{"id":108680,"date":"2023-05-24T12:48:28","date_gmt":"2023-05-24T10:48:28","guid":{"rendered":"https:\/\/prohoster.info\/?p=108680"},"modified":"2023-05-24T16:23:52","modified_gmt":"2023-05-24T14:23:52","slug":"uyazvimosti-v-module-ksmbd-yadra-linux-pozvolyayushhie-udalyonno-vypolnit-svoj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-module-ksmbd-yadra-linux-pozvolyayushhie-udalyonno-vypolnit-svoj-kod","title":{"rendered":"Sebezhet\u0151s\u00e9gek az Linux kernel ksmbd modulj\u00e1ban, amelyek lehet\u0151v\u00e9 teszik a t\u00e1voli k\u00f3dv\u00e9grehajt\u00e1st","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A ksmbd modulban, amely a Linux kernel be\u00e1gyazott f\u00e1jlszerver megval\u00f3s\u00edt\u00e1s\u00e1t k\u00edn\u00e1lja az SMB protokoll alapj\u00e1n, 14 sebezhet\u0151s\u00e9get fedeztek fel, amelyek k\u00f6z\u00fcl n\u00e9gy lehet\u0151v\u00e9 teszi, hogy t\u00e1voli t\u00e1mad\u00f3 k\u00f3dot hajtson v\u00e9gre kernel szint\u0171 jogosults\u00e1ggal. A t\u00e1mad\u00e1s hiteles\u00edt\u00e9s n\u00e9lk\u00fcl v\u00e9grehajthat\u00f3, elegend\u0151, ha a rendszerben akt\u00edv a ksmbd modul. A probl\u00e9m\u00e1k a 5.15-\u00f6s kernelt\u0151l kezd\u0151d\u0151en jelentkeznek, amelyben be\u00e9p\u00edtett\u00e9k a ksmbd modult. A sebezhet\u0151s\u00e9geket a 6.3.2, 6.2.15, 6.1.28 \u00e9s 5.15.112-es kernel friss\u00edt\u00e9sek jav\u00edtott\u00e1k. A jav\u00edt\u00e1sokat a disztrib\u00faci\u00f3kban a k\u00f6vetkez\u0151 oldalakon lehet nyomon k\u00f6vetni: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Gentoo, Arch. <\/p>\n
Az azonos\u00edtott probl\u00e9m\u00e1k: <\/p>\n
\n
CVE-2023-32254, CVE-2023-32250, CVE-2023-32257, CVE-2023-32258 \u2014 t\u00e1voli k\u00f3d v\u00e9grehajt\u00e1sa kernel jogokkal a megfelel\u0151 objektumz\u00e1rak hi\u00e1nya miatt, amikor a k\u00fcls\u0151 k\u00e9r\u00e9seket dolgozz\u00e1k fel, amelyek SMB2_TREE_DISCONNECT, SMB2_SESSION_SETUP, SMB2_LOGOFF \u00e9s SMB2_CLOSE parancsokat tartalmaznak, ami kihaszn\u00e1lhat\u00f3 versenyhelyzethez vezet. A t\u00e1mad\u00e1s hiteles\u00edt\u00e9s n\u00e9lk\u00fcl v\u00e9grehajthat\u00f3.\n
CVE-2023-32256 \u2014 a kernel mem\u00f3riater\u00fcletek tartalm\u00e1nak sziv\u00e1rg\u00e1sa versenyhelyzet miatt, amikor az SMB2_QUERY_INFO \u00e9s SMB2_LOGOFF parancsokat dolgozz\u00e1k fel. A t\u00e1mad\u00e1s hiteles\u00edt\u00e9s n\u00e9lk\u00fcl v\u00e9grehajthat\u00f3.\n
CVE-2023-32252, CVE-2023-32248 \u2014 t\u00e1voli szolg\u00e1ltat\u00e1smegtagad\u00e1s null pointer derefer\u00e1l\u00e1sa miatt az SMB2_LOGOFF, SMB2_TREE_CONNECT \u00e9s SMB2_QUERY_INFO parancsok feldolgoz\u00e1sa k\u00f6zben. A t\u00e1mad\u00e1s hiteles\u00edt\u00e9s n\u00e9lk\u00fcl v\u00e9grehajthat\u00f3.\n
CVE-2023-32249 \u2014 felhaszn\u00e1l\u00f3i munkamenet elfog\u00e1s\u00e1nak lehet\u0151s\u00e9ge a munkamenet azonos\u00edt\u00f3j\u00e1nak megfelel\u0151 elszigetel\u00e9s\u00e9nek hi\u00e1nya miatt multiproceszor be\u00e1ll\u00edt\u00e1sn\u00e1l.\n
CVE-2023-32247, CVE-2023-32255 \u2014 szolg\u00e1ltat\u00e1smegtagad\u00e1s a mem\u00f3ria sziv\u00e1rg\u00e1sa miatt az SMB2_SESSION_SETUP parancs feldolgoz\u00e1sa k\u00f6zben. A t\u00e1mad\u00e1s hiteles\u00edt\u00e9s n\u00e9lk\u00fcl v\u00e9grehajthat\u00f3.\n
