A Netfilter, a Linux kernel subsystem used for filtering and modifying network packets, has a vulnerability (CVE-2021-22555) that allows a local user to gain root privileges in the system, even when in an isolated container. A working prototype of an exploit, bypassing the KASLR, SMAP, and SMEP protection mechanisms, has been prepared for testing. The researcher who discovered the vulnerability received a $20,000 reward from Google for identifying a method to bypass Kubernetes container isolation in the kCTF cluster. <\/p>\n
The issue has been present since kernel 2.6.19, released 15 years ago, and is caused by a bug in the IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE handlers that leads to a buffer overflow when sending specially formatted parameters via the setsockopt call in compat mode. Under normal conditions, the compat_setsockopt() call can only be executed by the root user, but the necessary privileges for carrying out the attack can also be obtained by unprivileged users in systems with user namespaces support enabled. <\/p>\n
A felhaszn\u00e1l\u00f3 l\u00e9trehozhat egy kont\u00e9nert k\u00fcl\u00f6n root felhaszn\u00e1l\u00f3val, \u00e9s azon kereszt\u00fcl kihaszn\u00e1lhat egy sebezhet\u0151s\u00e9get. P\u00e9ld\u00e1ul a \"felhaszn\u00e1l\u00f3i n\u00e9vterek\" alap\u00e9rtelmez\u00e9s szerint enged\u00e9lyezve vannak az Ubuntu \u00e9s Fedora rendszerekben, de a Debian \u00e9s RHEL rendszerekben nem aktiv\u00e1lt\u00e1k. A sebezhet\u0151s\u00e9g jav\u00edt\u00e1s\u00e1t tartalmaz\u00f3 jav\u00edt\u00e1s 2023. \u00e1prilis 13-\u00e1n ker\u00fclt be az Linux kernelbe. A csomagfriss\u00edt\u00e9sek m\u00e1r elk\u00e9sz\u00fcltek a Debian, Arch Linux \u00e9s Fedora projektjei \u00e1ltal. Az Ubuntu, RHEL \u00e9s SUSE rendszerek friss\u00edt\u00e9sei folyamatban vannak. <\/p>\n
A probl\u00e9ma az xt_compat_target_from_user() f\u00fcggv\u00e9nyben mer\u00fcl fel a mem\u00f3ria m\u00e9ret\u00e9nek hib\u00e1s kisz\u00e1m\u00edt\u00e1sa miatt, amikor a kernelstrukt\u00far\u00e1k ment\u00e9se 32 bitesb\u0151l 64 bites reprezent\u00e1ci\u00f3ra t\u00f6rt\u00e9nik. A hiba lehet\u0151v\u00e9 teszi n\u00e9gy null\u00e1s byte \u00edr\u00e1s\u00e1t a lefoglalt pufferen k\u00edv\u00fcli b\u00e1rmely poz\u00edci\u00f3ba, a 0x4C eltol\u00e1s hat\u00e1rain bel\u00fcl. Ez elegend\u0151 lehet\u0151s\u00e9get biztos\u00edtott egy exploit l\u00e9trehoz\u00e1s\u00e1ra, amely lehet\u0151v\u00e9 tette a root jogosults\u00e1gok megszerz\u00e9s\u00e9t \u2014 a m_list->next mutat\u00f3 t\u00f6rl\u00e9s\u00e9vel a msg_msg strukt\u00far\u00e1ban olyan k\u00f6r\u00fclm\u00e9nyeket teremtettek, amelyek lehet\u0151v\u00e9 tett\u00e9k a mem\u00f3ri\u00e1n k\u00edv\u00fcli adatok el\u00e9r\u00e9s\u00e9t (use-after-free), amit azt\u00e1n az adatok c\u00edm\u00e9nek megszerz\u00e9s\u00e9re \u00e9s m\u00e1s strukt\u00far\u00e1k m\u00f3dos\u00edt\u00e1s\u00e1ra haszn\u00e1ltak a msgsnd() rendszerh\u00edv\u00e1s manipul\u00e1l\u00e1s\u00e1val. \u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-22555), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0441\u044c \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435. \u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b KASLR, SMAP \u0438 SMEP. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u0442 Google \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435, \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 20 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0437\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100767","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e1s a Linux Kernel Netfilter alrendszer\u00e9ben | ProHoster","description":"A Netfilter, a Linux kernel subsystem used for filtering and modifying network packets, a vulnerability (CVE-2021-22555) has been identified that allows a local user to gain root privileges in the system.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux Netfilter | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-22555), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-15T14:22:45+00:00","article:modified_time":"2021-07-15T14:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100767","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-15 14:42:50","updated":"2022-10-01 06:19:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=100767"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100767\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=100767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=100767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=100767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"