{"id":102971,"date":"2022-01-16T03:36:38","date_gmt":"2022-01-16T01:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82"},"modified":"2022-01-16T03:36:38","modified_gmt":"2022-01-16T01:36:38","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","title":{"rendered":"Turvaauk cryptsetup'is, mis v\u00f5imaldab LUKS2 jagudes kr\u00fcptimise keelamist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cryptsetup paketis, mida kasutatakse Linuxi kettaosa kr\u00fcpteerimiseks, on avastatud haavatavus (CVE-2021-4122), mis v\u00f5imaldab metaandmete modifitseerimise kaudu kehtestada kr\u00fcpteerimise keelamise LUKS2 (Linux Unified Key Setup) formaadis osadel. Haavatavuse \u00e4rakasutamiseks peab r\u00fcndajal olema f\u00fc\u00fcsiline juurdep\u00e4\u00e4s kr\u00fcpteeritud andmekandjale, st meetod on peamiselt m\u00f5eldud kr\u00fcpteeritud v\u00e4liste m\u00e4luseadmete r\u00fcndamiseks, nagu n\u00e4iteks Flash-diskid, millele kurjategija p\u00e4\u00e4seb juurde, kuid ei tea andmete dekr\u00fcpteerimise parooli. <\/p>\n

R\u00fcnnak on rakendatav ainult LUKS2 formaadi jaoks ning see on seotud metaandmete manipuleerimisega, mis vastutavad \"online reencryption\" laienduse aktiveerimise eest. See v\u00f5imaldab vajadusel juurdep\u00e4\u00e4suv\u00f5tme vahetamisel algatada andmete reenkodeerimise protsessi reaalajas ilma jaotuse t\u00f6\u00f6d katkestamata. Kuna andmete dekodeerimise ja uue v\u00f5tmega kodeerimise protsess v\u00f5tab palju aega, v\u00f5imaldab \"online reencryption\" t\u00f6\u00f6tada jaotusega katkestamata, teostades reenkodeerimist taustal, vaikselt muutes andmeid \u00fche v\u00f5tme alt teise alla. Samuti on v\u00f5imalik valida t\u00fchi sihtv\u00f5ti, mis v\u00f5imaldab jaotuse muundada dekodeeritud olekusse. <\/p>\n

R\u00fcndaja v\u00f5ib LUKS2 metaandmetesse teha muudatusi, simuleerides decoodeerimisoperatsiooni h\u00e4daolukorra katkemist t\u00f5rke t\u00f5ttu, saavutades selle tulemuseks jaotuse osa dekodeerimise p\u00e4rast modifitseeritud m\u00e4luseadmest s\u00f5ltuva omaniku aktiveerimist ja kasutamist. Samal ajal ei saa kasutaja, kes on \u00fchendatud modifitseeritud m\u00e4luseadmaga ja on selle \u00f5igete paroolidega avanenud, mingit hoiatust peatatud reenkodeerimise taastamise protsessi teostamise kohta ning v\u00f5ib selle protsessi k\u00e4igust teada saada ainult k\u00e4su \"luks Dump\" abil. R\u00fcndaja suudab dekodeerida andmete mahtu, mis s\u00f5ltub LUKS2 pealkirja suurusest, kuid vaikimisi suuruse (16 MiB) korral v\u00f5ib see \u00fcletada 3 GB. <\/p>\n

Probleem tuleneb sellest, et kuigi uuesti kr\u00fcpteerimine n\u00f5uab uute ja vanade v\u00f5tmete r\u00e4sim\u00e4rkide arvutamist ja kontrollimist, ei ole dekr\u00fcpteerimise alguses r\u00e4sim\u00e4rk vajalik, kui uue oleku korral eeldatakse kr\u00fcpteerimise v\u00f5tme puudumist (selges\u00f5naline tekst). Lisaks ei ole LUKS2 metaandmed, milles m\u00e4\u00e4ratakse kr\u00fcpteerimise algoritm, kaitstud r\u00e4sim\u00e4rkide muutumise eest, kui need satuvad pahatahtlike k\u00e4tte. Selle haavatavuse blokeerimiseks lisasid arendajad LUKS2-le t\u00e4iendava kaitse metaandmete jaoks, mille jaoks kontrollitakse n\u00fc\u00fcd t\u00e4iendavat r\u00e4sim\u00e4rki, mis arvutatakse tuntud v\u00f5tmete ja metaandmete sisu p\u00f5hjal, st r\u00fcndaja ei saa n\u00fc\u00fcd m\u00e4rkamatult muuta metaandmeid, teadmata dekr\u00fcpteerimise parooli. <\/p>\n

T\u00fc\u00fcpiline r\u00fcnnaku stsenaarium n\u00f5uab, et pahatahtlikul isikul oleks mitu korda v\u00f5imalik kantavat seadet enda k\u00e4tte saada. Alguses teeb r\u00fcndaja, kes ei tea ligip\u00e4\u00e4sukoodi, muutusi metaandmete alal, mis k\u00e4ivitavad osa andmete dekr\u00fcpteerimise j\u00e4rgmise seadme aktiveerimise ajal. Seej\u00e4rel tagastatakse seade oma kohale ja r\u00fcndaja ootab, kuni kasutaja \u00fchendab selle, sisestades parooli. Seadmeli aktiveerimise ajal k\u00e4ivitub kasutaja poolt taustaprotsess uuesti kr\u00fcpteerimiseks, mille k\u00e4igus osa kr\u00fcpteeritud andmeid asendatakse dekr\u00fcpteeritud andmetega. Kui r\u00fcndaja saab seadme veel kord enda k\u00e4tte, on osa andmeid seadmes dekr\u00fcpteeritud. <\/p>\n

Probleem avastati projekti cryptsetup hooldaja poolt ning see on parandatud cryptsetup 2.4.3 ja 2.3.7 v\u00e4rskendustes. Uuenduste teket probleemi lahendamiseks distributsioonides saab j\u00e4lgida j\u00e4rgmistel lehtedel: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. Haavatavus avaldub ainult alates cryptsetup 2.2.0 versioonist, kus lisandus \"online reencryption\" operatsiooni tugi. Kaitsmiseks v\u00f5ib kasutada ka k\u00e4ivitamist valikuga \"--disable-luks2-reencryption\".
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2 (Linux Unified Key Setup). \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044e, \u0442.\u0435. \u043c\u0435\u0442\u043e\u0434 \u0438\u043c\u0435\u0435\u0442 \u0441\u043c\u044b\u0441\u043b \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u0438, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Flash-\u0434\u0438\u0441\u043a\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102971","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cryptsetup haavatavus, mis v\u00f5imaldab LUKS2 osades kr\u00fcpteerimise v\u00e4lja l\u00fclitada | ProHoster","description":"Cryptsetup paketis, mis on m\u00f5eldud Linuxi diskiosade kr\u00fcpteerimiseks, avastati haavatavus (CVE-2021-4122), mis v\u00f5imaldab metaandmete muutmise kaudu kr\u00fcpteerimise v\u00e4lja l\u00fclitada LUKS2 formaadis osades.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cryptsetup, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 LUKS2-\u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-01-16T01:36:38+00:00","article:modified_time":"2022-01-16T01:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102971","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-01-16 01:37:39","updated":"2022-09-28 07:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102971"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102971\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}