30T09:21:07","modified_gmt":"2024-09-30T07:21:07","slug":"uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux","title":{"rendered":"Vulnerability in libnv on FreeBSD and vulnerabilities in Netfilter on Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In the patch released in early September, a logical error was identified in the vulnerability fix for the libnv library, which led to the vulnerability not being properly resolved, leaving the system susceptible to attacks. The libnv library is developed by the FreeBSD project and is used in the kernel and in applications from the base system for processing key\/value formatted lists and for organizing data transmission in interprocess communication. The library is based on the nvlist algorithm used in the OpenZFS project, but FreeBSD has created its own implementation, thus the vulnerability does not affect OpenZFS. <\/p>\n
The vulnerability is caused by an integer overflow leading to a buffer allocation smaller than the block of data being written to the buffer. This oversight can potentially be exploited to escalate privileges by overwriting memory areas within the kernel and system processes; for example, libnv is used in libcasper during interactions between privileged and unprivileged code. A proper fix for the vulnerability (CVE-2024-45287) has been proposed in updates 14.1-RELEASE-p5, 14.0-RELEASE-p11, 13.4-RELEASE-p1, and 13.3-RELEASE-p7, as well as in the form of a patch. <\/p>\n
FreeBSD has also addressed a vulnerability (CVE-2024-41721) in the bhyve hypervisor, which could potentially allow code execution in a process running on the host system (typically with root privileges, but isolated by a sandbox based on Capsicum) during manipulations within the guest system. The vulnerability exists in the code for emulating the USB controller XHCI and is triggered by insufficient buffer boundary checking, which may lead to reading data from outside the buffer as well as potentially writing to an arbitrary memory area of the process. An attack could be executed if privileged processes can be run in the guest system. The vulnerability has been fixed in updates FreeBSD 14.1-RELEASE-p5, 14.0-RELEASE-p11, 13.4-RELEASE-p1, and 13.3-RELEASE-p7. <\/p>\n
Additionally, the publication of working exploit prototypes and descriptions of exploitation methods for previously identified vulnerabilities in the Linux kernel CVE-2024-26808 and CVE-2024-1085 can be noted. The issues have been fixed in kernel updates 5.10.210, 5.15.149, 6.1.76, 6.6.15, 6.7.3, and 6.8, and have already been addressed in major distributions (Debian, Ubuntu, RHEL, SUSE, Fedora). The vulnerabilities are caused by accessing a previously freed memory area in the nft_chain_filter and nft_setelem_catchall_deactivate functions in the netfilter subsystem, allowing for code execution with root privileges. To conduct an attack, access to nftables is required, which can be obtained with CAP_NET_ADMIN rights in any user namespace or network namespace, provided for example in isolated containers. <\/p>\n
Exploits have been prepared by participants of the KernelCTF (Kernel Capture the Flag) initiative, through which Google rewards for identifying vulnerabilities in the Linux kernel. Initially, these issues were considered as just a few of many potential vulnerabilities in the kernel \u2014 for instance, in the June update of the 5.10 kernel package in Debian, alongside CVE-2024-26808, another 345 (!) potential vulnerabilities were fixed. Every week, several dozen new vulnerabilities are discovered in the kernel that were previously not identified as security issues (for example, last week, 68 vulnerabilities were flagged). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"