{"id":101712,"date":"2021-10-21T10:22:53","date_gmt":"2021-10-21T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux"},"modified":"2021-10-21T10:22:53","modified_gmt":"2021-10-21T08:22:53","slug":"raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","title":{"rendered":"Avalikustatud on tehnika Linuxi tuuma tty-alams\u00fcsteemi haavatavuse tootmiseks.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google Project Zero'i teadlased avaldasid meetodi Linuxi tuuma tty-alam s\u00fcsteemi TIOCSPGRP ioctli t\u00f6\u00f6tleja haavatavuse (CVE-2020-29661) \u00e4ra kasutamiseks ning arutlesid \u00fcksikasjalikult kaitsemehhanismide \u00fcle, mis v\u00f5iksid selliseid haavatavusi t\u00f5kestada. <\/p>\n

Probleemi p\u00f5hjustav viga parandati Linuxi tuumas juba eelmise aasta 3. detsembril. Probleem ilmneb tuumades enne versiooni 5.9.13, kuid enamik distributsioonidest on probleemi lahendanud tuuma paketitaaskasutusv\u00e4rskendustes, mis pakuti juba eelmisel aastal (Debian, RHEL, SUSE, Ubuntu, Fedora, Arch). Sarnane haavatavus (CVE-2020-29660) leiti samal ajal TIOCGSID ioctli kutsumise rakenduses, kuid see on samuti juba laialdaselt parandatud. <\/p>\n

Probleem tuleneb vigadest lukustuste seadistamisel, mis p\u00f5hjustavad l\u00f5imedusprobleemi drivers\/tty\/tty_jobctrl.c koodis, mida on v\u00f5imalik kasutada m\u00e4lu j\u00e4rele kutsumise (use-after-free) aluseks, mida saab kasutada kasutaja tasemel TIOCSPGRP ioctli manipuleerimiste kaudu. T\u00f6\u00f6eperiment on demonstreeritud privileegide t\u00f5stmiseks Debian 10-s, kasutades tuuma 4.19.0-13-amd64. <\/p>\n

Avaldatud artiklis r\u00f5hutatakse mitte niiv\u00f5rd t\u00f6\u00f6tava eksperimendi loomise tehnikat, vaid seda, milliseid t\u00f6\u00f6riistu tuumas on olemas selliste haavatavuste kaitsmiseks. J\u00e4reldus on mitte liiga lohutav; meetodid, nagu m\u00e4lu segmenteerimine ja m\u00e4lu j\u00e4rele kutsumise kontroll, ei rakendata praktikas, kuna need toovad kaasa j\u00f5udluse languse ning CFI (Control Flow Integrity) p\u00f5hine kaitse, mis takistab eksperimente r\u00fcnnaku hilises etapis, vajab t\u00e4iendavat arendust. <\/p>\n

Pidades silmas, mis v\u00f5iks pikaajalise olukorra muuta, tuuakse esile arenenud staatiliste anal\u00fcsaatorite kasutamine v\u00f5i sealhulgas m\u00e4lu ohututele t\u00f6\u00f6keeltele nagu Rust ja C keele dialektid, millel on t\u00e4iustatud annotatsioonid (nt Checked C), mis kontrollivad lukustuste, objektide ja n\u00e4idikute seisundit kogumise ajal. Kaitsemeetoditena mainitakse ka panic_on_oops re\u017eiimi aktiveerimist, tuuma struktuuride ainult lugemise re\u017eiimi teisendamist ja s\u00fcsteemikutsumise juurdep\u00e4\u00e4su piiramist selliste mehhanismide kaudu nagu seccomp.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-29661) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ioctl-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 TIOCSPGRP \u0438\u0437 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u044f\u0434\u0440\u0430 Linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u044f\u0434\u0440\u0435 Linux \u0435\u0449\u0451 3 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u044f\u0434\u0440\u0430\u0445 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.9.13, \u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101712","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linuxi tuuma tty-p subs\u00fcsteemi haavatavuse \u00e4rakasutamise tehnika avatud | ProHoster","description":"Google Project Zero meeskonna teadlased avaldasid meetodi Linuxi tuuma tty-p subs\u00fcsteemi ioctl-i TIOCSPGRP t\u00f6\u00f6tleja haavatavuse (CVE-2020-29661) \u00e4rakasutamiseks ning k\u00e4sitlesid \u00fcksikasjalikult selle mehhanisme.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-29661) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ioctl-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 TIOCSPGRP \u0438\u0437 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u044f\u0434\u0440\u0430 Linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-21T08:22:53+00:00","article:modified_time":"2021-10-21T08:22:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101712","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-21 08:23:00","updated":"2022-09-28 02:15:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101712"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101712\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}