{"id":105107,"date":"2022-09-16T03:36:41","date_gmt":"2022-09-16T01:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root"},"modified":"2022-09-16T03:36:41","modified_gmt":"2022-09-16T01:36:41","slug":"uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","title":{"rendered":"Vulnerabilit\u00e0 nell'ambiente utente Enlightenment che consente l'accesso ai diritti di root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 stata rilevata una vulnerabilit\u00e0 nell'ambiente utente Enlightenment (CVE-2022-37706) che consente a un utente locale non privilegiato di eseguire codice con diritti di root. La vulnerabilit\u00e0 non \u00e8 ancora stata corretta (0-day), ma \u00e8 gi\u00e0 disponibile un exploit pubblico, testato su Ubuntu 22.04. <\/p>\n

Il problema si trova nel file eseguibile enlightenment_sys, fornito con il flag suid root e che esegue determinate comandi consentiti tramite la chiamata system(), come il montaggio di un'unit\u00e0 con l'utility mount. A causa di un malfunzionamento della funzione che forma la stringa passata alla chiamata system(), le virgolette vengono rimosse dagli argomenti del comando eseguito, consentendo l'esecuzione del proprio codice. Ad esempio, eseguendo mkdir -p \/tmp\/net mkdir -p \u00ab\/tmp\/;\/tmp\/exploit\u00bb echo \u00ab\/bin\/sh\u00bb > \/tmp\/exploit chmod a+x \/tmp\/exploit enlightenment_sys \/bin\/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), \u00ab\/dev\/..\/tmp\/;\/tmp\/exploit\u00bb \/tmp\/\/\/net <\/p>\n

A causa della rimozione delle virgolette doppie, invece del comando specificato \u2018\/bin\/mount \u2026 \u00ab\/dev\/..\/tmp\/;\/tmp\/exploit\u00bb \/tmp\/\/\/net\u2019, alla funzione system() verr\u00e0 passata una stringa senza virgolette doppie \u2018\/bin\/mount \u2026 \/dev\/..\/tmp\/;\/tmp\/exploit \/tmp\/\/\/net\u2019, il che porter\u00e0 all'esecuzione separata del comando \u2018\/tmp\/exploit \/tmp\/\/\/net\u2019 invece di essere trattato come parte del percorso del dispositivo. Le stringhe \u00ab\/dev\/..\/tmp\/\u00bb e \u00ab\/tmp\/\/\/net\u00bb sono state scelte per aggirare la verifica degli argomenti del comando mount in enlightenment_sys (il dispositivo montato deve iniziare con \/dev\/ e puntare a un file esistente, e i tre caratteri \u00ab\/\u00bb nel punto di montaggio sono specificati per raggiungere la dimensione del percorso richiesta).
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 Enlightenment \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-37706), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043a\u0430 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 (0-day), \u043d\u043e \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0443\u0436\u0435 \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0432 Ubuntu 22.04. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c \u0444\u0430\u0439\u043b\u0435 enlightenment_sys, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0441 \u0444\u043b\u0430\u0433\u043e\u043c suid root \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0435\u043c \u0447\u0435\u0440\u0435\u0437 \u0432\u044b\u0437\u043e\u0432 system() \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105107","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nell'ambiente utente Enlightenment che consente l'accesso ai diritti di root | ProHoster","description":"\u00c8 stata rilevata una vulnerabilit\u00e0 nell'ambiente utente Enlightenment (CVE-2022-37706) che consente a un utente locale non privilegiato di eseguire codice con diritti di root.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 Enlightenment, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u0412 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 Enlightenment \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-37706), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-09-16T01:36:41+00:00","article:modified_time":"2022-09-16T01:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/105107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=105107"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/105107\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=105107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=105107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=105107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}