{"id":114603,"date":"2024-03-27T12:25:57","date_gmt":"2024-03-27T10:25:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd"},"modified":"2024-03-27T12:25:57","modified_gmt":"2024-03-27T10:25:58","slug":"uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","title":{"rendered":"Linuxi kernis esinevad haavatavused, mis v\u00f5imaldavad t\u00f5sta oma \u00f5igusi nf_tables'i ja ksmbd kaudu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Netfilteris, Linuxi tuumaal asuv allj\u00e4rgneva paketifiltreerimise ja -muutmise s\u00fcsteem, leidis turvaviga (CVE-2024-1086), mis v\u00f5imaldab kohalikel kasutajatel k\u00e4itada tuuma tasemel koodi ja t\u00f5sta oma \u00f5igusi s\u00fcsteemis. Probleem tuleneb m\u00e4lu topeltvabastamisest (double-free) nf_tables moodulis, mis haldab nftables pakettfiltrit. Turvavea avastanud turuurija on arendanud ja avaldanud t\u00f6\u00f6kava, mille kaudu eksploiti demonstreerida. <\/p>\n

Exploit t\u00f6\u00f6 n\u00e4idati j\u00e4tkuvates Debian ja Ubuntu v\u00e4ljaannetes koos Linuxi kernelitega 5.14 - 6.6, samuti KernelCTF (Capture the Flag) keskkonnas, mis sisaldab t\u00e4iendavaid parandusi t\u00fc\u00fcpiliste exploit-t\u00f6\u00f6tlusmeetodite blokeerimiseks ja mida Google kasutab haavatavuste leidmise preemia programmides. Exploiti t\u00f6\u00f6 edukuse m\u00e4\u00e4r on 99.4%. Saateartiklis anal\u00fc\u00fcsitakse \u00fcksikasjalikult keeruka mitmetasandilise exploiti loomise protsessi ning kaitse ja vastumeetmete \u00fcletamise kohta, mis esinevad kernelis.

\"Linuxi<\/center> <\/p>\n

Probleem on seotud veaga nft_verdict_init() funktsioonis, mis lubab positiivsete v\u00e4\u00e4rtuste kasutamise pakettide viskemise veakoodina (DROP) hookides, v\u00f5imaldades seega nf_hook_slow() funktsioonis uuesti vabastada m\u00e4lu juba varem vabastatud puhver. Probleem tekib, kui NF_DROP operatsioon on t\u00f5lgendatud veaga ja tuum t\u00f5lgendab esmalt NF_DROP'i, vabastab seej\u00e4rel puhvri ja tagastab staatuse NF_ACCEPT. See olukord viib selleni, et kuigi pakettide puhver on vabastatud, ei peata selle t\u00f6\u00f6tlemine ja see edastatakse teisele t\u00f6\u00f6tlejale, mis omakorda kutsub teist korda v\u00e4lja m\u00e4lu vabastamise funktsiooni. <\/p>\n

Turvaviga ilmneb alates Linuxi tuuma versioonist 3.15, kuid eksploiti saab kasutada alates versioonist 5.14. Turvavea parandamine on pakutud Linuxi tuuma v\u00e4ljaandes 6.8-rc1 ja veebruari l\u00f5pus viidud stabiilsetesse harudesse 5.15.149, 6.1.76 ja 6.6.15. Distrodes saab turvavea parandust j\u00e4lgida lehtedel: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

Lisaks sellele tuleks m\u00e4rkida j\u00e4rjestikku turvavead ksmbd moodulis, mis pakub tuuma Linuxi seadistust SMB protokolli p\u00f5hjal: Turvaviga CVE-2024-26592 v\u00f5imaldab kaugjuhtimisel ilma autentimiseta l\u00e4htestada oma koodi tuuma \u00f5igustega s\u00fcsteemides, kus ksmbd moodul on aktiivne. Probleem tuleneb v\u00f5istlush\u00e4iretest TCP-\u00fchenduse t\u00f6\u00f6tlemise koodis, mis tekib sobivate lukustuste puudumise t\u00f5ttu objekti k\u00e4sitlemisel. serverile<\/a> Turvaviga CVE-2023-52440 v\u00f5imaldab samuti kaugjuhtimisel saavutada oma koodi t\u00e4itmist tuuma \u00f5igustega, kuid see tuleneb puhvri \u00fclet\u00e4itumisest vale sisenemise v\u00f5tmete t\u00f6\u00f6tlemisel, kuna puudub korralik suuruse kontroll kasutajalt saadud andmete kopeerimisel fikseeritud suuruse puhvri. <\/p>\n

