{"id":101712,"date":"2021-10-21T10:22:53","date_gmt":"2021-10-21T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux"},"modified":"2021-10-21T10:22:53","modified_gmt":"2021-10-21T08:22:53","slug":"raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","title":{"rendered":"Avatud on Linuxi tuumas tty alams\u00fcsteemi haavatavuse ekspluateerimise tehnika","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google Project Zero meeskonna teadlased avaldasid haavatavuse (CVE-2020-29661) ekspluateerimise meetodi Linuxi tuuma tty alams\u00fcsteemi ioctl-k\u00e4itleja TIOCSPGRP rakenduses ning uurisid p\u00f5hjalikult kaitsemehhanisme, mis v\u00f5iksid selliseid haavatavusi blokeerida. <\/p>\n

Probleemi p\u00f5hjustav viga k\u00f5rvaldati Linuxi tuumas juba mullu 3. detsembril. Probleem avaldub tuumades, mis on versioonid kuni 5.9.13, kuid enamik distributsioone on probleemi lahendanud tuuma pakettide uuendustes, mis pakuti juba eelmisel aastal (Debian, RHEL, SUSE, Ubuntu, Fedora, Arch). Sarnane haavatavus (CVE-2020-29660) leiti samal ajal ioctl-k\u00e4sku TIOCGSID rakendades, kuid see on samuti juba laialdaselt parandatud. <\/p>\n

Probleem on p\u00f5hjustatud lukustuste seadistamise veast, mis viib koodi drivers\/tty\/tty_jobctrl.c puhul andmete konkurentsiseisundisse, mida suudeti kasutada m\u00e4lu juurdep\u00e4\u00e4su tingimuste loomiseks p\u00e4rast selle vabastamist (use-after-free), ekspluateerituna kasutajaruumi kaudu TIOCSPGRP ioctl-k\u00f5ne manipuleerimise kaudu. T\u00f6\u00f6tav eksploit on demonstreeritud priviligeeritud t\u00f5stmiseks Debian 10 versiooniga 4.19.0-13-amd64. <\/p>\n

Avaldatud artiklis ei keskenduta niiv\u00f5rd t\u00f6\u00f6ka eksploidijate loomise tehnikatele, vaid sellele, millised t\u00f6\u00f6riistad tuumas eksisteerivad sarnaste haavatavuste kaitsmiseks. Tulemus on masendav, kuna m\u00e4lusegmentimise ja m\u00e4luhalduse meetodid p\u00e4rast vabastamist ei rakendata praktikas, kuna need v\u00e4hendavad j\u00f5udlust, ning CFI (Control Flow Integrity) p\u00f5hine kaitse, mis blokeerib eksploidid r\u00fcnnaku hilisemates etappides, vajab t\u00e4iendavat arendust. <\/p>\n

K\u00fcsimuses, mis v\u00f5iks pikaajalises perspektiivis olukorda muuta, tuuakse esile edasij\u00f5udnud staatiliste anal\u00fcsaatorite kasutamine v\u00f5i keelte rakendamine, mis tagavad m\u00e4luga ohutu t\u00f6\u00f6tamise, nagu Rust ja C keele dialektid laiendatud annotatsioonidega (n\u00e4iteks Checked C), mis kontrollivad lukustuste, objektide ja n\u00e4idikute seisundit koostamise etapis. Kaitsemeetoditena mainitakse ka panic_on_oops re\u017eiimi aktiveerimist, tuuma struktuuride muutmist ainult lugemisre\u017eiimiks ja juurdep\u00e4\u00e4su piiramine s\u00fcsteemik\u00f5nedele selliste mehhanismidega nagu seccomp.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-29661) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ioctl-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 TIOCSPGRP \u0438\u0437 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u044f\u0434\u0440\u0430 Linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u044f\u0434\u0440\u0435 Linux \u0435\u0449\u0451 3 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u044f\u0434\u0440\u0430\u0445 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.9.13, \u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101712","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Avastati r\u00fcnde tehnika Linuxi tuuma tty-alams\u00fcsteemi n\u00f5rkusele | ProHoster","description":"Google Project Zero meeskonna teadlased avaldasid r\u00fcnde meetodi Linuxi tuuma tty-alams\u00fcsteemi ioctl-t\u00f6\u00f6tlija TIOCSPGRP n\u00f5rkuse (CVE-2020-29661) \u00e4ra kasutamiseks ning arutasid p\u00f5hjalikult kaitsemehhanisme, mis v\u00f5iksid selliseid n\u00f5rkusi blokeerida. Probleemi tekitav viga oli k\u00f5rvaldatud Linuxi tuumas juba eelmise aasta 3. detsembril. Probleem esines tuumades, mis on vanemad kui versioon 5.9.13, kuid enamik jaotusi on probleemiga tegelenud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-29661) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ioctl-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 TIOCSPGRP \u0438\u0437 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u044f\u0434\u0440\u0430 Linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u044f\u0434\u0440\u0435 Linux \u0435\u0449\u0451 3 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u044f\u0434\u0440\u0430\u0445 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.9.13, \u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-21T08:22:53+00:00","article:modified_time":"2021-10-21T08:22:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101712","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-21 08:23:00","updated":"2022-09-28 02:15:28"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101712"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101712\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}