Rashin lahani wanda ke ba ku damar fita daga keɓantaccen muhallin QEMU

Ya bayyana mahimman bayanai masu rauni (CVE-2019-14378) a cikin tsoho mai kula da SLIRP da aka yi amfani da shi a cikin QEMU don kafa tashar sadarwa tsakanin adaftan hanyar sadarwa ta hanyar sadarwa a cikin tsarin baƙo da kuma bayan cibiyar sadarwa a gefen QEMU. Batun kuma yana shafar tsarin tushen KVM (in Yanayin mai amfanida Virtualbox, waɗanda ke amfani da slirp backend daga QEMU, da kuma aikace-aikacen da ke amfani da tari na hanyar sadarwar sararin samaniya. libSLIRP (TCP/IP emulator).

Rashin lahani yana ba da damar yin amfani da lambar a gefen tsarin mai masaukin baki tare da haƙƙin tsarin mai sarrafa QEMU lokacin da aka aika fakitin cibiyar sadarwa na musamman da aka ƙera daga tsarin baƙo, wanda ke buƙatar rarrabuwa. Sakamakon kuskure a cikin aikin ip_reass(), wanda ake kira lokacin sake haɗa fakiti masu shigowa, guntun farko bazai dace da ma'ajin da aka keɓe ba kuma za'a rubuta wutsiyarsa zuwa wuraren ƙwaƙwalwar ajiya kusa da buffer.

Don gwaji riga akwai samfurin aiki na amfani, wanda ke ba da izinin ƙetare ASLR da aiwatar da lamba ta hanyar sake rubuta ƙwaƙwalwar ajiyar babban_loop_tlg, gami da QEMUTimerList tare da masu aiki da ake kira ta mai ƙidayar lokaci.
An riga an daidaita raunin a ciki Fedora и SUSE/budeSUSE, amma ya kasance ba a gyara ba a ciki Debian, Arch Linux и FreeBSD. A Ubuntu и RHEL Matsalar ba ta bayyana saboda rashin amfani da slirp. Rashin lahani ya kasance ba a kayyade a cikin sabon saki libslirp 4.0 (gyaran yana samuwa a halin yanzu kamar faci).

source: budenet.ru

Add a comment