CVE-2023-2593 \u2014 szolg\u00e1ltat\u00e1smegtagad\u00e1s az el\u00e9rhet\u0151 mem\u00f3ria kimer\u00fcl\u00e9se miatt, ami hib\u00e1t okoz, amely a mem\u00f3ria nem visszaad\u00e1s\u00e1hoz vezet \u00faj TCP kapcsolatok kezel\u00e9sekor. A t\u00e1mad\u00e1s hiteles\u00edt\u00e9s n\u00e9lk\u00fcl v\u00e9grehajthat\u00f3.\n
CVE-2023-32253 \u2014 szolg\u00e1ltat\u00e1smegtagad\u00e1s a holtpontok kialakul\u00e1sa miatt az SMB2_SESSION_SETUP parancs feldolgoz\u00e1sa k\u00f6zben. A t\u00e1mad\u00e1s hiteles\u00edt\u00e9s n\u00e9lk\u00fcl v\u00e9grehajthat\u00f3.\n
CVE-2023-32251 \u2014 a hiteles\u00edt\u00e9si param\u00e9terek t\u00e1mad\u00e1sok ellen (brute force) nincsenek v\u00e9dve.\n
CVE-2023-32246 \u2014 a rendszer helyi felhaszn\u00e1l\u00f3ja, akinek joga van az ksmbd modul bet\u00f6lt\u00e9s\u00e9re, v\u00e9grehajthatja a saj\u00e1t k\u00f3dj\u00e1t a Linux kernel szintj\u00e9n. <\/ul>\n
Additionally, 5 more vulnerabilities have been identified in the ksmbd-tools package, which includes utilities for managing and working with ksmbd that run in user space. The most critical vulnerabilities (ZDI-CAN-17822, ZDI-CAN-17770, ZDI-CAN-17820, CVE not yet assigned) allow a remote unauthenticated attacker to execute their code with root privileges. The vulnerabilities arise from the lack of size checks on incoming external data before copying it into the buffer in the WKSSVC service code and in the handlers for the LSARPC_OPNUM_LOOKUP_SID2 and SAMR_OPNUM_QUERY_USER_INFO opcodes. Two additional vulnerabilities (ZDI-CAN-17823, ZDI-CAN-17821) may lead to remote denial of service without requiring authentication. <\/p>\n
Ksmbd is presented as a high-performance and ready-to-use extension of Samba for embedded devices that can be integrated with Samba tools and libraries if necessary. Support for running the SMB server using the ksmbd module has been included in the Samba package since version 4.16.0. Unlike the user-space SMB server, ksmbd is more efficient in terms of performance, memory consumption, and integration with enhanced kernel capabilities. The authors of the ksmbd code are Namjae Jeon from Samsung and Hyunchul Lee from LG, while maintenance within the kernel is handled by Steve French from Microsoft, the maintainer of the CIFS\/SMB2\/SMB3 subsystems in the Linux kernel and a long-time contributor to the Samba development team, who has made significant contributions to the implementation of SMB\/CIFS protocol support in Samba and Linux. <\/p>\n
Additionally, two vulnerabilities can be noted in the vmwgfx graphics driver used for implementing 3D acceleration in VMware environments. The first vulnerability (ZDI-CAN-20292) allows a local user to escalate their privileges in the system. The vulnerability arises from the lack of buffer state checks before freeing when handling the vmw_buffer_object, which may lead to a double free function call. The second vulnerability (ZDI-CAN-20110) causes kernel memory content leakage due to errors in organizing GEM object locking. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"