{"id":170807,"date":"2026-05-16T06:24:35","date_gmt":"2026-05-16T04:24:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy"},"modified":"2026-05-16T06:24:35","modified_gmt":"2026-05-16T04:24:35","slug":"qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","title":{"rendered":"QEMUtiny — haavatavused QEMU-s, mis v\u00f5imaldavad p\u00e4\u00e4seda hostikeskkonda k\u00fclalis s\u00fcsteemist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uurijad, kes hiljuti avastasid Fragnesia haavatavuse Linuxi tuumas, avaldasid teavet QEMU-s esinevate haavatavuste kohta, mis v\u00f5imaldavad k\u00fclalis s\u00fcsteemist saada root-\u00f5igused hostikeskkonda. Probleemile on antud koodinimi QEMUtiny, kuid CVE-identifikaator ei ole veel m\u00e4\u00e4ratud. Valmistatud on eksploite, mis kasutab \u00e4ra kahte haavatavust CXL (Compute Express Link) seadme emulatsiooni koodis. <\/p>\n

M\u00f5lemad haavatavused on olemas cxl-mailbox-utils.c koodis. Esimene haavatavus ilmneb alates QEMU 7.1.0 v\u00e4ljalaskest ja viib m\u00e4lu lugemiseni eraldatud pufri alalt, kuna funktsioon cmd_logs_get_log() t\u00f5lgendab k\u00fcsitud CEL-logi nihket valesti massiivi indeksina, kuigi see m\u00e4\u00e4ratakse baitide kaupa. Teine haavatavus ilmneb alates QEMU 11.0.0 ja viib pufri \u00fclevooluni funktsioonis cmd_features_set_feature() struktuuride nihke t\u00f6\u00f6tlemise t\u00f5ttu atribuutide kirjutamisel, ilma et kontrollitaks, kas arvutatud v\u00e4\u00e4rtus \"offset + bytes_to_copy\" j\u00e4\u00e4b valitud struktuuri suurusesse. <\/p>\n

R\u00fcnnaku teostamine on v\u00f5imalik ainult QEMU 11.0.0 viimasel harul. Rikkumise parandamisest ei ole veel teateid, kuid m\u00e4rgitud on, et enne haavatavuse avalikustamist edastati teave QEMU arendajatele, kes vastasid, et CXL seadme tugi QEMU-s ei ole m\u00f5eldud virtualiseerimiseks. <\/p>\n

Eksploit on testitud QEMU koodibaasi p\u00f5hjal, mis on 11. mai seisuga viimasest commit'ist 5e61afe. Eksploidi t\u00f6\u00f6p\u00f5him\u00f5te p\u00f5hineb QEMU iga konkreetse versiooni ja s\u00fcsteemi libc m\u00e4lu struktuuride paigutusel, kuid teadlaste arvates on v\u00f5imalik luua universaalne eksploit, mis t\u00f6\u00f6tab erinevate QEMU versioonidega, kasutades m\u00e4lu skaneerimise haavatavust, mis v\u00f5imaldab lugeda andmeid m\u00e4lust v\u00e4ljaspool puhvers.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430 \u0434\u043d\u044f\u0445 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Fragnesia \u0432 \u044f\u0434\u0440\u0435 Linux, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 QEMU, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f QEMUtiny, \u043d\u043e CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0434\u0435 \u044d\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 CXL (Compute Express Link). \u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043a\u043e\u0434\u0435 cxl-mailbox-utils.c. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170807","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47QEMUtiny \u2014 haavatavused QEMU-s, mis v\u00f5imaldavad juurdep\u00e4\u00e4su host-\u00fcmbrusele k\u00fclalis s\u00fcsteemist | ProHoster","description":"Uurijad, kes hiljuti tuvastasid Fragnesia haavatavuse Linuxi tuumas, avaldasid teavet QEMU haavatavuste kohta, mis v\u00f5imaldavad k\u00fclalis s\u00fcsteemist saada root-juurdep\u00e4\u00e4su host-\u00fcmbrusele. Probleemile on antud koodnimi QEMUtiny, kuid CVE identifikaatorit pole veel m\u00e4\u00e4ratud. Valmistatud on eksploit, milles kasutavad kahte haavatavust CXL (Compute Express Link) seadme emulatsiooni koodis. M\u00f5lemad haavatavused on olemas cxl-mailbox-utils.c koodis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47QEMUtiny \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 QEMU, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044e \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430 \u0434\u043d\u044f\u0445 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Fragnesia \u0432 \u044f\u0434\u0440\u0435 Linux, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 QEMU, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f QEMUtiny, \u043d\u043e CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0434\u0435 \u044d\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 CXL (Compute Express Link). \u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043a\u043e\u0434\u0435 cxl-mailbox-utils.c.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-16T04:24:35+00:00","article:modified_time":"2026-05-16T04:24:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170807","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=170807"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170807\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=170807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=170807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=170807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}