{"id":102971,"date":"2022-01-16T03:36:38","date_gmt":"2022-01-16T01:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82"},"modified":"2022-01-16T03:36:38","modified_gmt":"2022-01-16T01:36:38","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","title":{"rendered":"K\u00fcsimus cryptsetupis, mis v\u00f5imaldab LUKS2-osade kr\u00fcpteerimise keelata.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cryptsetup pakettis, mida kasutatakse Linuxi kettaparty \u0161ifreerimiseks, on avastatud haavatavus (CVE-2021-4122), mis v\u00f5imaldab metaandmete muutmise kaudu \u0161ifreerimise keelata LUKS2 (Linux Unified Key Setup) formaadis partitsioonides. Haavatavuse \u00e4rakasutamiseks peab r\u00fcndajal olema f\u00fc\u00fcsiline ligip\u00e4\u00e4s \u0161ifreeritud andmekandjale, st meetod on m\u00f5istlik peamiselt \u0161ifreeritud v\u00e4liste m\u00e4luseadmete, nagu Flash-m\u00e4lud, r\u00fcndamiseks, millele r\u00fcndaja p\u00e4\u00e4seb ligi, kuid ei tea andmete dekodeerimise parooli. <\/p>\n

R\u00fcnnak on rakendatav ainult LUKS2 formaadi puhul ja see on seotud metainfoga, mis vastutab \u201eonline reencryption\u201d laienduse aktiveerimise eest, v\u00f5imaldades vajadusel juurdep\u00e4\u00e4suv\u00f5tme vahetamise korral alustada andmete reenkodeerimise protsessi reaalajas, peatamata jagamise kasutamist. Kuna uue v\u00f5tmega dekr\u00fcpteerimise ja kr\u00fcpteerimise protsess v\u00f5tab aega, annab \u201eonline reencryption\u201d v\u00f5imaluse jagamise kasutamist katkestamata teostada reenkodeerimist taustal, j\u00e4rk-j\u00e4rgult muutes \u00fchte v\u00f5tme andmed teise v\u00f5rra. Sealhulgas on v\u00f5imalik valida t\u00fchi sihtv\u00f5ti, mis v\u00f5imaldab jagada muuta dekr\u00fcpteeritud olekusse. <\/p>\n

R\u00fcndaja v\u00f5ib metainfos LUKS2 teha muudatusi, simuleerides dekr\u00fcpteerimise operatsiooni l\u00f5petamise t\u00f5rke korral ja saavutada osa jagamisest dekr\u00fcpteerimist p\u00e4rast muudetud andmekandja aktiveerimist ja kasutamist omanikult. Samuti ei saa kasutaja, kes on \u00fchendatud muudetud andmekandjaga ja avab selle \u00f5ige parooliga, mingit hoiatust katkestatud reenkodeerimise protsessi taastamise kohta ning v\u00f5ib selle k\u00e4igu avastada ainult k\u00e4su \u201eluks Dump\u201d abil. Andmemahu dekr\u00fcpteerimine, mille r\u00fcndaja v\u00f5ib saavutada, s\u00f5ltub LUKS2 pealkirja suurusest, kuid vaike suuruse (16 MiB) puhul v\u00f5ib see \u00fcletada 3 GB. <\/p>\n

Probleem tuleneb sellest, et hoolimata sellest, et \u00fcmberkr\u00fcpteerimine n\u00f5uab uute ja vanade v\u00f5tmete r\u00e4si arvutamist ja kontrollimist, ei ole algselt kr\u00fcpteerimise dekr\u00fcpteerimiseks r\u00e4si vaja, kui uus olek t\u00e4hendab, et kr\u00fcpteerimist ei ole (tasuline tekst). Lisaks ei ole LUKS2 metaandmed, kus m\u00e4\u00e4ratakse kr\u00fcpteerimisalgoritm, kaitstud muutmise eest, kui need satuvad kurjategija k\u00e4tte. Haavatavuse blokeerimiseks lisasid arendajad LUKS2-sse t\u00e4iendava kaitse metaandmete jaoks, mille jaoks kontrollitakse n\u00fc\u00fcd t\u00e4iendavat r\u00e4si, mis arvutatakse tuntud v\u00f5tmest ja metaandmete sisust, st r\u00fcndaja ei saa enam m\u00e4rkamatult metaandmeid muuta, teadmata dekr\u00fcpteerimise parooli. <\/p>\n

T\u00fc\u00fcpiline r\u00fcnnaku stsenaarium eeldab, et kurjategijal on v\u00f5imalus mitu korda andmesalvestit enda k\u00e4tte saada. Alustuseks muudab r\u00fcndaja, kes ei tea juurdep\u00e4\u00e4susoovit, metandmete valdkonnas muudatusi, mis k\u00e4ivitavad osa andmete dekr\u00fcptimise j\u00e4rgmise andmesalvesti aktiveerimise ajal. Seej\u00e4rel tagastatakse andmesalvesti oma kohale ja r\u00fcndaja ootab, kuni kasutaja selle \u00fchendab ja parooli sisestab. Seadme aktiveerimise ajal k\u00e4ivitab kasutaja taustprotsessi uuesti \u0161ifreerimiseks, mille k\u00e4igus osa kr\u00fcptitud andmeid asendatakse dekr\u00fcpteeritud andmetega. Kui r\u00fcndaja saab seadme uuesti k\u00e4tte, on osa andmetest andmesalvestis dekr\u00fcpteeritud. <\/p>\n

Probleem on tuvastatud cryptsetup projekti hooldaja poolt ja parandatud cryptsetup 2.4.3 ja 2.3.7 v\u00e4rskendustes. Probleemi lahendamise v\u00e4rskenduste olekut jaotustes saab j\u00e4lgida nende lehtede kaudu: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. Haavatavus ilmneb alates cryptsetup 2.2.0 versioonist, kus toodi sisse \u201eonline reencryption\u201d operatsiooni tugi. Kaitsega variant on k\u00e4ivitamine valikuga \u201e--disable-luks2-reencryption\u201d.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2 (Linux Unified Key Setup). \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044e, \u0442.\u0435. \u043c\u0435\u0442\u043e\u0434 \u0438\u043c\u0435\u0435\u0442 \u0441\u043c\u044b\u0441\u043b \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u0438, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Flash-\u0434\u0438\u0441\u043a\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102971","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus cryptsetup'is, mis v\u00f5imaldab kr\u00fcpteerimise keelata LUKS2 sektsioonides | ProHoster","description":"Cryptsetup paketis, mida kasutatakse Linuxi kettasegmentide kr\u00fcptimiseks, avastati haavatavus (CVE-2021-4122), mis v\u00f5imaldab metainfo muutmise kaudu kr\u00fcptimise keelata LUKS2 formaadis segmentides.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cryptsetup, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 LUKS2-\u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-01-16T01:36:38+00:00","article:modified_time":"2022-01-16T01:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102971","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-01-16 01:37:39","updated":"2022-09-28 07:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102971"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102971\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}