A Linux kernel vulnerability (CVE-2022-0847) has been identified that allows overwriting the contents of the page cache for any files, including those in read-only mode, opened with the O_RDONLY flag, or located on filesystems mounted as read-only. Practically, the vulnerability can be exploited to inject code into arbitrary processes or corrupt data in opened files. For example, it can change the contents of the authorized_keys file for the sshd process. A prototype exploit is available for testing. <\/p>\n
The issue has been assigned the code name Dirty Pipe, similar to the critical vulnerability Dirty COW identified in 2016. It is noted that Dirty Pipe poses a danger level comparable to Dirty COW but is significantly easier to exploit. The vulnerability was discovered following reports of periodic corruption of network-loaded files in a system that loads compressed archives from a log server (37 corruptions over 3 months on a heavily loaded system), during which the splice() operation and unnamed pipes were used. <\/p>\n
The vulnerability manifests starting from Linux kernel 5.8, released in August 2020, meaning it is present in Debian 11 but does not affect the base kernel in Ubuntu 20.04 LTS. RHEL 8.x and openSUSE\/SUSE 15 kernels are based on older branches, but it is possible that the problematic change has been backported into them (exact information is not yet available). Updates on package releases in the distributions can be followed on the following pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. The vulnerability has been fixed in releases 5.16.11, 5.15.25, and 5.10.102. The fix is also included in the kernel used on the Android platform. <\/p>\n
A sebezhet\u0151s\u00e9g a \"buf->flags\" \u00e9rt\u00e9k\u00e9nek inicializ\u00e1l\u00e1s\u00e1nak hi\u00e1ny\u00e1b\u00f3l ered a copy_page_to_iter_pipe() \u00e9s push_pipe() funkci\u00f3k k\u00f3dj\u00e1ban, mik\u00f6zben a mem\u00f3ria a strukt\u00fara lefoglal\u00e1sakor nem ker\u00fcl t\u00f6rl\u00e9sre, \u00e9s bizonyos m\u0171veletek sor\u00e1n a n\u00e9vtelen csatorn\u00e1kon a \"buf->flags\" \u00e9rt\u00e9ke m\u00e1s m\u0171veletekb\u0151l sz\u00e1rmaz\u00f3 \u00e9rt\u00e9ket tartalmazhat. Ezt a jellemz\u0151t kihaszn\u00e1lva egy nem privil\u00e9giz\u00e1lt helyi felhaszn\u00e1l\u00f3 el\u00e9rheti, hogy a f\u00e1lgban megjelenjen a PIPE_BUF_FLAG_CAN_MERGE \u00e9rt\u00e9k, amely lehet\u0151v\u00e9 teszi az adatok fel\u00fcl\u00edr\u00e1s\u00e1t az oldal cache-ben egyszer\u0171 \u00faj adatok \u00edr\u00e1s\u00e1val egy megfelel\u0151en el\u0151k\u00e9sz\u00edtett n\u00e9vtelen csatorn\u00e1ba (pipe). <\/p>\n
A t\u00e1mad\u00e1shoz a c\u00e9lf\u00e1jlnak olvashat\u00f3nak kell lennie, mivel a pipe-ba t\u00f6rt\u00e9n\u0151 \u00edr\u00e1skor nem ellen\u0151rzik a hozz\u00e1f\u00e9r\u00e9si jogokat, a weboldal gyors\u00edt\u00f3t\u00e1r\u00e1ban val\u00f3 csere ak\u00e1r olyan f\u00e1jlok eset\u00e9ben is v\u00e9gbe mehet, amelyek csak olvas\u00e1sra vannak csatolva (p\u00e9ld\u00e1ul CD-ROM-on l\u00e9v\u0151 f\u00e1jlok eset\u00e9ben). Az oldal gyors\u00edt\u00f3t\u00e1r\u00e1nak inform\u00e1ci\u00f3j\u00e1nak lecser\u00e9l\u00e9se ut\u00e1n az elj\u00e1r\u00e1s a f\u00e1jl adatainak olvas\u00e1sakor nem a t\u00e9nyleges, hanem a hamis\u00edtott adatokat kapja meg. <\/p>\n
A kihaszn\u00e1l\u00e1s l\u00e9nyege egy n\u00e9vtelen csatorna l\u00e9trehoz\u00e1sa \u00e9s annak tetsz\u0151leges adatokkal val\u00f3 felt\u00f6lt\u00e9se, hogy el\u00e9rj\u00fck a PIPE_BUF_FLAG_CAN_MERGE jelz\u0151 be\u00e1ll\u00edt\u00e1s\u00e1t az \u00f6sszes kapcsol\u00f3d\u00f3 gy\u0171r\u0171s strukt\u00far\u00e1ban. Ezt k\u00f6vet\u0151en az adatokat olvass\u00e1k a csatorn\u00e1b\u00f3l, de a jelz\u0151 tov\u00e1bbra is be van \u00e1ll\u00edtva az \u00f6sszes pipe_buffer strukt\u00fara eset\u00e9ben a gy\u0171r\u0171s pipe_inode_info strukt\u00far\u00e1kban. Ezt k\u00f6vet\u0151en a splice() h\u00edv\u00e1s t\u00f6rt\u00e9nik a c\u00e9lf\u00e1jlb\u00f3l a n\u00e9vtelen csatorn\u00e1ba t\u00f6rt\u00e9n\u0151 adatolvas\u00e1shoz, a sz\u00fcks\u00e9ges eltol\u00e1ssal kezdve. Amikor adatokat \u00edrnak a n\u00e9vtelen csatorn\u00e1ba, a PIPE_BUF_FLAG_CAN_MERGE jelz\u0151 miatt az adatok a weboldal gyors\u00edt\u00f3t\u00e1r\u00e1ban fel\u00fcl\u00edr\u00f3dnak, ahelyett, hogy \u00faj pipe_buffer strukt\u00fara p\u00e9ld\u00e1nyt hozn\u00e1nak l\u00e9tre. \u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0847), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c O_RDONLY \u0438\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u043f\u0440\u0438\u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f. \u0421 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438\u043b\u0438 \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103489","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9g a Linux kernelben, amely lehet\u0151v\u00e9 teszi az csak olvas\u00e1sra el\u00e9rhet\u0151 f\u00e1jlok hamis\u00edt\u00e1s\u00e1t | ProHoster","description":"A Linux kernelben egy sebezhet\u0151s\u00e9g (CVE-2022-0847) ker\u00fclt felfedez\u00e9sre, amely lehet\u0151v\u00e9 teszi a weboldal gyors\u00edt\u00f3t\u00e1r\u00e1nak tartalm\u00e1nak fel\u00fcl\u00edr\u00e1s\u00e1t b\u00e1rmilyen f\u00e1jl eset\u00e9ben, bele\u00e9rtve azokat is, amelyek csak olvas\u00e1sra vannak nyitva az O_RDONLY z\u00e1szl\u00f3val, vagy elhelyezve vannak.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0847), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c O_RDONLY \u0438\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-07T19:36:38+00:00","article:modified_time":"2022-03-07T19:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-07 19:37:31","updated":"2022-10-03 12:20:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/103489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=103489"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/103489\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=103489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=103489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=103489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"