{"id":114603,"date":"2024-03-27T12:25:57","date_gmt":"2024-03-27T10:25:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd"},"modified":"2024-03-27T12:25:57","modified_gmt":"2024-03-27T10:25:58","slug":"uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","title":{"rendered":"Linuxi tuumas avastatud haavatavused, mis v\u00f5imaldavad privileegide t\u00f5stmist l\u00e4bi nf_tables ja ksmbd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Netfilteris, Linuxi tuuma alams\u00fcsteem, mida kasutatakse v\u00f5rgupakettide filtreerimiseks ja muutmiseks, on tuvastatud haavatavus (CVE-2024-1086), mis v\u00f5imaldab kohalikel kasutajatel k\u00e4ivitada tuuma tasemel koodi ja t\u00f5sta oma \u00f5igusi s\u00fcsteemis. Probleem tuleneb m\u00e4luhalduse topelt vabastamisest (double-free) nf_tables moodulis, mis toetab nftables paketifiltrit. Haavatavuse avastanud turvauurija on v\u00e4lja t\u00f6\u00f6tanud ja avaldanud t\u00f6\u00f6protot\u00fc\u00fcbi eksploitist. <\/p>\n

Eksploojandi t\u00f6\u00f6 on demonstreeritud uusimates Debian ja Ubuntu v\u00e4ljaannetes, mille Linuxi tuumad on vahemikus 5.14 kuni 6.6, samuti KernelCTF (Capture the Flag) keskkonnas, mis sisaldab t\u00e4iendavaid patareid, et blokeerida ekspluotide t\u00fc\u00fcpilised t\u00f6\u00f6meetodid ja mida Google kasutab turvauuringute jaoks preemiate v\u00e4ljamaksmise programmis. Eksploojandi t\u00f6\u00f6 edukuse m\u00e4\u00e4r on 99,4%. Saates artiklis on p\u00f5hjalikult k\u00e4sitletud keerulise mitmetasandilise eksploojandi loomise protsessi ja olemasolevate tuumas kaitsemehanismide \u00fcletamist.

\"Linuxi<\/center> <\/p>\n

Probleem on seotud veaga funktsioonis nft_verdict_init(), mis lubab positiivsete v\u00e4\u00e4rtuste kasutamise pakettide allakriipsumise (DROP) veakoodina hook'ides, mis v\u00f5ib v\u00f5imaldada m\u00e4luhaldusfunktsioonis nf_hook_slow() korduvat m\u00e4luhaldust juba vabastatud pufferi jaoks. Probleem ilmneb, kui NF_DROP operatsioon genereeritakse veaga ja tuum t\u00f5lgendab esmalt NF_DROP'i, kuid seej\u00e4rel vabastab pufferi ja tagastab oleku NF_ACCEPT. See olukord viib selleni, et kuigi pakettidega seotud puffer vabastatakse, ei l\u00f5petata selle t\u00f6\u00f6tlemist, vaid see edastatakse teisele t\u00f6\u00f6tlejale, kes omakorda kutsub m\u00e4luhaldusfunktsiooni teist korda. <\/p>\n

Haavatavus ilmneb alates Linuxi tuuma versioonist 3.15, kuid eksploit t\u00f6\u00f6tab tuumadega alates versioonist 5.14. Haavatavuse parandamine on ette n\u00e4htud Linuxi tuuma v\u00e4ljaandes 6.8-rc1 ja see viidi veebruari l\u00f5pus stabiliseeritud okstesse 5.15.149, 6.1.76 ja 6.6.15. Jaotustes saab haavatavuse parandamise kohta j\u00e4lgida j\u00e4rgmiste lehtede kaudu: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

Lisaks v\u00f5ib m\u00e4rkida sarja haavatavusi ksmbd moodulis, mis pakub Linuxi tuuma sisseehitatud failiteenuse implementatsiooni. serverilt<\/a> SMB protokoli p\u00f5hjal: haavatavus CVE-2024-26592 v\u00f5imaldab kaugelt, ilma autentimiseta, t\u00e4ita oma koodi kernelitasandi \u00f5igustega s\u00fcsteemides, kus on aktiveeritud ksmbd moodul. Probleem on p\u00f5hjustatud race condition'ist TCP-\u00fchenduse t\u00f6\u00f6tlemise koodis, mis tekib seet\u00f5ttu, et objekti t\u00f6\u00f6tlemisel ei ole \u00f5iged lukud seadistatud. <\/p>\n

