{"id":99693,"date":"2021-04-09T16:22:51","date_gmt":"2021-04-09T14:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-podsisteme-ebpf-yadra-linux"},"modified":"2021-04-09T16:22:51","modified_gmt":"2021-04-09T14:22:51","slug":"uyazvimosti-v-podsisteme-ebpf-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","title":{"rendered":"A Linux kernel eBPF alrendszer\u00e9nek sebezhet\u0151s\u00e9gei","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Az eBPF alrendszerben, amely lehet\u0151v\u00e9 teszi a nyomk\u00f6vet\u00e9si, elemz\u00e9si \u00e9s forgalomkezel\u00e9si feladatokhoz sz\u00fcks\u00e9ges kezel\u0151k ind\u00edt\u00e1s\u00e1t a Linux kernelben, egy sebezhet\u0151s\u00e9get (CVE-2021-29154) azonos\u00edtottak, amely lehet\u0151v\u00e9 teszi egy helyi felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra, hogy a kernel szintj\u00e9n futtasson saj\u00e1t k\u00f3dot. A probl\u00e9ma a 5.11.12-es verzi\u00f3ig terjed, \u00e9s m\u00e9g nem jav\u00edtott\u00e1k a disztrib\u00faci\u00f3kban (Debian, Ubuntu, RHEL, Fedora, SUSE, Arch). A jav\u00edt\u00e1s patch form\u00e1j\u00e1ban \u00e9rhet\u0151 el. <\/p>\n

A sebezhet\u0151s\u00e9get felfedez\u0151 kutat\u00f3k szerint siker\u00fclt megalkotniuk egy m\u0171k\u00f6d\u0151 protot\u00edpust a 32- \u00e9s 64-bites x86 rendszerekhez, amelyet nem privilegiz\u00e1lt felhaszn\u00e1l\u00f3k is alkalmazhatnak. Ezen k\u00edv\u00fcl a Red Hat c\u00e9g megjegyzi, hogy a probl\u00e9ma vesz\u00e9lyess\u00e9ge a felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra hozz\u00e1f\u00e9rhet\u0151 eBPF rendszerh\u00edv\u00e1s f\u00fcggv\u00e9nye. P\u00e9ld\u00e1ul a RHEL \u00e9s a legt\u00f6bb m\u00e1s Linux disztrib\u00faci\u00f3 eset\u00e9ben az alap\u00e9rtelmezett konfigur\u00e1ci\u00f3ban a sebezhet\u0151s\u00e9g kihaszn\u00e1lhat\u00f3 a BPF JIT enged\u00e9lyez\u00e9s\u00e9vel \u00e9s a felhaszn\u00e1l\u00f3 CAP_SYS_ADMIN jogainak megl\u00e9t\u00e9vel. Mint v\u00e9delmi int\u00e9zked\u00e9st aj\u00e1nlott a BPF JIT letilt\u00e1sa a k\u00f6vetkez\u0151 parancs haszn\u00e1lat\u00e1val: echo 0 > \/proc\/sys\/net\/core\/bpf_jit_enable <\/p>\n

A probl\u00e9ma a g\u00e9pi k\u00f3d JIT-k\u00e9sz\u00edt\u0151kkel v\u00e9gzett ugr\u00e1sparancsok elmozdul\u00e1s\u00e1nak sz\u00e1m\u00edt\u00e1si hib\u00e1j\u00e1b\u00f3l ad\u00f3dik. K\u00fcl\u00f6n\u00f6sen az ugr\u00e1sparancsok gener\u00e1l\u00e1sakor nem veszik figyelembe, hogy az elmozdul\u00e1s megv\u00e1ltozhat az optimaliz\u00e1l\u00e1si f\u00e1zis ut\u00e1n. Az eml\u00edtett hi\u00e1nyoss\u00e1g felhaszn\u00e1lhat\u00f3 abnorm\u00e1lis g\u00e9pi k\u00f3d l\u00e9trehoz\u00e1s\u00e1ra \u00e9s a kernel szintj\u00e9n t\u00f6rt\u00e9n\u0151 v\u00e9grehajt\u00e1s\u00e1ra. <\/p>\n

Figyelemre m\u00e9lt\u00f3, hogy ez nem az egyetlen sebezhet\u0151s\u00e9g az eBPF alrendszer\u00e9ben az ut\u00f3bbi id\u0151szakban. M\u00e1rcius v\u00e9g\u00e9n a kernelben tov\u00e1bbi k\u00e9t sebezhet\u0151s\u00e9get (CVE-2020-27170, CVE-2020-27171) azonos\u00edtottak, amelyek lehet\u0151v\u00e9 teszik az eBPF sz\u00e1m\u00e1ra a Spectre-f\u00e9le sebezhet\u0151s\u00e9gek v\u00e9delmi k\u00f6r\u00e9nek megker\u00fcl\u00e9s\u00e9t, lehet\u0151v\u00e9 t\u00e9ve a kernel mem\u00f3ri\u00e1j\u00e1nak tartalm\u00e1nak meghat\u00e1roz\u00e1s\u00e1t bizonyos m\u0171veletek spekulat\u00edv v\u00e9grehajt\u00e1s\u00e1nak el\u0151seg\u00edt\u00e9s\u00e9vel. A Spectre-t\u00e1mad\u00e1shoz priviligiz\u00e1lt k\u00f3dban sz\u00fcks\u00e9ges egy meghat\u00e1rozott parancsokb\u00f3l \u00e1ll\u00f3 sorrend, amely spekulat\u00edv v\u00e9grehajt\u00e1sra vezet. Az eBPF-ben t\u00f6bb m\u00f3dot tal\u00e1ltak, amelyek seg\u00edts\u00e9g\u00e9vel ilyen parancsok gener\u00e1lhat\u00f3k a v\u00e9grehajt\u00e1sra sz\u00e1nt BPF-programok manipul\u00e1l\u00e1s\u00e1val. <\/p>\n

A CVE-2020-27170 vulnerability is caused by pointer manipulations in the BPF verifier that trigger speculative operations accessing memory beyond buffer boundaries. The CVE-2020-27171 vulnerability is related to an integer arithmetic error (integer underflow) when working with pointers, leading to speculative access to data outside the buffer. These issues have already been addressed in kernel releases 5.11.8, 5.10.25, 5.4.107, 4.19.182, and 4.14.227, and have been included in the kernel updates of most Linux distributions. Researchers have prepared a prototype exploit that allows an unprivileged user to extract data from kernel memory.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29154), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 5.11.12 (\u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e) \u0438 \u0435\u0449\u0451 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 (Debian, Ubuntu, RHEL, Fedora, SUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99693","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilities in the Linux kernel eBPF subsystem | ProHoster","description":"In the eBPF subsystem, which enables the execution of handlers for tracing, analyzing subsystem performance, and traffic management within the Linux kernel in a special JIT virtual machine, a vulnerability has been discovered.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-09T14:22:51+00:00","article:modified_time":"2021-04-09T14:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99693","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-09 14:30:13","updated":"2022-09-30 04:24:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/99693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=99693"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/99693\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=99693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=99693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=99693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}