{"id":99421,"date":"2021-03-13T22:22:39","date_gmt":"2021-03-13T20:22:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii"},"modified":"2021-03-13T22:22:39","modified_gmt":"2021-03-13T20:22:40","slug":"uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","title":{"rendered":"Linuxi iSCSI alam s\u00fcsteemide haavatavus, mis v\u00f5imaldab privileegide t\u00f5stmist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi kerneli iSCSI alams\u00fcsteemi koodis avastati haavatavus (CVE-2021-27365), mis v\u00f5imaldab \u00f5igusteta kohalikul kasutajal k\u00e4ivitada koodi kerneli tasemel ja saada s\u00fcsteemis root-\u00f5igused. Testimiseks on saadaval toimiv exploit\u2019i protot\u00fc\u00fcp. Haavatavus on parandatud Linuxi kerneli versioonide 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260 ja 4.4.260 uuendustes. Tuumapaketid koos parandustega on saadaval distributsioonides Debian, Ubuntu, SUSE\/openSUSE, Arch Linux ja Fedora. RHEL-i jaoks ei ole parandusi veel avaldatud. <\/p>\n

Probleemi p\u00f5hjustab viga mooduli libiscsi funktsioonis iscsi_host_get_param(), mis lisati juba 2006. aastal iSCSI alams\u00fcsteemi arendamise k\u00e4igus. Piisavate suurusekontrollide puudumise t\u00f5ttu v\u00f5ivad m\u00f5ned iSCSI stringatribuudid, n\u00e4iteks hostname v\u00f5i username, \u00fcletada v\u00e4\u00e4rtust PAGE_SIZE (4 KB). Haavatavust saab \u00e4ra kasutada, kui \u00f5igusteta kasutaja saadab Netlinki s\u00f5numeid, mis m\u00e4\u00e4ravad iSCSI atribuutidele PAGE_SIZE-i \u00fcletavad v\u00e4\u00e4rtused. Nende atribuutide lugemisel sysfs-i v\u00f5i seqfs-i kaudu k\u00e4ivitatakse kood, mis edastab atribuudid funktsioonile sprintf puhvris kopeerimiseks, mille suurus on v\u00f5rdne v\u00e4\u00e4rtusega PAGE_SIZE. <\/p>\n

Haavatavuse \u00e4rakasutamise v\u00f5imalus distributsioonides s\u00f5ltub sellest, kas kerneli moodul scsi_transport_iscsi laaditakse automaatselt, kui p\u00fc\u00fctakse luua NETLINK_ISCSI soklit. Distributsioonides, kus see moodul laaditakse automaatselt, saab r\u00fcnde l\u00e4bi viia s\u00f5ltumata iSCSI funktsionaalsuse kasutamisest. Seejuures on exploit\u2019i edukaks kasutamiseks lisaks vaja registreerida v\u00e4hemalt \u00fcks iSCSI transport. Transpordi registreerimiseks saab omakorda kasutada kerneli moodulit ib_iser, mis laaditakse automaatselt, kui \u00f5igusteta kasutaja p\u00fc\u00fcab luua NETLINK_RDMA soklit. <\/p>\n

Exploit'i kasutamiseks vajalike moodulite automaatset laadimist toetatakse CentOS 8-s, RHEL 8-s ja Fedoras, kui s\u00fcsteemi on paigaldatud pakett rdma-core, mis on m\u00f5ne populaarse paketi s\u00f5ltuvus ning paigaldatakse vaikimisi t\u00f6\u00f6jaamade, GUI-ga serveris\u00fcsteemide ja virtualiseerimise hostkeskkondade konfiguratsioonides. Seejuures ei paigaldata rdma-core'i serveriversiooni puhul, mis t\u00f6\u00f6tab ainult konsoolire\u017eiimis, ega minimaalse paigalduskujutise kasutamisel. N\u00e4iteks kuulub pakett Fedora 31 Workstationi baaspaigaldusse, kuid ei sisaldu Fedora 31 Serveris. Debian ja Ubuntu on probleemist v\u00e4hem m\u00f5jutatud, kuna pakett rdma-core laadib r\u00fcnde jaoks vajalikud kernelimoodulid ainult RDMA-riistvara olemasolul.

\"Linuxi<\/center> <\/p>\n

Kaitse ringtee lahendusena saab keelata libiscsi mooduli automaatse laadimise: echo \"install libiscsi \/bin\/true\" >> \/etc\/modprobe.d\/disable-libiscsi.conf <\/p>\n

Lisaks on iSCSI alams\u00fcsteemis k\u00f5rvaldatud veel kaks v\u00e4hem ohtlikku haavatavust, mis v\u00f5ivad viia tuumast andmete lekkeni: CVE-2021-27363 (iSCSI transpordidetektiivi info lekkimine l\u00e4bi sysfs) ja CVE-2021-27364 (lugemine m\u00e4lu piire \u00fcletavalt alalt). Need haavatavused v\u00f5ivad v\u00f5imaldada netlink-soketiga suhtlemist iSCSI alams\u00fcsteemiga ilma vajalike \u00f5igusteta. N\u00e4iteks v\u00f5ib privileegideta kasutaja \u00fchendada iSCSI ja saata k\u00e4su \"end a session\" seansi katkestamiseks.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u0435 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b iSCSI \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 \u044f\u0434\u0440\u0430 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-27365), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 Linux 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260 \u0438 4.4.260. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u044f\u0434\u0440\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Debian, Ubuntu, SUSE\/openSUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":99422,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Linuxi kerneli iSCSI alams\u00fcsteemis, mis v\u00f5imaldab \u00f5igusi eskaleerida | ProHoster","description":"Linuxi kerneli iSCSI alams\u00fcsteemi koodis avastati haavatavus (CVE-2021-27365), mis v\u00f5imaldab \u00f5igusteta kohalikul kasutajal k\u00e4ivitada koodi kerneli tasemel ja saada s\u00fcsteemis root-\u00f5igused.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 iSCSI \u044f\u0434\u0440\u0430 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u0435 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b iSCSI \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 \u044f\u0434\u0440\u0430 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-27365), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-13T20:22:40+00:00","article:modified_time":"2021-03-13T20:22:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99421","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-13 20:38:21","updated":"2022-09-28 06:45:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=99421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99421\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/99422"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=99421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=99421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=99421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}