{"id":100548,"date":"2021-06-20T10:22:54","date_gmt":"2021-06-20T08:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm"},"modified":"2021-06-20T10:22:54","modified_gmt":"2021-06-20T08:22:55","slug":"uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","title":{"rendered":"Haavatavus Linuxi tuumas, mis m\u00f5jutab CAN BCM v\u00f5rgu protokolli","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi tuumas avastati haavatavus (CVE-2021-3609), mis v\u00f5imaldab kohalikul kasutajal t\u00f5sta oma \u00f5igusi s\u00fcsteemis. Probleem tuleneb v\u00f5istlusolukorrast CAN BCM protokolli rakenduses ja see ilmneb Linuxi tuumades alates 2.6.25 kuni 5.13-rc6. Jaotustes j\u00e4\u00e4b probleem praegu lahendamata (RHEL, Fedora, Debian, Ubuntu, SUSE, Arch). <\/p>\n

Haavatavuse avastanud teadlane suutis koostada eksploidimise, et saada root \u00f5igused Linuxi tuumadega 5.4 ja uuemates s\u00fcsteemides, sealhulgas n\u00e4idati, et r\u00fcnnak on edukalt teostatav Ubuntu 20.04.02 LTS-s. Pole v\u00e4listatud, et eksploidimist saab kohandada ka vanemate tuumade jaoks (tuumas 5.4 viidi CAN BCM kood (net\/can\/bcm.c) hrtimer_tasklet-ilt HRTIMER_MODE_SOFT-ile). <\/p>\n

CAN BCM protokoll v\u00f5imaldab registreerida oma s\u00f5numit\u00f6\u00f6tleja, mis saabub l\u00e4bi CAN (controller area network) bussiga, ja kinnitada selle teatud v\u00f5rgu soketiga. Kui sisend s\u00f5num saabub, kutsutakse esile funktsioon bcm_rx_handler(). R\u00fcndaja v\u00f5ib kasutada v\u00f5istlusolukorda ja saavutada v\u00f5rgu soketi sulgemise samal ajal, kui bcm_rx_handler() t\u00f6\u00f6tab. Soketi sulgemisel kutsutakse esile funktsioon bcm_release(), kus vabastatakse m\u00e4lu, mis on eraldatud bcm_op ja bcm_sock struktuuride jaoks, mis j\u00e4tkavad kasutamist veel k\u00e4imasolevas bcm_rx_handler() t\u00f6\u00f6tlejas. Tekib olukord, mis viib juba vabastatud m\u00e4lu ploki juurde p\u00e4\u00e4semiseni (use-after-free). <\/p>\n

R\u00fcnnak koosneb kahest CAN BCM soketi avamisest ja nende sidumisest vcan-liidesega. Esimeses soketis tehakse call sendmsg() RX_SETUP lipuga, et seadistada CAN s\u00f5numite t\u00f6\u00f6tlejat, samas kui teises soketis tehakse sendmsg() call s\u00f5numi saatmiseks esimesse soketti. Kui s\u00f5num saabub, kutsub see esile bcm_rx_handler() ja r\u00fcndaja valib \u00f5ige hetke, et sulgeda esimene soket, mis toob kaasa bcm_release() k\u00e4ivitamise ja bcm_op ja bcm_sock struktuuride vabastamise, kuigi bcm_rx_handler() t\u00f6\u00f6 ei ole veel l\u00f5petatud. <\/p>\n

Kasutades bcm_sock sisu manipuleerimise meetodeid, v\u00f5ib r\u00fcndaja \u00fcle kirjutada funktsiooni sk->sk_data_ready(sk) n\u00e4idiku, k\u00f5rvale juhtida k\u00e4ivitamist ning rakendada tagasip\u00f6\u00f6ratud programmeerimise (ROP - Return-Oriented Programming) tehnikaid, et muuta modprobe_path parameetrit ja saavutada oma koodi t\u00e4itmine root \u00f5igustes. ROP tehnikat kasutav r\u00fcndaja ei p\u00fc\u00fca oma koodi m\u00e4lu paigutada, vaid opereerib juba laaditud teekides olemasolevate masina juhiste fragmentidega, mis l\u00f5ppevad kontrolli tagastamise juhisega (tavaliselt on need teekide funktsioonide l\u00f5pp-punktid). Ekspluateerimise t\u00f6\u00f6 seisneb sarnaste plokkide («gadgetide») kutsejadade joonistamises, et saavutada soovitud funktsionaalsus.

\"Haavatavus<\/center> <\/p>\n

R\u00fcnnakuks on vajalik juurdep\u00e4\u00e4s CAN sokettide loomise ja seadistatud vcan v\u00f5rgu liidese loomiseks. R\u00fcnnakuks vajalikud \u00f5igused v\u00f5ivad omandada mitteprivilegeeritud kasutaja konteinerites, mis luuakse s\u00fcsteemides, kus on sisse l\u00fclitatud kasutaja nime ruumide (user namespaces) tugi. N\u00e4iteks on Ubuntu ja Fedora vaikimisi aktiveeritud kasutaja nime ruumid, kuid Debianis ja RHEL-is ei ole need aktiivsed.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3609), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 CAN BCM \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u044f\u0434\u0440\u0430 Linux \u0441 2.6.25 \u043f\u043e 5.13-rc6. \u0412 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043a\u0430 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 (RHEL, Fedora, Debian, Ubuntu, SUSE, Arch). \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u043c\u043e\u0433 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432 root […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100549,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100548","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Haavatavus Linuxi tuumas, mis m\u00f5jutab CAN BCM v\u00f5rgu protokolli | ProHoster","description":"Linuxi tuumas avastati haavatavus (CVE-2021-3609), mis v\u00f5imaldab kohalikul kasutajal oma privileege s\u00fcsteemis t\u00f5sta.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b CAN BCM | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3609), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-20T08:22:55+00:00","article:modified_time":"2021-06-20T08:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100548","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-20 08:24:40","updated":"2022-10-01 08:48:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100548"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100548\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/100549"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}