{"id":114603,"date":"2024-03-27T12:25:57","date_gmt":"2024-03-27T10:25:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd"},"modified":"2024-03-27T12:25:57","modified_gmt":"2024-03-27T10:25:58","slug":"uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","title":{"rendered":"Ranljivosti u Linux kernelu koje omogu\u0107avaju podizanje privilegija putem nf_tables i ksmbd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

U Netfilteru, podsustavu jezgre Linuxa koja se koristi za filtriranje i modificiranje mre\u017enih paketa, otkrivena je ranjivost (CVE-2024-1086) koja omogu\u0107ava lokalnom korisniku izvr\u0161avanje koda na razini jezgre i pove\u0107anje svojih privilegija u sustavu. Problem je uzrokovan dvostrukim osloba\u0111anjem memorije (double-free) u modulu nf_tables, koji omogu\u0107ava rad paketnog filtra nftables. Istra\u017eiva\u010d sigurnosti koji je otkrio ranjivost razvio je i objavio radni prototip eksploita. <\/p>\n

Rad eksploita demonstriran je u aktualnim izdanjima Debiana i Ubuntua s Linux kernalima 5.14 \u2014 6.6, kao i u okru\u017eenju s KernelCTF (Capture the Flag), koje uklju\u010duje dodatne zakrpe za blokiranje uobi\u010dajenih metoda rada eksploita i koje koristi tvrtka Google u programu nagra\u0111ivanja za pronala\u017eenje ranjivosti. Stupanj uspje\u0161nosti rada eksploita procijenjuje se na 99,4%. U prate\u0107em \u010dlanku detaljno je razra\u0111en proces izrade slo\u017eenog vi\u0161eslojnog eksploita i zaobila\u017eenje mehanizama za\u0161tite i otpora prisutnih u kernalu.

\"Ranljivosti<\/center> <\/p>\n

Problem je povezan s pogre\u0161kom u funkciji nft_verdict_init(), koja dopu\u0161ta kori\u0161tenje pozitivnih vrijednosti kao koda gre\u0161ke za odbacivanje paketa (DROP) u hook-ovima, \u0161to se mo\u017ee iskoristiti za pozivanje ponovnog osloba\u0111anja memorije u funkciji nf_hook_slow() za buffere za koje je ve\u0107 pozvana funkcija free(). Problem nastaje kada je operacija NF_DROP formirana s gre\u0161kom, i jezgra u po\u010detku interpretira NF_DROP, ali zatim osloba\u0111a buffer i vra\u0107a status NF_ACCEPT. Ova situacija dovodi do toga da se, unato\u010d osloba\u0111anju povezanog s paketom buffera, njegova obrada ne prekida, ve\u0107 se prenosi drugom obrtniku, koji potom drugi put poziva funkciju osloba\u0111anja memorije. <\/p>\n

Ranjivost se manifestira po\u010dev\u0161i od verzije jezgre Linux 3.15, ali exploit radi s jezgrama po\u010dev\u0161i od verzije 5.14. Ispravak ranjivosti predlo\u017een je u izdanju jezgre Linux 6.8-rc1 i krajem velja\u010de prenesen je u stabilne grane 5.15.149, 6.1.76 i 6.6.15. U distribucijama se ispravak ranjivosti mo\u017ee pratiti na stranicama: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

Dodatno se mo\u017ee istaknuti niz ranjivosti u modulu ksmbd, koji nudi ugra\u0111enu u jezgru Linux implementaciju datote\u010dnog poslu\u017eitelja<\/a> na temelju SMB protokola: Ran vulnerability CVE-2024-26592 omogu\u0107ava udaljeno izvr\u0161enje koda s pravima jezgre na sustavima s aktiviranim ksmbd modulom bez prolaska autentifikacije. Problem je uzrokovan utrkom stanja u kodu za obradu TCP veze, koja nastaje zbog nedostatka pravilnog postavljanja blokada prilikom rada s objektom. <\/p>\n

Ran vulnerability CVE-2023-52440 tako\u0111er omogu\u0107ava udaljeno izvr\u0161enje koda s pravima jezgre, ali je uzrokovana prelivanjem bafera prilikom obrade neispravnih sesijskih klju\u010deva zbog nedostatka pravilne provjere veli\u010dine podataka primljenih od korisnika prije nego \u0161to se kopiraju u bafer fiksne veli\u010dine. <\/p>\n

Ran vulnerabilities (1, 2, 3) CVE-2024-26594, CVE-2023-52442 i CVE-2023-52441 u ksmbd omogu\u0107uju udaljeno odre\u0111ivanje sadr\u017eaja memorije jezgre bez prolaska autentifikacije. Ran vulnerability CVE-2024-26594 uzrokovana je nepravilnom provjerom podataka prilikom obrade primljenih SMB2 Mech tokena, \u0161to dovodi do povratka podataka izvan granica bafera. Ran vulnerability CVE-2023-52442 uzrokovana je nedostatkom pravilne provjere ulaznih podataka tijekom obrade povezanih upita. Ran vulnerability CVE-2023-52441 uzrokovana je nedostatkom potrebne provjere ulaznih podataka prilikom obrade zahtjeva za uskla\u0111ivanje SMB2 veze. <\/p>\n

Ran vulnerabilities CVE-2024-26594 i CVE-2024-26592 ispravljene su u jezgru 6.8 i korektivnim a\u017euriranjima pro\u0161lih stabilnih grana 6.1.75, 6.6.14, 6.7.2. Ostale ran vulnerabilities ispravljene su u jezgru 6.5 i a\u017euriranjima 5.15.145, 6.1.53, 6.4.16. <\/p>\n

Na kraju se mo\u017ee spomenuti aktivacija nove ekipe razvija\u010da Linux kernala, stvorene za analizu prisutnosti ranjivosti i procjenu povezanosti ispravaka unesenih u kernel s problemima sigurnosti. U velja\u010di su developeri kernala osnovali vlastitu CNA slu\u017ebu (CVE Numbering Authority), koja je dobila ovlasti samostalnog dodjeljivanja CVE identifikatora ranjivostima. Prije toga, dodjeljivanje CVE i analiza povezanosti ispravaka s mogu\u0107im ranjivostima bila je na ramenima developera distribucija, a u kernalu potencijalne ranjivosti nisu bile istaknute i pojavljuju se zajedno s obi\u010dnim ispravcima. Rezultati rada nove slu\u017ebe nadma\u0161ili su sva o\u010dekivanja \u2014 svakodnevno u kernalu ozna\u010di se do nekoliko desetaka novih ranjivosti koje prije nisu bile ozna\u010dene kao sigurnosni problemi. Na primjer, 26. o\u017eujka dodijeljeni su novi CVE identifikatori za 14 ranjivosti koje prije nisu razmatrane kao sigurnosni problemi, a 25. o\u017eujka \u2014 41 ranjivost.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivosti u jezgru Linuxa koje omogu\u0107uju podizanje privilegija preko nf_tables i ksmbd | ProHoster","description":"U Netfilteru, podsustavu jezgre Linuxa, koji se koristi za filtriranje i modificiranje mre\u017enih paketa, otkrivena je ranjivost (CVE-2024-1086) koja omogu\u0107ava lokalnom korisniku da izvr\u0161i kod na razini jezgre i podigne svoje privilegije.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 nf_tables \u0438 ksmbd | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-27T10:25:58+00:00","article:modified_time":"2024-03-27T10:25:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:46","updated":"2026-02-22 15:29:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=114603"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114603\/revisions"}],"predecessor-version":[{"id":162202,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114603\/revisions\/162202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/114604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=114603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=114603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=114603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}