{"id":114603,"date":"2024-03-27T12:25:57","date_gmt":"2024-03-27T10:25:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd"},"modified":"2024-03-27T12:25:57","modified_gmt":"2024-03-27T10:25:58","slug":"uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","title":{"rendered":"Linux kernel sebezhet\u0151s\u00e9gei, amelyek lehet\u0151v\u00e9 teszik a jogosults\u00e1gok emel\u00e9s\u00e9t nf_tables \u00e9s ksmbd r\u00e9v\u00e9n","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Netfilter, a Linux kernel subsystem used for filtering and modifying network packets, a vulnerability (CVE-2024-1086) has been identified that allows a local user to execute code at the kernel level and escalate their privileges in the system. The issue is caused by a double-free in the nf_tables module, which supports the functioning of the nftables packet filter. The security researcher who discovered the vulnerability has developed and published a working exploit prototype. <\/p>\n

A kihaszn\u00e1l\u00f3 m\u0171k\u00f6d\u00e9s\u00e9t a legfrissebb Debian \u00e9s Ubuntu kiad\u00e1sokban mutatt\u00e1k be, amelyek Linux 5.14 \u2013 6.6 kernellel rendelkeznek, valamint a KernelCTF (Capture the Flag) k\u00f6rnyezetben, amely kieg\u00e9sz\u00edt\u0151 jav\u00edt\u00e1sokat tartalmaz a klasszikus kihaszn\u00e1l\u00e1si m\u00f3dszerek blokkol\u00e1s\u00e1ra, \u00e9s amelyet a Google a sebezhet\u0151s\u00e9gek felfedez\u00e9s\u00e9\u00e9rt j\u00e1r\u00f3 jutalmak programj\u00e1ban haszn\u00e1l. A kihaszn\u00e1l\u00f3 m\u0171k\u00f6d\u00e9s\u00e9nek sikeress\u00e9g\u00e9t 99,4%-ra \u00e9rt\u00e9kelik. A k\u00eds\u00e9r\u0151 cikk r\u00e9szletesen t\u00e1rgyalja a bonyolult, t\u00f6bb szint\u0171 kihaszn\u00e1l\u00f3 l\u00e9trehoz\u00e1s\u00e1nak folyamat\u00e1t, valamint azokat a v\u00e9delmi mechanizmusokat, amelyek a kernelben tal\u00e1lhat\u00f3k \u00e9s amelyekkel szemben a kihaszn\u00e1l\u00e1sok m\u0171k\u00f6d\u00e9s\u00e9t akad\u00e1lyozz\u00e1k.

\"Linux<\/center> <\/p>\n

The problem is associated with an error in the nft_verdict_init() function, which allows positive values to be used as error codes for packet dropping (DROP) in hooks, which can be exploited to call the nf_hook_slow() function for a buffer that has already had the free() function called on it. The issue arises when the NF_DROP operation is formed incorrectly, and the kernel initially interprets NF_DROP, but then frees the buffer and returns a status of NF_ACCEPT. This situation leads to the processing of the packet not being terminated, despite the associated buffer being freed, and instead passing to another handler, which then invokes the memory release function a second time. <\/p>\n

The vulnerability has been present since Linux kernel version 3.15, but the exploit works with kernels starting from version 5.14. A fix for the vulnerability has been proposed in the Linux kernel release 6.8-rc1 and was backported to stable branches 5.15.149, 6.1.76, and 6.6.15 at the end of February. Users can track the vulnerability fix in distributions on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

Additionally, a series of vulnerabilities in the ksmbd module, which provides an integrated file-sharing implementation within the Linux kernel, can be noted. a szerver<\/a> SMB protokoll alapj\u00e1n: A CVE-2024-26592 sebezhet\u0151s\u00e9g lehet\u0151v\u00e9 teszi, hogy t\u00e1volr\u00f3l, hiteles\u00edt\u00e9s n\u00e9lk\u00fcl hajtsuk v\u00e9gre a k\u00f3dot kernel jogokkal olyan rendszereken, ahol az ksmbd modul aktiv\u00e1lva van. A probl\u00e9ma a TCP-kapcsolat kezel\u00e9s\u00e9ben fell\u00e9p\u0151 versenyhelyzetb\u0151l ad\u00f3dik, amely a megfelel\u0151 z\u00e1rak hi\u00e1ny\u00e1b\u00f3l ered, amikor az objektummal dolgozunk. <\/p>\n

A CVE-2023-52440 sebezhet\u0151s\u00e9g szint\u00e9n lehet\u0151v\u00e9 teszi, hogy t\u00e1volr\u00f3l, kernel jogokkal hajtsuk v\u00e9gre a k\u00f3dot, de a b\u0171n\u00f6z\u00e9s a mem\u00f3ria t\u00falcsordul\u00e1s\u00e1b\u00f3l ered, amikor hib\u00e1s munkamenetkulcsokat kezel\u00fcnk a felhaszn\u00e1l\u00f3t\u00f3l kapott adatok m\u00e9ret\u00e9nek megfelel\u0151 ellen\u0151rz\u00e9s\u00e9nek hi\u00e1nya miatt a fix m\u00e9ret\u0171 pufferbe m\u00e1sol\u00e1s el\u0151tt. <\/p>\n

