{"id":100548,"date":"2021-06-20T10:22:54","date_gmt":"2021-06-20T08:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm"},"modified":"2021-06-20T10:22:54","modified_gmt":"2021-06-20T08:22:55","slug":"uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","title":{"rendered":"Vulnerability in the Linux kernel affecting the CAN BCM network protocol","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Linux kernel vulnerability (CVE-2021-3609) has been identified, allowing a local user to escalate their privileges within the system. The issue is caused by a race condition in the CAN BCM protocol implementation and is present in Linux kernel releases from 2.6.25 to 5.13-rc6. The problem remains unpatched in distributions (RHEL, Fedora, Debian, Ubuntu, SUSE, Arch). <\/p>\n
The researcher who discovered the vulnerability was able to prepare an exploit to obtain root privileges on systems with Linux kernels 5.4 and newer, demonstrating the possibility of successfully carrying out an attack on Ubuntu 20.04.02 LTS. There is also a chance of adapting the exploit to work with older kernels (in kernel 5.4, the CAN BCM code (net\/can\/bcm.c) was transitioned from hrtimer_tasklet to HRTIMER_MODE_SOFT). <\/p>\n
The CAN BCM protocol allows registering a custom message handler for incoming messages through the CAN (controller area network) bus and attaching it to a specific network socket. When an incoming message arrives, the function bcm_rx_handler() is invoked. An attacker can exploit the race condition to close the network socket concurrently with the execution of bcm_rx_handler(). When the socket is closed, the bcm_release() function is called, which frees the memory allocated for the bcm_op and bcm_sock structures that are still being used by the ongoing bcm_rx_handler(). This situation leads to access to a freed memory block (use-after-free). <\/p>\n
The attack involves opening two CAN BCM sockets and binding them to the vcan interface. The first socket executes the sendmsg() call with the RX_SETUP flag to set up the incoming CAN message handler, while the second socket makes a sendmsg() call to send a message to the first socket. Once the message arrives, bcm_rx_handler() is triggered, and the attacker chooses the right moment to close the first socket, causing bcm_release() to run and free the bcm_op and bcm_sock structures, even though the execution of bcm_rx_handler() is still ongoing. <\/p>\n
A bcm_sock tartalm\u00e1val v\u00e9gzett manipul\u00e1ci\u00f3k r\u00e9v\u00e9n a t\u00e1mad\u00f3 fel\u00fcl\u00edrhatja a sk->sk_data_ready(sk) f\u00fcggv\u00e9nyre mutat\u00f3 mutat\u00f3t, \u00e1tir\u00e1ny\u00edthatja a v\u00e9grehajt\u00e1st, \u00e9s a visszafel\u00e9 orient\u00e1lt programoz\u00e1s (ROP - Return-Oriented Programming) technik\u00e1j\u00e1val biztos\u00edthatja a modprobe_path param\u00e9ter fel\u00fcl\u00edr\u00e1s\u00e1t, lehet\u0151v\u00e9 t\u00e9ve ezzel k\u00f3dj\u00e1nak root jogosults\u00e1ggal val\u00f3 v\u00e9grehajt\u00e1s\u00e1t. ROP technika alkalmaz\u00e1sakor a t\u00e1mad\u00f3 nem pr\u00f3b\u00e1lja elhelyezni saj\u00e1t k\u00f3dj\u00e1t a mem\u00f3ri\u00e1ban, hanem a m\u00e1r bet\u00f6lt\u00f6tt k\u00f6nyvt\u00e1rakban l\u00e9v\u0151 g\u00e9pi utas\u00edt\u00e1sok darabjaival oper\u00e1l, amelyek visszair\u00e1ny\u00edt\u00f3 utas\u00edt\u00e1ssal v\u00e9gz\u0151dnek (ez \u00e1ltal\u00e1ban k\u00f6nyvt\u00e1ri funkci\u00f3k befejez\u00e9se). Az exploit m\u0171k\u00f6d\u00e9se abban \u00e1ll, hogy egy ilyen blokkokb\u00f3l (\u00fagynevezett 'gadgetekb\u0151l') \u00e1ll\u00f3 h\u00edv\u00e1si l\u00e1ncot \u00e9p\u00edt fel a k\u00edv\u00e1nt funkcionalit\u00e1s el\u00e9r\u00e9s\u00e9hez.
<\/center> <\/p>\n
A t\u00e1mad\u00e1shoz CAN socketek l\u00e9trehoz\u00e1s\u00e1hoz val\u00f3 hozz\u00e1f\u00e9r\u00e9s \u00e9s a vcan h\u00e1l\u00f3zati interf\u00e9sz be\u00e1ll\u00edt\u00e1sa sz\u00fcks\u00e9ges. A t\u00e1mad\u00e1shoz sz\u00fcks\u00e9ges jogosults\u00e1gok a nem privilegiz\u00e1lt felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra is megszerezhet\u0151k olyan kont\u00e9nerek l\u00e9trehoz\u00e1s\u00e1val, ahol a felhaszn\u00e1l\u00f3i azonos\u00edt\u00f3k (user namespaces) t\u00e1mogat\u00e1sa enged\u00e9lyezve van. P\u00e9ld\u00e1ul az Ubuntu \u00e9s Fedora alap\u00e9rtelmez\u00e9s szerint enged\u00e9lyezi a felhaszn\u00e1l\u00f3i neveket, de a Debian \u00e9s RHEL-ben nem aktiv\u00e1lt\u00e1k. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Vulnerability](\"\/wp-content\/uploads\/2021\/06\/60534f0194a819c8401abf2ec53b3a9a.png\")
<\/center> <\/p>\n