{"id":41582,"date":"2020-02-12T16:19:30","date_gmt":"2020-02-12T13:19:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii"},"modified":"2020-02-12T16:19:30","modified_gmt":"2020-02-12T13:19:30","slug":"uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"S\u00fcsteemi h\u00e4iret\u00f5rje teates tuvastati haavatavus, mis v\u00f5ib v\u00f5imaldada privileegide t\u00f5stmist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

S\u00fcsteemihalduris systemd tuvastatud<\/a><\/noindex> haavatavus (CVE-2020-1712<\/a><\/noindex>), mis v\u00f5imaldab potentsiaalselt k\u00e4ivitada enda koodi k\u00f5rgete \u00f5igustega, saates spetsiaalselt vormindatud p\u00e4ringu DBus-bussile. Probleem on lahendatud testversioonis systemd 245-rc1<\/a><\/noindex> (lahendavad probleemipatch'id: 1<\/a><\/noindex>, 2<\/a><\/noindex>, 3<\/a><\/noindex>). Haavatavus on k\u00f5rvaldatud distributsioonides Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex>, RHEL<\/a><\/noindex> (ilmneb RHEL 8-s, kuid ei m\u00f5juta RHEL 7), CentOS<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> ja ROSA<\/a><\/noindex>, kuid uudise kirjutamise hetkel j\u00e4\u00e4b see lahendamata Debian<\/a><\/noindex> ja Arch Linux<\/a><\/noindex>. <\/p>\n

Haavatavus on p\u00f5hjustatud juba vabastatud m\u00e4luala (use-after-free) kasutamisest, mis tekib as\u00fcnkroonsete p\u00e4ringute tegemisel Polkit'ile DBus-s\u00f5numite t\u00f6\u00f6tlemise ajal. M\u00f5ned DBus-liidesed kasutavad l\u00fchiajaliste objektide salvestamiseks vahem\u00e4lu ning puhastavad vahem\u00e4lu elemendid kohe, kui DBus-buss on vabastatud teiste p\u00e4ringute t\u00f6\u00f6tlemiseks. Kui DBus-meetodi k\u00e4itleja kasutab bus_verify_polkit_async(), peab ta v\u00f5ib-olla ootama Polkit'i tegevuse l\u00f5puleviimist. P\u00e4rast Polkit'i valmimist kutsutakse k\u00e4itlejat uuesti ja see p\u00f6\u00f6rdub tagasi juba m\u00e4\u00e4ratud m\u00e4ludatavatele andmetele. Kui Polkit'i p\u00e4ring kestab liiga kaua, siis vahem\u00e4lu elemendid peaksid olema juba puhastatud, enne kui DBus-meetodi k\u00e4itleja kutsutakse teist korda. <\/p>\n

Teenustest, mis v\u00f5imaldavad haavatavust kasutada, on m\u00e4rgitud systemd-machined, mis pakub DBus API org.freedesktop.machine1.Image.Clone, viies andmete ajutise salvestamiseni vahem\u00e4lu ja as\u00fcnkroonse p\u00e4ringu tegemiseni Polkit'i. Liides
\norg.freedesktop.machine1.Image.Clone on k\u00f5igile mitterikka \u00f5igustega s\u00fcsteemi kasutajatele saadaval, kes v\u00f5ivad algatada systemd teenuste krahhi v\u00f5i potentsiaalselt k\u00e4ivitada koodi root'i \u00f5igustes (haavatavuse protot\u00fc\u00fcpi pole veel n\u00e4idatud). Haavatavuse \u00e4rakasutamiseks m\u00f5eldud kood oli on lisatud<\/a><\/noindex> systemd-machined'is 2015. aastal versioonis systemd 220<\/a><\/noindex> (RHEL 7.x kasutab systemd 219). <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 systemd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1712), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0448\u0438\u043d\u0435 DBus. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 systemd 245-rc1 (\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043f\u0430\u0442\u0447\u0438: 1, 2, 3). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Ubuntu, Fedora, RHEL (\u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 RHEL 8, \u043d\u043e \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 RHEL 7), CentOS, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41582","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus systemd-s, mis v\u00f5imaldab potentsiaalselt oma \u00f5igusi t\u00f5sta | ProHoster","description":"S\u00fcsteemihalduris systemd on tuvastatud haavatavus (","canonical_url":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 systemd, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 systemd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-systemd-potenczialno-pozvolyayushhaya-povysit-svoi-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-12T13:19:30+00:00","article:modified_time":"2020-02-12T13:19:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41582","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:14:28","updated":"2022-09-30 17:11:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41582"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41582\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}