{"id":38281,"date":"2019-10-31T22:22:43","date_gmt":"2019-10-31T19:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-vhost-net-pozvolyayushhaya-obojti-izolyatsiyu-v-sistemah-na-baze-qemu-kvm\/"},"modified":"2019-10-31T22:22:43","modified_gmt":"2019-10-31T19:22:43","slug":"uyazvimost-v-vhost-net-pozvolyayushhaya-obojti-izolyatsiyu-v-sistemah-na-baze-qemu-kvm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-vhost-net-pozvolyayushhaya-obojti-izolyatsiyu-v-sistemah-na-baze-qemu-kvm","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans vhost-net permettant de contourner l'isolation dans les syst\u00e8mes bas\u00e9s sur QEMU-KVM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00e9v\u00e9l\u00e9e<\/a><\/noindex> des informations sur une vuln\u00e9rabilit\u00e9<\/a><\/noindex> (CVE-2019-14835<\/a><\/noindex>), permettant de sortir du syst\u00e8me invit\u00e9 dans KVM (qemu-kvm) et d'ex\u00e9cuter son code du c\u00f4t\u00e9 de l'environnement h\u00f4te dans le contexte du noyau Linux. La vuln\u00e9rabilit\u00e9 a re\u00e7u le nom de code V-gHost. Le probl\u00e8me permet depuis le syst\u00e8me invit\u00e9 de cr\u00e9er des conditions pour un d\u00e9bordement de tampon dans le module noyau vhost-net (backend r\u00e9seau pour virtio), ex\u00e9cut\u00e9 du c\u00f4t\u00e9 de l'environnement h\u00f4te. Une attaque peut \u00eatre r\u00e9alis\u00e9e par un attaquant ayant un acc\u00e8s privil\u00e9gi\u00e9 dans le syst\u00e8me invit\u00e9 lors de l'op\u00e9ration de migration des machines virtuelles.<\/p>\n

Correction du probl\u00e8me incluse<\/a><\/noindex> dans le noyau Linux 5.3. Comme contournement pour bloquer la vuln\u00e9rabilit\u00e9, vous pouvez interdire la migration live des syst\u00e8mes invit\u00e9s ou d\u00e9sactiver le module vhost-net (ajoutez \u00ab blacklist vhost-net \u00bb dans \/etc\/modprobe.d\/blacklist.conf). Le probl\u00e8me appara\u00eet \u00e0 partir du noyau Linux 2.6.34. La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans Ubuntu<\/a><\/noindex> et Fedora<\/a><\/noindex>, mais reste non r\u00e9solue dans Debian<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE<\/a><\/noindex> et RHEL<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-14835), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 KVM (qemu-kvm) \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u044f\u0434\u0440\u0430 Linux. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f V-gHost. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u044f\u0434\u0440\u0430 vhost-net (\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u044d\u043a\u0435\u043d\u0434 \u0434\u043b\u044f virtio), \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38281","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans vhost-net, permettant de contourner l'isolation dans les syst\u00e8mes bas\u00e9s sur QEMU-KVM | ProHoster","description":"R\u00e9v\u00e9l\u00e9e des informations sur","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-vhost-net-pozvolyayushhaya-obojti-izolyatsiyu-v-sistemah-na-baze-qemu-kvm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 vhost-net, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 QEMU-KVM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-vhost-net-pozvolyayushhaya-obojti-izolyatsiyu-v-sistemah-na-baze-qemu-kvm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:43+00:00","article:modified_time":"2019-10-31T19:22:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38281","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 21:19:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:12:22","updated":"2026-01-23 21:19:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/38281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=38281"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/38281\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=38281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=38281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=38281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}