{"id":106088,"date":"2022-12-15T13:06:35","date_gmt":"2022-12-15T11:06:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth"},"modified":"2022-12-15T13:06:35","modified_gmt":"2022-12-15T11:06:35","slug":"uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","title":{"rendered":"Linuxi tuuma haavatavused, mida saab kaugelt kasutada Bluetoothi kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi tuumas on tuvastatud haavatavus (CVE-2022-42896), mida saab potentsiaalselt kasutada kaugelt koodi k\u00e4ivitamiseks tuuma tasemel, saates spetsiaalselt koostatud L2CAP-paketti Bluetoothi kaudu. Lisaks on tuvastatud veel \u00fcks sarnane probleem (CVE-2022-42895) L2CAP t\u00f6\u00f6tlejas, mis v\u00f5ib viia tuuma m\u00e4lu sisu leket konfigureerimisandmete paketides. Esimene haavatavus ilmneb alates augustist 2014 (tuum 3.16) ja teine alates oktoobrist 2011 (tuum 3.0). Haavatavused on k\u00f5rvaldatud Linuxi tuuma versioonides 6.1.0, 6.0.8, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154 ja 5.15.78. Veaparanduste j\u00e4lgimiseks jaotustes saate k\u00fclastada j\u00e4rgmisi lehti: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

Kaugt\u00f5kkev\u00f5imetuse demonstreerimiseks on avaldatud protot\u00fc\u00fcbid eksploitidest, mis t\u00f6\u00f6tavad Ubuntu 22.04. R\u00fcnnaku sooritamiseks peab sissetungija olema Bluetooth'i vahemikus \u2014 eelnevat paari ei ole vaja, kuid Bluetooth peab olema arvutis aktiveeritud. R\u00fcnnakuks piisab, kui teada ohvri seadme MAC-aadressi, mis v\u00f5ib olla m\u00e4\u00e4ratud j\u00e4rgi snifimise kaudu v\u00f5i muudel seadmetel arvutatud Wi-Fi MAC-aadressi p\u00f5hjal. <\/p>\n

Esimene haavatavus (CVE-2022-42896) on p\u00f5hjustatud juba vabastatud m\u00e4lupiirkonda p\u00f6\u00f6rdumisest (use-after-free) l2cap_connect ja l2cap_le_connect_req funktsioonide rakendamisel \u2014 p\u00e4rast kanali loomist callback-k\u00f5ne new_connection'i kaudu ei olnud selle jaoks lukku seatud, kuid seadistati taimer (__set_chan_timer), mille aegumise korral kutsutakse funktsioon l2cap_chan_timeout, mis puhastab kanali ilma kontrollimata, kas kanali t\u00f6\u00f6tlemine on l\u00f5petatud l2cap_le_connect* funktsioonides. <\/p>\n

Vaikimisi on taimeri aegumine 40 sekundit ja arvati, et sellise viivitusega ei saa olla v\u00f5istluse seisundit, kuid selgus, et teise vea t\u00f5ttu SMP t\u00f6\u00f6tlejas on v\u00f5imalik taimer kohe kutsuda ja saavutada v\u00f5istluse seisund. Probleem l2cap_le_connect_req-s v\u00f5ib viia tuuma m\u00e4lu leketeni, samas kui l2cap_connect v\u00f5ib kirjutada m\u00e4lu sisu \u00fcle ja t\u00e4ita oma koodi. Esimene r\u00fcnde variant saab teostada Bluetooth LE 4.0 (alates 2009. aastast) kasutamisega, teine aga Bluetooth BR\/EDR 5.2 (alates 2020. aastast) kasutamisega. <\/p>\n

Teine haavatavus (CVE-2022-42895) on p\u00f5hjustatud j\u00e4\u00e4kandmete leklest m\u00e4lus funktsioonis l2cap_parse_conf_req, mida saab kasutada kaugelt tuvastamiseks, et saada teavet tuuma struktuuride kohta, saates spetsiaalselt koostatud konfigureerimis\u3000\u3000\u3000\u3000p\u00e4ringud. Funktsioonis l2cap_parse_conf_req kasutati struktuuri l2cap_conf_efs, mille jaoks ei olnud ette n\u00e4htud eelnevat m\u00e4lude j\u00e4rjekorra initsialiseerimist, ning flaga FLAG_EFS_ENABLE manipuleerimisega oli v\u00f5imalik saavutada, et vanad andmed kuhjati paketti. Probleem ilmneb ainult s\u00fcsteemides, kus tuum on kompileeritud valikuga CONFIG_BT_HS (vaikimisi on see keelatud, kuid aktiveeritud m\u00f5nedes jaotustes, nagu n\u00e4iteks Ubuntu). Edukaks r\u00fcnnakuks on samuti vajalik HCI_HS_ENABLED parameetri seadmine juhtimise liidese kaudu v\u00e4\u00e4rtusele true (vaikimisi ei kasutata).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 Bluetooth. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u043f\u043e\u0445\u043e\u0436\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2022-42895) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 L2CAP, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106088","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linuxi tuum haavatavused, mida saab kaugelt \u00e4ra kasutada Bluetoothi kaudu | ProHoster","description":"Linuxi tuumas tuvastati haavatavus (CVE-2022-42896), mida saab potentsiaalselt kasutada tuuma taseme kaugkoodi t\u00e4itmiseks, saates spetsiaalselt koostatud L2CAP paketti.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 Bluetooth | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-15T11:06:35+00:00","article:modified_time":"2022-12-15T11:06:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=106088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106088\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=106088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=106088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=106088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}