{"id":106088,"date":"2022-12-15T13:06:35","date_gmt":"2022-12-15T11:06:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth"},"modified":"2022-12-15T13:06:35","modified_gmt":"2022-12-15T11:06:35","slug":"uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","title":{"rendered":"Linuxi tuumas leitud haavatavused, mida saab kaugelt kasutada Bluetoothi kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi ydas on tuvastatud haavatavus (CVE-2022-42896), mida saab potentsiaalselt kasutada kaugkoodi t\u00e4itmise korraldamiseks ydas tasemel, saates spetsiaalselt kujundatud L2CAP-pakette Bluetoothi kaudu. Samuti on tuvastatud veel \u00fcks sarnane probleem (CVE-2022-42895) L2CAP-i t\u00f6\u00f6tlejas, mis v\u00f5ib viia ydas m\u00e4lu sisu leket konfigureerimisandmetes. Esimene haavatavus on esinenud alates augustist 2014 (ydas 3.16) ja teine alates oktoobrist 2011 (ydas 3.0). Haavatavused on k\u00f5rvaldatud ydas 6.1.0, 6.0.8, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154 ja 5.15.78 versioonides. Paranduste j\u00e4lgimiseks jaotusversioonides saab minna j\u00e4rgmistele lehek\u00fclgedele: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

Kaugjuhtimise r\u00fcnnaku v\u00f5imaluste demonstreerimiseks on avaldatud protot\u00fc\u00fcbid eksploitidest, mis t\u00f6\u00f6tavad Ubuntu 22.04-s. R\u00fcnnaku l\u00e4biviimiseks peab kuritegelik isik olema Bluetoothi ka\u8986\u76d6\u8303\u56f4\u00a0\u2014 eelnevat koppied, ei ole vajalik, kuid arvutil peab olema Bluetooth aktiivne. R\u00fcnnakuks on piisav teada ohvri seadme MAC-aadressi, mida saab m\u00e4\u00e4rata snifimise teel v\u00f5i m\u00f5nede seadmete puhul arvutada Wi-Fi MAC-aadressi p\u00f5hjal. <\/p>\n

Esimene haavatavus (CVE-2022-42896) tuleneb juba vabastatud m\u00e4lu ala (use-after-free) k\u00f5netest l2cap_connect ja l2cap_le_connect_req funktsioonidesse \u2012 p\u00e4rast kanali loomist callback-kutse new_connection kaudu ei lukustunud kanal, kuid seadistati ajastus (__set_chan_timer), mille l\u00f5ppemise korral kutsuti v\u00e4lja l2cap_chan_timeout funktsioon, mis puhastas kanali ilma kanali t\u00f6\u00f6 l\u00f5petamist kontrollimata l2cap_le_connect* funktsioonides. <\/p>\n

Vaikimisi on ajutootel 40 sekundit, arvatakse, et sellise viivituse korral ei saa tekkida v\u00f5idujooksu seisundit. Kuid selgus, et SMP t\u00f6\u00f6tleja teise vea t\u00f5ttu on v\u00f5imalik saavutada ajasti v\u00e4ljakutse kohene aktiveerimine ja j\u00f5uda v\u00f5idujooksu seisundisse. Probleem l2cap_le_connect_req v\u00f5ib p\u00f5hjustada tuumam\u00e4lu leket, samas kui l2cap_connect v\u00f5ib p\u00f5hjustada m\u00e4lusisu \u00fclekirjutamist ja oma koodi k\u00e4ivitamist. Esimene r\u00fcndevariant v\u00f5ib toimuda Bluetooth LE 4.0 kasutamisel (alates 2009. aastast), teine aga Bluetooth BR\/EDR 5.2 kasutamisel (alates 2020. aastast). <\/p>\n

Teine haavatavus (CVE-2022-42895) on p\u00f5hjustatud j\u00e4\u00e4kandmete leket m\u00e4lust funktsioonis l2cap_parse_conf_req, mida v\u00f5ib kasutada kaugjuhtimise teel tuvastamiseks, mis on seotud tuuma struktuuride n\u00e4idikute leidmisega, saates spetsiaalselt vormistatud konfigureerimissoove. Funktsioonis l2cap_parse_conf_req kasutati struktuuri l2cap_conf_efs, mille jaoks ei toimunud ettevalmistavat m\u00e4lu algust, ja man\u00f6\u00f6verdades FLAG_EFS_ENABLE lipuga, oli v\u00f5imalik vanade andmete lisamine paketisse, mis sisaldus virnas. Probleem ilmneb ainult s\u00fcsteemides, kus tuum on koostatud CONFIG_BT_HS valiku abil (vaikimisi v\u00e4lja l\u00fclitatud, kuid aktiveeritud teatud distributsioonides, n\u00e4iteks Ubuntu). Edukaks r\u00fcnnakuks on vajalik ka HCI_HS_ENABLED parameetri seadmine juhtimisliideses v\u00e4\u00e4rtuseks true (vaikimisi ei kasutata).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 Bluetooth. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u043f\u043e\u0445\u043e\u0436\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2022-42895) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 L2CAP, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106088","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused Linuxi tuumas, mida saab kaugelt kasutada Bluetoothi kaudu | ProHoster","description":"Linuxi tuumas avastati haavatavus (CVE-2022-42896), mida v\u00f5ib potentsiaalselt kasutada koodi kaugk\u00e4ivitamiseks tuumatasandil, saates spetsiaalselt vormistatuga L2CAP-pakette.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 Bluetooth | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-15T11:06:35+00:00","article:modified_time":"2022-12-15T11:06:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=106088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106088\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=106088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=106088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=106088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}