{"id":93183,"date":"2020-09-04T07:42:02","date_gmt":"2020-09-04T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizaczii-soketov-af_packet-yadra-linux"},"modified":"2020-09-04T07:42:02","modified_gmt":"2020-09-04T05:42:02","slug":"uyazvimost-v-realizaczii-soketov-af_packet-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-realizaczii-soketov-af_packet-yadra-linux","title":{"rendered":"Vulnerabilit\u00e0 nell'implementazione dei socket AF_PACKET del kernel Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tre anni dopo l'ondata di vulnerabilit\u00e0 (1<\/a><\/noindex>, 2<\/a><\/noindex>, 3<\/a><\/noindex>, 4<\/a><\/noindex>, 5<\/a><\/noindex>) nel sottosistema AF_PACKET del kernel Linux identificata<\/a><\/noindex> un altro problema (CVE-2020-14386<\/a><\/noindex>), che consente a un utente locale non privilegiato di eseguire codice con i privilegi di root o di uscire da contenitori isolati, se hanno accesso root.<\/p>\n

Per creare un socket AF_PACKET e sfruttare la vulnerabilit\u00e0 \u00e8 necessaria l'abilitazione del privilegio CAP_NET_RAW. Tuttavia, tale privilegio pu\u00f2 essere ottenuto da un utente non privilegiato nei contenitori creati in sistemi con il supporto abilitato per gli spazi dei nomi degli identificatori utente (user namespaces). Ad esempio, gli spazi dei nomi degli identificatori utente sono abilitati di default in Ubuntu e Fedora, ma non attivati in Debian e RHEL. In Android, l'accesso per creare socket AF_PACKET \u00e8 concesso al processo mediaserver, attraverso cui pu\u00f2 essere sfruttata la vulnerabilit\u00e0.<\/p>\n

La vulnerabilit\u00e0 \u00e8 presente nella funzione tpacket_rcv ed \u00e8 causata da un errore di calcolo della variabile netoff. Un attaccante pu\u00f2 creare condizioni in cui il valore della variabile netoff \u00e8 inferiore a maclen, il che provoca un overflow durante il calcolo di \u00abmacoff = netoff \u2014 maclen\u00bb e un'errata impostazione successiva del puntatore al buffer per i dati in arrivo. Di conseguenza, un attaccante pu\u00f2 avviare una scrittura di da 1 a 10 byte nell'area al di fuori del buffer allocato. Si segnala che \u00e8 in fase di sviluppo un exploit che consente di ottenere i diritti di root nel sistema. <\/p>\n

Il problema \u00e8 presente nel kernel da luglio 2008, cio\u00e8 si manifesta in tutti i kernel attuali. Una correzione \u00e8 attualmente disponibile sotto forma di patch<\/a><\/noindex>. \u00c8 possibile monitorare l'apparizione di aggiornamenti dei pacchetti sulle distribuzioni sulle seguenti pagine: Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, Arch<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043f\u0443\u0441\u0442\u044f \u0442\u0440\u0438 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0432\u043e\u043b\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (1, 2, 3, 4, 5) \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 AF_PACKET \u044f\u0434\u0440\u0430 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2020-14386), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0438\u043b\u0438 \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u043d\u0438\u0445 root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0414\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u043e\u043a\u0435\u0442\u0430 AF_PACKET \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u043e\u043b\u043d\u043e\u043c\u043e\u0447\u0438\u0439 CAP_NET_RAW. \u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93183","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nell'implementazione dei socket AF_PACKET del kernel Linux | ProHoster","description":"Tre anni dopo l'ondata di vulnerabilit\u00e0 (1,","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-realizaczii-soketov-af_packet-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u043a\u0435\u0442\u043e\u0432 AF_PACKET \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0421\u043f\u0443\u0441\u0442\u044f \u0442\u0440\u0438 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0432\u043e\u043b\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (1,","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-realizaczii-soketov-af_packet-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-04T05:42:02+00:00","article:modified_time":"2020-09-04T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93183","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:52:32","updated":"2022-09-28 05:10:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/93183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=93183"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/93183\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=93183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=93183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=93183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}