{"id":103489,"date":"2022-03-07T21:36:38","date_gmt":"2022-03-07T19:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya"},"modified":"2022-03-07T21:36:38","modified_gmt":"2022-03-07T19:36:38","slug":"uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","title":{"rendered":"Linuxi tuumas avastatud haavatavus, mis v\u00f5imaldab muuta ainult lugemiseks m\u00f5eldud faile.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi tuumas avastati haavatavus (CVE-2022-0847), mis v\u00f5imaldab \u00fcle kirjutada m\u00e4lukahtluse sisu k\u00f5igi failide jaoks, sealhulgas ka ainult lugemisre\u017eiimis avatud failide jaoks, mis on avatud O_RDONLY lipuga v\u00f5i \u00fchendatud ainult lugemisre\u017eiimis failis\u00fcsteemidega. Praktiliselt toob see haavatavus kaasa, et seda saab kasutada koodi sisestamiseks suvalistesse protsessidesse v\u00f5i failide avamise k\u00e4igus andmete moonutamiseks. N\u00e4iteks on v\u00f5imalik muuta authorized_keys faili sisu sshd protsessi jaoks. Testimiseks on saadaval eksploitide protot\u00fc\u00fcp. <\/p>\n

Probleem sai koodnime Dirty Pipe, sarnaselt 2016. aastal avastatud kriitilisele haavatavusele Dirty COW. T\u00f5detakse, et ohu taseme poolest on Dirty Pipe samal tasemel nagu Dirty COW, kuid palju lihtsamini \u00e4ra kasutatav. Haavatavus tuvastati kaebuste anal\u00fc\u00fcsi k\u00e4igus, mis puudutas v\u00f5rgu kaudu laaditavate failide perioodilisi riknemisi s\u00fcsteemis, mis laadis kokkut\u00f5mmatud arhiive logiserverist (3 kuu jooksul 37 riknemist koormatud s\u00fcsteemis), mille ettevalmistamisel kasutati splice() operatsiooni ja nimetamata torusid. <\/p>\n

Haavatavus ilmneb alates Linuxi tuumast 5.8, mis ilmus 2020. aasta augustis, st see on olemas Debian 11-s, kuid ei m\u00f5juta Ubuntu 20.04 LTS p\u00f5hituuma. RHEL 8.x ja openSUSE\/SUSE 15 tuumad p\u00f5hinevad algselt vanadel harudel, kuid ei saa v\u00e4listada, et probleemsed muudatused on neisse tagatud (t\u00e4pseid andmeid pole veel). Pakettide uuenduste avaldamise j\u00e4lgimiseks distributsioonides saab kasutada j\u00e4rgmistel lehtedel: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. Haavatavuse k\u00f5rvaldamine on pakutud versioonides 5.16.11, 5.15.25 ja 5.10.102. Parandus on samuti kaasatud Androidi platvormil kasutatavasse tuuma. <\/p>\n

Haavatavus on tingitud v\u00e4\u00e4rtuse «buf->flags» initsialiseerimise puudumisest funktsioonides copy_page_to_iter_pipe() ja push_pipe(), kuna struktuuri m\u00e4lu eraldamisel ei puhastata ja teatud manipuleerimiste korral nimetamata kanalitega v\u00f5ib «buf->flags» leida v\u00e4\u00e4rtuse, mis p\u00e4rineb teisest operatsioonist. Kasutades seda omadust, saab mittepriviligeeritud kohalik kasutaja saavutada, et lipu v\u00e4\u00e4rtuseks muutub PIPE_BUF_FLAG_CAN_MERGE, mis lubab andmete kirjutamist lehek\u00fcljete vahem\u00e4lles, lihtsalt uute andmete kirjutamise kaudu spetsiaalselt ette valmistatud nimetamata kanalisse (pipe). <\/p>\n

R\u00fcnde fail peab olema loetav, kuna toru kirjutamisel \u00f5igusi ei kontrollita, v\u00f5ib vahem\u00e4lu asendamine toimuda ka ainult lugemiseks monteeritud osade failide suhtes (n\u00e4iteks CD-ROM-i failide puhul). P\u00e4rast teabe asendamist lehe vahem\u00e4lus saab protsess faili lugemisel vale, mitte tegeliku teabe. <\/p>\n

Kasutamine seisneb nimetu toru loomises ja selle t\u00e4itmises suvaliste andmetega, et saavutada PIPE_BUF_FLAG_CAN_MERGE lipu seadmine k\u00f5igis seotud ringstruktuurides. Seej\u00e4rel loetakse andmed torust, kuid lipp j\u00e4\u00e4b seatuks k\u00f5igis pipe_buffer ringstruktuuride eksemplarides. Seej\u00e4rel kutsutakse splice() andmete lugemiseks sihtfailist nimetu torusse, alustades vajalikust nihkes. Kui andmeid sellele nimetud torule kirjutatakse, siis seatud PIPE_BUF_FLAG_CAN_MERGE lipu t\u00f5ttu kirjutatakse andmed vahem\u00e4lus \u00fcle, mitte ei loodud uut pipe_buffer struktuuri eksemplari.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0847), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c O_RDONLY \u0438\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u043f\u0440\u0438\u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f. \u0421 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438\u043b\u0438 \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103489","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Linuxi tuumas, mis v\u00f5imaldab vaid lugemiseks m\u00f5eldud faile moonutada | ProHoster","description":"Linuxi tuumas on tuvastatud haavatavus (CVE-2022-0847), mis v\u00f5imaldab \u00fcle kirjutada vahem\u00e4lu sisu mistahes failide puhul, sealhulgas ainult lugemisre\u017eiimis, avatud O_RDONLY lipuga v\u00f5i paigutatud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0847), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c O_RDONLY \u0438\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-07T19:36:38+00:00","article:modified_time":"2022-03-07T19:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-07 19:37:31","updated":"2022-10-03 12:20:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103489"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103489\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}