{"id":106088,"date":"2022-12-15T13:06:35","date_gmt":"2022-12-15T11:06:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth"},"modified":"2022-12-15T13:06:35","modified_gmt":"2022-12-15T11:06:35","slug":"uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","title":{"rendered":"Linux kernel sebezhet\u0151s\u00e9ge, amelyet t\u00e1volr\u00f3l kihaszn\u00e1lhatunk Bluetooth-on kereszt\u00fcl","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Linux kernelben felfedeztek egy sebezhet\u0151s\u00e9get (CVE-2022-42896), amely potenci\u00e1lisan felhaszn\u00e1lhat\u00f3 a kernel szint\u0171 t\u00e1voli k\u00f3dv\u00e9grehajt\u00e1s megszervez\u00e9s\u00e9re, ha egy megfelel\u0151en form\u00e1zott L2CAP-csomagot k\u00fcldenek Bluetooth-on kereszt\u00fcl. Emellett egy m\u00e1sik hasonl\u00f3 probl\u00e9ma (CVE-2022-42895) is felfedez\u00e9sre ker\u00fclt az L2CAP feldolgoz\u00f3j\u00e1ban, amely a kernel mem\u00f3ri\u00e1j\u00e1nak tartalm\u00e1nak kisziv\u00e1rg\u00e1s\u00e1hoz vezethet a konfigur\u00e1ci\u00f3s inform\u00e1ci\u00f3kat tartalmaz\u00f3 csomagokban. Az els\u0151 sebezhet\u0151s\u00e9g 2014 augusztusa \u00f3ta (3.16 kernel), a m\u00e1sodik pedig 2011 okt\u00f3bere \u00f3ta (3.0 kernel) l\u00e9tezik. A sebezhet\u0151s\u00e9geket orvosolt\u00e1k a Linux kernel 6.1.0, 6.0.8, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154 \u00e9s 5.15.78 verzi\u00f3iban. A jav\u00edt\u00e1sok nyomon k\u00f6vethet\u0151k a k\u00f6vetkez\u0151 disztrib\u00faci\u00f3s oldalakon: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

A t\u00e1voli t\u00e1mad\u00e1si lehet\u0151s\u00e9gek bemutat\u00e1s\u00e1hoz Ubuntu 22.04 alatt m\u0171k\u00f6d\u0151 exploit protot\u00edpusokat tettek k\u00f6zz\u00e9. A t\u00e1mad\u00e1s v\u00e9grehajt\u00e1s\u00e1hoz a t\u00e1mad\u00f3nak Bluetooth hat\u00f3t\u00e1vols\u00e1g\u00e1n bel\u00fcl kell lennie \u2014 el\u0151zetes p\u00e1ros\u00edt\u00e1sra nincs sz\u00fcks\u00e9g, de a sz\u00e1m\u00edt\u00f3g\u00e9pen akt\u00edv Bluetooth-nak kell lennie. A t\u00e1mad\u00e1shoz elegend\u0151 tudni az \u00e1ldozat eszk\u00f6z\u00e9nek MAC-c\u00edm\u00e9t, ami sniffing \u00fatj\u00e1n meghat\u00e1rozhat\u00f3, vagy egyes eszk\u00f6z\u00f6k\u00f6n a Wi-Fi MAC-c\u00edm alapj\u00e1n kisz\u00e1m\u00edthat\u00f3. <\/p>\n

Az els\u0151 sebezhet\u0151s\u00e9g (CVE-2022-42896) egy m\u00e1r felszabad\u00edtott mem\u00f3ria ter\u00fclethez val\u00f3 hozz\u00e1f\u00e9r\u00e9sb\u0151l (use-after-free) ad\u00f3dik az l2cap_connect \u00e9s l2cap_le_connect_req funkci\u00f3k implement\u00e1ci\u00f3j\u00e1ban \u2014 miut\u00e1n a csatorn\u00e1t l\u00e9trehozt\u00e1k a new_connection callback-h\u00edv\u00e1s\u00e1n kereszt\u00fcl, nem \u00e1ll\u00edtottak be z\u00e1rat r\u00e1, de be volt \u00e1ll\u00edtva egy id\u0151z\u00edt\u0151 (__set_chan_timer), amely a timeout lej\u00e1rtakor megh\u00edvta az l2cap_chan_timeout funkci\u00f3t, \u00e9s ellen\u0151rz\u00e9s n\u00e9lk\u00fcl tiszt\u00edtotta a csatorn\u00e1t az l2cap_le_connect* funkci\u00f3kban. <\/p>\n

