{"id":100548,"date":"2021-06-20T10:22:54","date_gmt":"2021-06-20T08:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm"},"modified":"2021-06-20T10:22:54","modified_gmt":"2021-06-20T08:22:55","slug":"uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","title":{"rendered":"Ranljivost u Linux jezgru koja utje\u010de na mre\u017eni protokol CAN BCM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

U Linux kernelu otkrivena je ranjivost (CVE-2021-3609) koja omogu\u0107ava lokalnom korisniku da podigne svoje privilegije u sistemu. Problem je uzrokovan stanjem utrke u implementaciji CAN BCM protokola i manifestuje se u verzijama Linux kernela od 2.6.25 do 5.13-rc6. U distribucijama problem trenutno ostaje neispravljen (RHEL, Fedora, Debian, Ubuntu, SUSE, Arch). <\/p>\n

Istra\u017eiva\u010d koji je otkrio ranjivost uspio je pripremiti exploit za sticanje root prava na sistemima s Linux kernelima 5.4 i novijim, uklju\u010duju\u0107i demonstraciju mogu\u0107nosti uspje\u0161nog izvo\u0111enja napada na Ubuntu 20.04.02 LTS. Nije isklju\u010dena mogu\u0107nost dorade exploita i za rad s starijim kernelima (u kernelu 5.4 kod CAN BCM (net\/can\/bcm.c) je preba\u010den s hrtimer_tasklet na HRTIMER_MODE_SOFT). <\/p>\n

CAN BCM protokol omogu\u0107ava registraciju vlastitog obrtnika poruka koji dolaze preko CAN (controller area network) sabirnice i povezivanje istog na odre\u0111eni mre\u017eni soket. Kada stigne dolazna poruka, poziva se funkcija bcm_rx_handler(). Napada\u010d mo\u017ee iskoristiti stanje utrke i posti\u0107i zatvaranje mre\u017enog soketa istovremeno s izvr\u0161avanjem bcm_rx_handler(). Kada se soket zatvori, pokre\u0107e se funkcija bcm_release(), u kojoj se osloba\u0111a memorija dodijeljena za strukture bcm_op i bcm_sock, koje se i dalje koriste u jo\u0161 uvijek izvr\u0161avanom obrtniku bcm_rx_handler(). Dolazi do situacije koja dovodi do pristupa ve\u0107 oslobo\u0111enoj memoriji (use-after-free). <\/p>\n

Napad se svodi na otvaranje dva CAN BCM soketa i njihovo povezivanje na vcan interfejs. U prvom soketu izvr\u0161ava se poziv sendmsg() s RX_SETUP zastavicom za pode\u0161avanje obrtnika dolaznih CAN poruka, dok se u drugom soketu izvr\u0161ava poziv sendmsg() za slanje poruke u prvi soket. Nakon \u0161to poruka stigne, aktivira se poziv bcm_rx_handler(), a napada\u010d odabire pravi trenutak i zatvara prvi soket, \u0161to dovodi do pokretanja bcm_release() i osloba\u0111anja struktura bcm_op i bcm_sock, iako rad bcm_rx_handler() jo\u0161 nije zavr\u0161en. <\/p>\n

Manipulacijom sadr\u017eajem bcm_sock, napada\u010d mo\u017ee prepisati pokaziva\u010d na funkciju sk->sk_data_ready(sk), preusmjeriti izvr\u0161avanje i putem tehnika povratno-orijentiranog programiranja (ROP - Return-Oriented Programming) organizirati prepisivanje parametra modprobe_path kako bi omogu\u0107io izvr\u0161enje svog koda s root pravima. Kada koristi ROP tehniku, napada\u010d ne poku\u0161ava smjestiti vlastiti kod u memoriju, ve\u0107 upravlja ve\u0107 postoje\u0107im blokovima strojnih instrukcija u u\u010ditanim bibliotekama, koji se zavr\u0161avaju instrukcijom vra\u0107anja kontrole (to su obi\u010dno zavr\u0161etci funkcija iz biblioteke). Rad eksploata svodi se na izgradnju lanca poziva sli\u010dnih blokova (\"gadgets\") kako bi se dobila potrebna funkcionalnost.

\"Ranljivost<\/center> <\/p>\n

Za napad je potreban pristup za stvaranje CAN soketa i konfiguriran mre\u017eni su\u010delje vcan. Potrebne ovlasti za izvo\u0111enje napada mogu biti ste\u010dene od strane neprivilegiranog korisnika unutar kontejnera koji se stvaraju u sustavima s uklju\u010denom podr\u0161kom za prostore imenskih identifikatora korisnika (user namespaces). Na primjer, user namespaces je prema zadanim postavkama uklju\u010den u Ubuntu i Fedora, ali nije aktiviran u Debianu i RHEL-u.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3609), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 CAN BCM \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u044f\u0434\u0440\u0430 Linux \u0441 2.6.25 \u043f\u043e 5.13-rc6. \u0412 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043a\u0430 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 (RHEL, Fedora, Debian, Ubuntu, SUSE, Arch). \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u043c\u043e\u0433 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432 root […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100549,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100548","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivost u Linux kernelu koja se odnosi na mre\u017eni protokol CAN BCM | ProHoster","description":"U Linux kernelu otkrivena je ranjivost (CVE-2021-3609) koja omogu\u0107ava lokalnom korisniku da podigne svoje privilegije u sustavu.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b CAN BCM | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3609), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-20T08:22:55+00:00","article:modified_time":"2021-06-20T08:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100548","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-20 08:24:40","updated":"2022-10-01 08:48:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/100548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=100548"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/100548\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/100549"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=100548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=100548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=100548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}