A CVE-2024-26594, CVE-2023-52442 \u00e9s CVE-2023-52441 (1, 2, 3) sebezhet\u0151s\u00e9gek az ksmbd-ben lehet\u0151v\u00e9 teszik, hogy t\u00e1volr\u00f3l, hiteles\u00edt\u00e9s n\u00e9lk\u00fcl meghat\u00e1rozzuk a kernel mem\u00f3ria tartalm\u00e1t. A CVE-2024-26594 sebezhet\u0151s\u00e9g az SMB2 Mech tokenek kezel\u00e9s\u00e9n\u00e9l fell\u00e9p\u0151 hib\u00e1s adatok ellen\u0151rz\u00e9s\u00e9b\u0151l ad\u00f3dik, ami a puffer ter\u00fclet\u00e9n k\u00edv\u00fcli adatok visszaad\u00e1s\u00e1hoz vezet. A CVE-2023-52442 sebezhet\u0151s\u00e9g a kapcsolt (chained) k\u00e9r\u00e9sek kezel\u00e9s\u00e9n\u00e9l fell\u00e9p\u0151 bej\u00f6v\u0151 adatok megfelel\u0151 ellen\u0151rz\u00e9s\u00e9nek hi\u00e1ny\u00e1b\u00f3l ered. A CVE-2023-52441 sebezhet\u0151s\u00e9g a csatlakoz\u00e1si k\u00e9r\u00e9sek kezel\u00e9s\u00e9n\u00e9l fell\u00e9p\u0151 bej\u00f6v\u0151 adatok sz\u00fcks\u00e9ges ellen\u0151rz\u00e9s\u00e9nek hi\u00e1nya miatt l\u00e9p fel. <\/p>\n

A CVE-2024-26594 \u00e9s CVE-2024-26592 sebezhet\u0151s\u00e9geket a 6.8-as kernell verzi\u00f3ban \u00e9s a kor\u00e1bbi 6.1.75, 6.6.14, 6.7.2 stabil \u00e1gv\u00e1ltozataiban orvosolt\u00e1k. A t\u00f6bbi sebezhet\u0151s\u00e9get a 6.5-\u00f6s kernellben \u00e9s az 5.15.145, 6.1.53, 6.4.16 friss\u00edt\u00e9sekben orvosolt\u00e1k. <\/p>\n

\u00d6sszegz\u00e9sk\u00e9ppen eml\u00edthetj\u00fck meg az \u00faj Linux kernel fejleszt\u0151i csapat aktiv\u00e1l\u00e1s\u00e1t, amelyet a sebezhet\u0151s\u00e9gek elemz\u00e9s\u00e9re \u00e9s a kernel jav\u00edt\u00e1saival kapcsolatos biztons\u00e1gi probl\u00e9m\u00e1k \u00e9rt\u00e9kel\u00e9s\u00e9re hoztak l\u00e9tre. Febru\u00e1rban a kernel fejleszt\u0151i l\u00e9trehoztak egy saj\u00e1t CNA (CVE Numbering Authority) szolg\u00e1ltat\u00e1st, amely \u00f6n\u00e1ll\u00f3an jogosult CVE-azonos\u00edt\u00f3k kioszt\u00e1s\u00e1ra a sebezhet\u0151s\u00e9geknek. Kor\u00e1bban a CVE-azonos\u00edt\u00f3k kioszt\u00e1sa \u00e9s a jav\u00edt\u00e1sok sebezhet\u0151s\u00e9gekkel val\u00f3 kapcsolata a disztrib\u00faci\u00f3k fejleszt\u0151inek v\u00e1ll\u00e1r\u00f3l sz\u00e1rmazott, m\u00edg a kernelen bel\u00fcl a potenci\u00e1lis sebezhet\u0151s\u00e9gek nem voltak kiemelve, \u00e9s norm\u00e1l jav\u00edt\u00e1sokk\u00e9nt szerepeltek. Az \u00faj szolg\u00e1ltat\u00e1s munk\u00e1j\u00e1nak eredm\u00e9nyei fel\u00fclm\u00falt\u00e1k a v\u00e1rakoz\u00e1sokat \u2013 naponta t\u00f6bb tucat \u00faj sebezhet\u0151s\u00e9get jel\u00f6lnek meg a kernelben, amelyek kor\u00e1bban nem voltak a biztons\u00e1gi probl\u00e9m\u00e1k k\u00f6z\u00f6tt. P\u00e9ld\u00e1ul m\u00e1rcius 26-\u00e1n \u00faj CVE-azonos\u00edt\u00f3kat osztottak ki 14 sebezhet\u0151s\u00e9gnek, amelyeket kor\u00e1bban nem tekintettek biztons\u00e1gi probl\u00e9m\u00e1nak, m\u00edg m\u00e1rcius 25-\u00e9n 41 sebezhet\u0151s\u00e9get jel\u00f6ltek meg.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e9r\u00fcl\u00e9kenys\u00e9gek a Linux kernelben, amelyek lehet\u0151v\u00e9 teszik a privil\u00e9giumemel\u00e9st az nf_tables \u00e9s az ksmbd r\u00e9v\u00e9n | ProHoster","description":"A Netfilterben, a Linux kernel olyan alrendszer\u00e9ben, amelyet a h\u00e1l\u00f3zati csomagok sz\u0171r\u00e9s\u00e9re \u00e9s m\u00f3dos\u00edt\u00e1s\u00e1ra haszn\u00e1lnak, egy s\u00e9r\u00fcl\u00e9kenys\u00e9g (CVE-2024-1086) ker\u00fclt felfedez\u00e9sre, amely lehet\u0151v\u00e9 teszi egy helyi felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra, hogy kernel szint\u0171 k\u00f3dot futtasson \u00e9s emelje privil\u00e9giumait.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 nf_tables \u0438 ksmbd | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-27T10:25:58+00:00","article:modified_time":"2024-03-27T10:25:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:46","updated":"2026-02-22 15:29:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=114603"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114603\/revisions"}],"predecessor-version":[{"id":162202,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114603\/revisions\/162202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/114604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=114603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=114603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=114603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}