{"id":99421,"date":"2021-03-13T22:22:39","date_gmt":"2021-03-13T20:22:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii"},"modified":"2021-03-13T22:22:39","modified_gmt":"2021-03-13T20:22:40","slug":"uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","title":{"rendered":"Vulnerabilit\u00e0 nel sottosistema iSCSI del kernel Linux che consente di elevare i propri privilegi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 stata scoperta una vulnerabilit\u00e0 nel codice del sottosistema iSCSI incluso nel kernel di Linux (CVE-2021-27365), che consente a un utente locale non privilegiato di eseguire codice a livello di kernel e ottenere privilegi di root nel sistema. \u00c8 disponibile un prototipo funzionante dell'exploit per il testing. La vulnerabilit\u00e0 \u00e8 stata corretta negli aggiornamenti del kernel di Linux 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260 e 4.4.260. Gli aggiornamenti dei pacchetti del kernel sono disponibili nelle distribuzioni Debian, Ubuntu, SUSE\/openSUSE, Arch Linux e Fedora. Per RHEL, le correzioni non sono ancora state rilasciate. <\/p>\n

Il problema \u00e8 causato da un errore nella funzione iscsi_host_get_param() del modulo libiscsi, introdotto nel 2006 durante lo sviluppo del sottosistema iSCSI. A causa della mancanza di adeguati controlli sulle dimensioni, alcuni attributi stringa di iSCSI, come hostname o username, possono superare il valore di PAGE_SIZE (4 KB). La vulnerabilit\u00e0 pu\u00f2 essere sfruttata tramite l'invio di messaggi Netlink da parte di un utente non privilegiato, che impostano gli attributi iSCSI a valori superiori a PAGE_SIZE. Durante la lettura di questi attributi attraverso sysfs o seqfs, viene eseguito il codice che passa gli attributi alla funzione sprintf per copiare in un buffer di dimensione PAGE_SIZE. <\/p>\n

Lo sfruttamento della vulnerabilit\u00e0 nelle distribuzioni dipende dal supporto per il caricamento automatico del modulo kernel scsi_transport_iscsi quando si tenta di creare un socket NETLINK_ISCSI. Nelle distribuzioni in cui questo modulo viene caricato automaticamente, l'attacco pu\u00f2 essere eseguito indipendentemente dall'uso della funzionalit\u00e0 iSCSI. Affinch\u00e9 l'exploit abbia successo, \u00e8 inoltre necessaria la registrazione di almeno un trasporto iSCSI. A sua volta, per registrare un trasporto si pu\u00f2 utilizzare il modulo kernel ib_iser, caricato automaticamente quando un utente non privilegiato tenta di creare un socket NETLINK_RDMA. <\/p>\n

Il caricamento automatico dei moduli necessari per l'applicazione dell'exploit \u00e8 supportato in CentOS 8, RHEL 8 e Fedora con l'installazione del pacchetto rdma-core, che \u00e8 una dipendenza per alcuni pacchetti popolari e viene installato per impostazione predefinita nelle configurazioni per workstation, sistemi server con GUI e ambienti di virtualizzazione. Tuttavia, rdma-core non viene installato quando si utilizza una build server che funziona solo in modalit\u00e0 console e quando viene installata un'immagine di installazione minimale. Ad esempio, il pacchetto \u00e8 incluso nella fornitura di base di Fedora 31 Workstation, ma non \u00e8 presente in Fedora 31 Server. Debian e Ubuntu sono meno soggetti al problema, poich\u00e9 il pacchetto rdma-core carica i moduli del kernel necessari per l'attacco solo in presenza di hardware RDMA.

\"Vulnerabilit\u00e0<\/center> <\/p>\n

\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u043e\u0434\u0443\u043b\u044f libiscsi: echo «install libiscsi \/bin\/true» >> \/etc\/modprobe.d\/disable-libiscsi.conf <\/p>\n

\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 iSCSI \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0435\u0449\u0451 \u0434\u0432\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u044f\u0434\u0440\u0430: CVE-2021-27363 (\u0443\u0442\u0435\u0447\u043a\u0430 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 iSCSI \u0447\u0435\u0440\u0435\u0437 sysfs) \u0438 CVE-2021-27364 (\u0447\u0442\u0435\u043d\u0438\u0435 \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0432\u043d\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u0431\u0443\u0444\u0435\u0440\u0430). \u0423\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0447\u0435\u0440\u0435\u0437 netlink-\u0441\u043e\u043a\u0435\u0442 \u0441 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 iSCSI \u0431\u0435\u0437 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a iSCSI \u0438 \u043e\u0442\u043f\u0440\u0432\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 «end a session» \u0434\u043b\u044f \u043e\u0431\u0440\u044b\u0432\u0430 \u0441\u0435\u0430\u043d\u0441\u0430.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u0435 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b iSCSI \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 \u044f\u0434\u0440\u0430 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-27365), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 Linux 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260 \u0438 4.4.260. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u044f\u0434\u0440\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Debian, Ubuntu, SUSE\/openSUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":99422,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nel sottosistema iSCSI del kernel Linux che consente di elevare i propri privilegi | ProHoster","description":"Nel codice del sottosistema iSCSI presente nel kernel Linux \u00e8 stata identificata una vulnerabilit\u00e0 (CVE-2021-27365) che consente a un utente locale non privilegiato di eseguire codice a livello di kernel e ottenere privilegi di root nel sistema.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 iSCSI \u044f\u0434\u0440\u0430 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u0435 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b iSCSI \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 \u044f\u0434\u0440\u0430 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-27365), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-13T20:22:40+00:00","article:modified_time":"2021-03-13T20:22:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99421","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-13 20:38:21","updated":"2022-09-28 06:45:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/99421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=99421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/99421\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/99422"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=99421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=99421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=99421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}