Linux kodola apak\u0161sist\u0113m\u0101 Netfilter, kas tiek izmantota t\u012bkla pakete izfiltr\u0113\u0161anai un modific\u0113\u0161anai, atkl\u0101ts v\u0101jums (CVE-2021-22555), kas \u013cauj lok\u0101lam lietot\u0101jam ieg\u016bt root privil\u0113\u0123ijas sist\u0113m\u0101, pat atrodoties izol\u0113t\u0101 konteiner\u0101. Tika izstr\u0101d\u0101ts darba prototips eksploitam, kas apiet KASLR, SMAP un SMEP aizsardz\u012bbas meh\u0101nismus. P\u0113tnieks, kur\u0161 atkl\u0101ja v\u0101jumu, sa\u0146\u0113ma 20 t\u016bksto\u0161u dol\u0101ru atl\u012bdz\u012bbu no Google par metodes atkl\u0101\u0161anu, kas apiet Kubernetes konteineru izol\u0101ciju kCTF klaster\u012b. <\/p>\n
Probl\u0113ma par\u0101d\u0101s kop\u0161 2.6.19 kodola, kas izlaists pirms 15 gadiem, un ir izrais\u012bta k\u013c\u016bd\u0101m IPT_SO_SET_REPLACE un IP6T_SO_SET_REPLACE apstr\u0101d\u0101t\u0101jos, kas noved pie bufera p\u0101rpl\u016bdes, nos\u016btot speci\u0101li izstr\u0101d\u0101tus parametrus ar setsockopt izsaukumu compat re\u017e\u012bm\u0101. Parastajos apst\u0101k\u013cos compat_setsockopt() var izsaukt tikai lietot\u0101js root, ta\u010du nepiecie\u0161amie uzbrukuma pilnvarojumi var tikt ieg\u016bti ar\u012b no ierobe\u017eota lietot\u0101ja sist\u0113m\u0101s ar aktiviz\u0113tu lietot\u0101ju identit\u0101\u0161u nosaukumu telpu (user namespaces) atbalstu. <\/p>\n
Lietot\u0101js var izveidot konteineru ar atsevi\u0161\u0137u root lietot\u0101ju un no t\u0101 izmantot ievainojam\u012bbu. Piem\u0113ram, 'lietot\u0101ja nosaukumu telpas' p\u0113c noklus\u0113juma ir iesl\u0113gtas Ubuntu un Fedora, bet nav aktiviz\u0113tas Debian un RHEL. Patches, kas nov\u0113r\u0161 ievainojam\u012bbu, tika pie\u0146emti Linux kodol\u0101 13. apr\u012bl\u012b. Pakot\u0146u atjaunin\u0101jumi jau ir sagatavoti projektiem Debian, Arch Linux un Fedora. Ubuntu, RHEL un SUSE atjaunin\u0101jumi ir sagatavo\u0161anas stadij\u0101. <\/p>\n
Probl\u0113ma rodas funkcij\u0101 xt_compat_target_from_user() d\u0113\u013c nepareizas atmi\u0146as lieluma apr\u0113\u0137in\u0101\u0161anas, saglab\u0101jot kodola strukt\u016bras p\u0113c p\u0101rveido\u0161anas no 32-bitu uz 64-bitu att\u0113lojumu. K\u013c\u016bda \u013cauj ierakst\u012bt \u010detras nulles baitu jebkur\u0101 poz\u012bcij\u0101 \u0101rpus pie\u0161\u0137irt\u0101 bufera, ko ierobe\u017eo p\u0101rvietojums 0x4C. Min\u0113t\u0101 iesp\u0113ja izr\u0101d\u012bj\u0101s pietiekama, lai izveidotu exploitu, kas \u013cauj ieg\u016bt root ties\u012bbas \u2014 caur m_list->next r\u0101d\u012bt\u0101ja not\u012br\u012b\u0161anu strukt\u016br\u0101 msg_msg tika rad\u012bti nosac\u012bjumi netie\u0161ai piek\u013cuvei datiem p\u0113c atmi\u0146as atbr\u012bvo\u0161anas (use-after-free), ko v\u0113l\u0101k izmantoja, lai ieg\u016btu adreses un main\u012btu citas strukt\u016bras, manipul\u0113jot ar sist\u0113mas izsaukumu msgsnd(). \u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-22555), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0441\u044c \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435. \u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b KASLR, SMAP \u0438 SMEP. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u0442 Google \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435, \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 20 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0437\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100767","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ievainojam\u012bba Linux kodola Netfilter apak\u0161sist\u0113m\u0101 | ProHoster","description":"Netfilter, Linux kodolaika apak\u0161sist\u0113m\u0101, kas tiek izmantota t\u012bkla pake\u0161u filtr\u0113\u0161anai un modific\u0113\u0161anai, ir atkl\u0101ta ievainojam\u012bba (CVE-2021-22555), kas \u013cauj viet\u0113jiem lietot\u0101jiem ieg\u016bt root privil\u0113\u0123ijas sist\u0113m\u0101.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux Netfilter | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-22555), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-15T14:22:45+00:00","article:modified_time":"2021-07-15T14:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100767","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-15 14:42:50","updated":"2022-10-01 06:19:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/100767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=100767"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/100767\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=100767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=100767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=100767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"