Haavatavus CVE-2023-52440 v\u00f5imaldab samuti kaugelt t\u00e4ita oma koodi kernelitasandi \u00f5igustega, kuid on p\u00f5hjustatud puhver\u00fclevoolust, kui t\u00f6\u00f6deldakse vale sessiooniv\u00f5tmeid, kuna ei ole piisavalt kontrollitud kasutajalt saadud andmete suurust enne, kui need kopeeritakse fikseeritud suurusega puhvri. <\/p>\n

Haavatavused (1, 2, 3) CVE-2024-26594, CVE-2023-52442 ja CVE-2023-52441 ksmbd-s v\u00f5imaldavad eemalt, ilma autentimiseta, m\u00e4\u00e4rata kernelim\u00e4lu sisu. Haavatavus CVE-2024-26594 on p\u00f5hjustatud vale andmete kontrollimisest, kui t\u00f6\u00f6deldakse saabunud SMB2 Mechi tokene, mis toob kaasa andmete tagastamise puhvri piiridest v\u00e4lja. Haavatavus CVE-2023-52442 on p\u00f5hjustatud piisava sisendi kontrollimise puudumisest seotud (chained) p\u00e4ringute t\u00f6\u00f6tlemisel. Haavatavus CVE-2023-52441 on p\u00f5hjustatud vajaliku sisendi kontrollimise puudumisest SMB2 \u00fchenduse kokkuleppe p\u00e4ringute t\u00f6\u00f6tlemisel. <\/p>\n

Haavatavused CVE-2024-26594 ja CVE-2024-26592 on k\u00f5rvaldatud kernelis 6.8 ja varasemate stabiilsete harude 6.1.75, 6.6.14, 6.7.2 parandavates v\u00e4rskendustes. \u00dclej\u00e4\u00e4nud haavatavused on k\u00f5rvaldatud kernelis 6.5 ja v\u00e4rskendustes 5.15.145, 6.1.53, 6.4.16. <\/p>\n

Kokkuv\u00f5tteks v\u00f5ib mainida, et aktiveeriti uus Linuxi tuuma arendajate meeskond, mis on loodud haavatavuste anal\u00fc\u00fcsimiseks ning tuuma paranduste seostamiseks turvaprobleemidega. Veebruaris l\u00f5id tuuma arendajad oma CNA (CVE Numbering Authority) teenuse, mis sai volitused CVE-identifikaatorite iseseisvaks m\u00e4\u00e4ramiseks haavatavustele. Enne seda langes CVE m\u00e4\u00e4ramine ja paranduste seostamine v\u00f5imalike haavatavustega distributsioonide arendajate \u00f5lgadele, samas kui tuumas potentsiaalsed haavatavused ei olnud eraldi v\u00e4lja toodud ja olid v\u00f5rdselt tavaliste parandustega. Uue teenuse t\u00f6\u00f6 tulemused \u00fcletasid k\u00f5ik ootused \u2013 igap\u00e4evaselt m\u00e4rgistatakse tuumas kuni mituk\u00fcmmend uut haavatavust, mida varem ei olnud turvaprobleemideks peetud. N\u00e4iteks 26. m\u00e4rtsil m\u00e4\u00e4rati 14 haavatavusele uued CVE-identifikaatorid, mida varem ei peetud turvaprobleemideks, ja 25. m\u00e4rtsil - 41 haavatavust.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linuxi tuumas esinevad haavatavused, mis v\u00f5imaldavad t\u00f5sta oma \u00f5igusi l\u00e4bi nf_tables ja ksmbd | ProHoster","description":"Netfilteris, Linuxi tuuma alams\u00fcsteemis, mida kasutatakse v\u00f5rgupakettide filtreerimiseks ja muutmiseks, on avastatud haavatavus (CVE-2024-1086), mis v\u00f5imaldab kohalikel kasutajatel k\u00e4ivitada koodi tuuma tasemel ja t\u00f5sta oma \u00f5igusi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 nf_tables \u0438 ksmbd | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-27T10:25:58+00:00","article:modified_time":"2024-03-27T10:25:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:46","updated":"2026-02-22 15:29:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114603"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114603\/revisions"}],"predecessor-version":[{"id":162202,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114603\/revisions\/162202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/114604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}