Alap\u00e9rtelmez\u00e9s szerint az id\u0151t\u00fall\u00e9p\u00e9s 40 m\u00e1sodperc, \u00e9s \u00fagy gondolt\u00e1k, hogy ilyen k\u00e9sleltet\u00e9si id\u0151 mellett versenyhelyzet nem alakulhat ki, de kider\u00fclt, hogy egy m\u00e1sik hiba miatt az SMP feldolgoz\u00f3j\u00e1ban az id\u0151z\u00edt\u0151 azonnali megh\u00edv\u00e1sa \u00e9s versenyhelyzet el\u00e9rhet\u0151. Az l2cap_le_connect_req probl\u00e9m\u00e1ja mem\u00f3riasziv\u00e1rg\u00e1shoz vezethet, m\u00edg az l2cap_connect eset\u00e9n a mem\u00f3ria tartalm\u00e1nak fel\u00fcl\u00edr\u00e1s\u00e1hoz \u00e9s saj\u00e1t k\u00f3dunk v\u00e9grehajt\u00e1s\u00e1hoz. Az els\u0151 t\u00e1mad\u00e1si lehet\u0151s\u00e9g Bluetooth LE 4.0 (2009 \u00f3ta) haszn\u00e1lat\u00e1val val\u00f3s\u00edthat\u00f3 meg, a m\u00e1sodik pedig Bluetooth BR\/EDR 5.2 (2020 \u00f3ta) alkalmaz\u00e1s\u00e1val. <\/p>\n

A m\u00e1sodik sebezhet\u0151s\u00e9g (CVE-2022-42895) a mem\u00f3ria maradv\u00e1nyadatainak sziv\u00e1rg\u00e1s\u00e1b\u00f3l ered az l2cap_parse_conf_req f\u00fcggv\u00e9nyben, amely seg\u00edts\u00e9g\u00e9vel t\u00e1volr\u00f3l kinyerhet\u0151k a kernel strukt\u00far\u00e1kra mutat\u00f3 mutat\u00f3k inform\u00e1ci\u00f3i, speci\u00e1lisan form\u00e1zott konfigur\u00e1ci\u00f3s k\u00e9r\u00e9sek k\u00fcld\u00e9s\u00e9vel. Az l2cap_parse_conf_req f\u00fcggv\u00e9nyben az l2cap_conf_efs strukt\u00far\u00e1t haszn\u00e1lt\u00e1k, amelynek foglalt mem\u00f3ri\u00e1ja nem volt el\u0151zetesen inicializ\u00e1lva, \u00e9s a FLAG_EFS_ENABLE z\u00e1szl\u00f3 manipul\u00e1ci\u00f3j\u00e1val lehet\u0151v\u00e9 v\u00e1lt, hogy a csomagba r\u00e9gi adatok ker\u00fcljenek a veremb\u0151l. A probl\u00e9ma csak olyan rendszerekben jelentkezik, ahol a kernel a CONFIG_BT_HS opci\u00f3val van \u00f6ssze\u00e1ll\u00edtva (alap\u00e9rtelmezetten ki van kapcsolva, de egyes disztrib\u00faci\u00f3kban, p\u00e9ld\u00e1ul az Ubuntu-ban akt\u00edv). A sikeres t\u00e1mad\u00e1shoz sz\u00fcks\u00e9g van a HCI_HS_ENABLED param\u00e9ter be\u00e1ll\u00edt\u00e1s\u00e1ra a kezel\u0151i fel\u00fcleten igaz (alap\u00e9rtelmezetten nincs haszn\u00e1lva).
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 Bluetooth. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u043f\u043e\u0445\u043e\u0436\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2022-42895) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 L2CAP, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106088","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9gek a Linux kernelben, t\u00e1volr\u00f3l kihaszn\u00e1lhat\u00f3k Bluetooth-on kereszt\u00fcl | ProHoster","description":"A Linux kernelben egy sebezhet\u0151s\u00e9get (CVE-2022-42896) fedeztek fel, amely potenci\u00e1lisan lehet\u0151v\u00e9 teszi t\u00e1voli k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a kernel szintj\u00e9n speci\u00e1lisan form\u00e1zott L2CAP csomagok k\u00fcld\u00e9s\u00e9vel.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 Bluetooth | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-15T11:06:35+00:00","article:modified_time":"2022-12-15T11:06:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/106088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=106088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/106088\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=106088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=106088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=106088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}