Turvavead (1, 2, 3) CVE-2024-26594, CVE-2023-52442 ja CVE-2023-52441 ksmbd-s v\u00f5imaldavad kaugelt ja ilma autentimiseta p\u00e4\u00e4seda tuuma m\u00e4lu sisule. Turvaviga CVE-2024-26594 tuleneb andmete vale kontrollimisest, kui t\u00f6\u00f6deldakse vastuv\u00f5etud SMB2 Mech tokenit, mis viib andmete tagastamiseni puhvri piiridest. Turvaviga CVE-2023-52442 on tingitud piisavate sisendandmete kontrollimise puudumisest seondunud (chained) p\u00e4ringute t\u00f6\u00f6tlemisel. Turvaviga CVE-2023-52441 tuleneb vajalikku sisendaandmete kontrolli puudumisest SMB2 \u00fchenduse lepingu p\u00e4ringute t\u00f6\u00f6tlemisel. <\/p>\n

Turvavead CVE-2024-26594 ja CVE-2024-26592 on parandatud tuumas 6.8 ja varasemate stabiilsete harude, sealhulgas 6.1.75, 6.6.14, 6.7.2, korrigeerivate v\u00e4rskenduste raames. \u00dclej\u00e4\u00e4nud turvavead on parandatud tuumas 6.5 ja v\u00e4rskendustes 5.15.145, 6.1.53, 6.4.16. <\/p>\n

Haavatavused CVE-2024-26594 ja CVE-2024-26592 on parandatud kernelis 6.8 ja eelnevate stabiilsete versioonide 6.1.75, 6.6.14, 6.7.2 korrigeerivate uuenduste kaudu. \u00dclej\u00e4\u00e4nud haavatavused on k\u00f5rvaldatud kernelis 6.5 ja uuendustes 5.15.145, 6.1.53, 6.4.16. <\/p>\n

Kokkuv\u00f5tteks v\u00f5ib mainida uue Linuxi kernelite arendajate meeskonna loomist, mis on loodud haavatavuste anal\u00fc\u00fcsimiseks ja olemuslike seaduste seose hindamiseks kernelis tehtud paranduste ja turvaprobleemide vahel. Veebruaris asutasid kernelite arendajad oma CNA (CVE Numbering Authority) teenuse, mis sai volitused iseseisvalt CVE-ide m\u00e4\u00e4ramiseks haavatavustele. Enne seda oli CVE m\u00e4\u00e4ramine ja paranduste seose anal\u00fc\u00fcs potentsiaalsete haavatavustega arendajate \u00f5lgadel ning kernelis ei olnud potentsiaalsed haavatavused eristatavad ja nad ilmnesid tavap\u00e4raste parandustega samal joonel. Uue teenuse t\u00f6\u00f6 tulemused on \u00fcletanud k\u00f5ik ootused - kernelis m\u00e4rgitakse iga p\u00e4ev kuni mituk\u00fcmmend uut haavatavust, mis olid varem turvaprobleemidena m\u00e4rkamatuks j\u00e4\u00e4nud. N\u00e4iteks 26. m\u00e4rtsil anti 14-le haavatavale, mida varem turvaprobleemina ei k\u00e4sitletud, uued CVE-id, ja 25. m\u00e4rtsil - 41 haavatavust.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused Linuxi tuumas, mis v\u00f5imaldavad \u00f5iguste t\u00f5stmist l\u00e4bi nf_tables ja ksmbd | ProHoster","description":"Netfilteris, Linuxi tuuma alam-s\u00fcsteemis, mida kasutatakse v\u00f5rgupakettide filtreerimiseks ja muutmiseks, avastati haavatavus (CVE-2024-1086), mis v\u00f5imaldab kohalikel kasutajatel k\u00e4ivitada koodi tuuma tasemel ja t\u00f5sta oma \u00f5igusi s\u00fcsteemis. Probleem tuleneb m\u00e4lulehe topelt-vabastamisest (double-free) nf_tables moodulis, mis toetab nftablesi paketifiltreerimist. Haavatavuse avastanud turvauuringute ekspert t\u00f6\u00f6tas v\u00e4lja ja avaldas t\u00f6\u00f6tava eksploitatsiooni protot\u00fc\u00fcbi. Ekspluateerimise t\u00f6\u00f6","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 nf_tables \u0438 ksmbd | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-27T10:25:58+00:00","article:modified_time":"2024-03-27T10:25:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:46","updated":"2026-02-22 15:29:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114603"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114603\/revisions"}],"predecessor-version":[{"id":162202,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114603\/revisions\/162202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/114604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}