{"id":104680,"date":"2022-07-21T09:36:51","date_gmt":"2022-07-21T07:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown"},"modified":"2022-07-21T09:36:51","modified_gmt":"2022-07-21T07:36:51","slug":"uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","title":{"rendered":"Linuxi tuumas on haavatavus, mis v\u00f5imaldab \u00fcletada Lockdown re\u017eiimi piiranguid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi tuumas avastati haavatavus (CVE-2022-21505), mis v\u00f5imaldab kergesti m\u00f6\u00f6duda Lockdown kaitsemehhanismist, mis piirab root-kasutaja juurdep\u00e4\u00e4su tuumale ja blokeerib UEFI Secure Booti \u00fcmbers\u00f5iduteed. \u00dcmberminekuks soovitatakse kasutada IMA (Integrity Measurement Architecture) tuuma alam s\u00fcsteemi, mis on ette n\u00e4htud operatsioonis\u00fcsteemi komponentide terviklikkuse kontrollimiseks digitaalse allkirja ja r\u00e4si abil. <\/p>\n

Lockdown re\u017eiimis piiratakse juurdep\u00e4\u00e4su \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, kprobesi ladustamisre\u017eiimile, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), m\u00f5nede ACPI liideste ja CPU MSR-registerite jaoks, blokeeritakse kexec_file ja kexec_load kutsed, keelatakse une re\u017eiimi minek, piiratakse DMA kasutamist PCI-seadmete jaoks, keelatakse ACPI koodi importimine EFI muutujatest, ei lubata sisendi-\/v\u00e4ljundiportide manipuleerimist, sealhulgas katkestuste numbrite ja sisendi-\/v\u00e4ljundiportide muutmine seeria porti jaoks. <\/p>\n

Haavatavuse tuum seisneb selles, et kui kasutatakse laadimisparameetrit «ima_appraise=log», on v\u00f5imalik kutsuda \u00fcles kexec, et laadida uus tuumakoopia, kui s\u00fcsteemis ei ole aktiivne Secure Boot re\u017eiim ja Lockdown re\u017eiimi kasutatakse iseseisvalt. IMA ei luba «ima_appraise» re\u017eiimi aktiveerimist aktiivse Secure Booti puhul, kuid ei arvestata Lockdowni kasutamise v\u00f5imalust eraldi Secure Bootist.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-21505), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u0435\u0433\u043a\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u0414\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u044f\u0434\u0440\u0430 IMA (Integrity Measurement Architecture), \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0445\u044d\u0448\u0430\u043c. \u0412 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \/dev\/mem, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104680","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linuxi tuumas avastatud haavatavus, mis v\u00f5imaldab m\u00f6\u00f6duda Lockdown re\u017eiimi piirangutest | ProHoster","description":"Linuxi s\u00fcdamikus tuvastati haavatavus (CVE-2022-21505), mis v\u00f5imaldab kergesti \u00fcletada Lockdown kaitsemekanismi, mis piirab root-kasutaja juurdep\u00e4\u00e4su s\u00fcdamikule ja blokeerib UEFI Secure Booti m\u00f5jud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0436\u0438\u043c\u0430 Lockdown | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-21505), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u0435\u0433\u043a\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-21T07:36:51+00:00","article:modified_time":"2022-07-21T07:36:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104680","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-21 07:37:49","updated":"2022-09-28 19:29:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=104680"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104680\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=104680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=104680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=104680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}