{"id":106239,"date":"2022-12-22T15:36:49","date_gmt":"2022-12-22T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm"},"modified":"2022-12-22T15:36:49","modified_gmt":"2022-12-22T13:36:49","slug":"uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm","title":{"rendered":"Vulnerabilit\u00e0 in systemd-coredump, che consente di determinare il contenuto della memoria dei programmi suid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 stata identificata una vulnerabilit\u00e0 nel componente systemd-coredump, che gestisce i file di core generati dopo la chiusura anomala dei processi (CVE-2022-4415), consentendo a un utente locale non privilegiato di determinare il contenuto della memoria dei processi privilegiati eseguiti con il flag suid root. La presenza di un problema nella configurazione predefinita \u00e8 stata confermata nelle distribuzioni openSUSE, Arch, Debian, Fedora e SLES. <\/p>\n

La vulnerabilit\u00e0 \u00e8 causata dalla mancanza di una corretta gestione del parametro sysctl fs.suid_dumpable in systemd-coredump, che, con il valore predefinito impostato su 2, permette la generazione di core dump per processi con il flag suid. Si presume che i file di core scritti dal kernel per processi suid debbano avere i privilegi di accesso impostati in modo da consentirne la lettura solo all'utente root. Lo strumento systemd-coredump, chiamato dal kernel per salvare i file di core, salva il file di core con l'identificatore root, ma permette inoltre l'accesso ai file di core basato su ACL, consentendo la lettura sulla base dell'identificatore del proprietario che ha originariamente avviato il processo. <\/p>\n

Questa caratteristica consente di caricare i file di core senza considerare che il programma pu\u00f2 cambiare l'identificatore utente ed essere eseguito con privilegi elevati. L'attacco consiste nel fatto che un utente pu\u00f2 avviare un'applicazione suid e inviare il segnale SIGSEGV, dopodich\u00e9 pu\u00f2 caricare il contenuto del file di core, che include un'istantanea della memoria del processo al momento della chiusura anomala. <\/p>\n

\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c «\/usr\/bin\/su» \u0438 \u0432 \u0434\u0440\u0443\u0433\u043e\u043c \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0435\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 «kill -s SIGSEGV `pidof su`», \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e systemd-coredump \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442 core-\u0444\u0430\u0439\u043b \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \/var\/lib\/systemd\/coredump, \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u0432 \u0434\u043b\u044f \u043d\u0435\u0433\u043e ACL, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0439 \u0447\u0442\u0435\u043d\u0438\u0435 \u0442\u0435\u043a\u0443\u0449\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e. \u0422\u0430\u043a \u043a\u0430\u043a suid-\u0443\u0442\u0438\u043b\u0438\u0442\u0430 ‘su’ \u0447\u0438\u0442\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \/etc\/shadow, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0445\u0435\u0448\u0430\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u0442\u0438\u043b\u0438\u0442\u0430 sudo \u0430\u0442\u0430\u043a\u0435 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430, \u0442\u0430\u043a \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u0435\u0449\u0430\u0435\u0442 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044e core-\u0444\u0430\u0439\u043b\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 ulimit. <\/p>\n

Secondo gli sviluppatori di systemd, la vulnerabilit\u00e0 \u00e8 presente a partire dal rilascio di systemd 247 (novembre 2020), ma secondo il ricercatore che ha identificato il problema, anche la versione 246 \u00e8 vulnerabile. La vulnerabilit\u00e0 si presenta se systemd \u00e8 stato compilato con la libreria libacl (predefinita in tutte le distribuzioni popolari). Una correzione \u00e8 attualmente disponibile sotto forma di patch. \u00c8 possibile monitorare le correzioni nelle distribuzioni sulle seguenti pagine: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Gentoo, Arch. Come soluzione temporanea per la protezione, si pu\u00f2 impostare sysctl fs.suid_dumpable su 0, disabilitando il passaggio dei dump al gestore systemd-coredump.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 systemd-coredump, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 core-\u0444\u0430\u0439\u043b\u043e\u0432, \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u043f\u043e\u0441\u043b\u0435 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-4415), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c suid root. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043e \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 openSUSE, Arch, Debian, Fedora \u0438 SLES. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 sysctl-\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 fs.suid_dumpable \u0432 systemd-coredump, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106239","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u00e0 in systemd-coredump che consente di determinare il contenuto della memoria delle applicazioni suid | ProHoster","description":"\u00c8 stata identificata una vulnerabilit\u00e0 (CVE-2022-4415) nel componente systemd-coredump, che gestisce i file core generati dopo l'interruzione imprevista dei processi, consentendo a un utente locale non privilegiato di sfruttarla.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 systemd-coredump, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 suid-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c | ProHoster","og:description":"\u0412 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 systemd-coredump, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 core-\u0444\u0430\u0439\u043b\u043e\u0432, \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u043f\u043e\u0441\u043b\u0435 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-4415), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-22T13:36:49+00:00","article:modified_time":"2022-12-22T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/106239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=106239"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/106239\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=106239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=106239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=106239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}