{"id":119988,"date":"2024-09-30T09:21:07","date_gmt":"2024-09-30T07:21:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux"},"modified":"2024-09-30T09:21:07","modified_gmt":"2024-09-30T07:21:07","slug":"uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux","title":{"rendered":"Vulnerability in libnv on FreeBSD and vulnerabilities in Netfilter on Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

S\u0101kotn\u0113j\u0101 septembra atjaunin\u0101jum\u0101 par dro\u0161\u012bbas risin\u0101jumiem bibliot\u0113k\u0101 libnv tika atkl\u0101ta lo\u0123iska k\u013c\u016bda, kas liedza pien\u0101c\u012bgi nov\u0113rst ievainojam\u012bbu, t\u0101d\u0113j\u0101di sist\u0113ma palika pak\u013cauta uzbrukumam. Bibliot\u0113ku libnv att\u012bsta FreeBSD projekts, un to izmanto kodola un pamatprogrammu lietojumprogramm\u0101s v\u0113rt\u012bbu p\u0101ru apstr\u0101dei un datu p\u0101rs\u016bt\u012b\u0161anai savstarp\u0113j\u0101 mijiedarb\u012bb\u0101. T\u0101 ir balst\u012bta uz algoritmu nvlist, kas tiek izmantots OpenZFS projekt\u0101, ta\u010du FreeBSD ir izstr\u0101d\u0101ta sava versija, t\u0101p\u0113c ievainojam\u012bba neietekm\u0113 OpenZFS. <\/p>\n

Ievainojam\u012bba ir izrais\u012bta ar vesel\u012bgu skait\u013cu p\u0101rpl\u016bdi, kas noved pie bufera atg\u016b\u0161anas, kura izm\u0113rs ir maz\u0101ks par ierakst\u0101mo bufer\u012b eso\u0161o datu bloku. Pie\u013caut\u0101 k\u013c\u016bda potenci\u0101li var tikt izmantota, lai paaugstin\u0101tu savas privil\u0113\u0123ijas, p\u0101rrakstot atmi\u0146as apgabalus kodol\u0101 un sist\u0113mas procesos. Piem\u0113ram, libnv tiek izmantots libcasper, kad tiek mijiedarboties ar privile\u0123\u0113tu un neprivile\u0123\u0113tu kodu. Pareizs dro\u0161\u012bbas risin\u0101jums (CVE-2024-45287) ir pied\u0101v\u0101ts atjaunin\u0101jumos 14.1-RELEASE-p5, 14.0-RELEASE-p11, 13.4-RELEASE-p1 un 13.3-RELEASE-p7, k\u0101 ar\u012b k\u0101 pl\u0101ksteris. <\/p>\n

FreeBSD ar\u012b ir nov\u0113rsta ievainojam\u012bba (CVE-2024-41721) hipervizor\u0101 bhyve, kas potenci\u0101li \u013cauj izpild\u012bt kodu proces\u0101, kas darbojas viesu sist\u0113mas pus\u0113 (parasti ar root ties\u012bb\u0101m, bet izol\u0113ts CAPSICUM b\u0101zes sandbox\u0101) proced\u016bru manipul\u0101ciju laik\u0101 viesu sist\u0113m\u0101. Ievainojam\u012bba past\u0101v USB kontroliera XHCI emul\u0101cijas kod\u0101 un ir izrais\u012bta ar nepietiekamu bufera robe\u017eu p\u0101rbaudi, kas var novest pie datu las\u012b\u0161anas no bufera \u0101r\u0113j\u0101 apgabala un potenci\u0101li pie iesp\u0113jas rakst\u012bt uz nejau\u0161u atmi\u0146as apgabalu procesa ietvaros. Uzbrukums var tikt \u012bstenots tad, ja ir iesp\u0113ja palaist privile\u0123\u0113tus procesus viesu sist\u0113m\u0101. Ievainojam\u012bba ir nov\u0113rsta 14.1-RELEASE-p5, 14.0-RELEASE-p11, 13.4-RELEASE-p1 un 13.3-RELEASE-p7 atjaunin\u0101jumos. <\/p>\n

Turkl\u0101t var atz\u012bm\u0113t publisko\u0161anu darba prototipiem exploitiem un aprakstiem par izmantotaj\u0101m metod\u0113m iepriek\u0161 atkl\u0101taj\u0101m ievainojam\u012bb\u0101m Linux kodol\u0101 CVE-2024-26808 un CVE-2024-1085. Probl\u0113mas ir nov\u0113rstas kodola atjaunin\u0101jumos 5.10.210, 5.15.149, 6.1.76, 6.6.15, 6.7.3 un 6.8, un jau ir izlabotas galvenajos distrib\u016bcij\u0101s (Debian, Ubuntu, RHEL, SUSE, Fedora). Ievainojam\u012bbas ir izveidoju\u0161\u0101s, piek\u013c\u016bstot jau atbr\u012bvotai atmi\u0146as da\u013cai funkcij\u0101s nft_chain_filter un nft_setelem_catchall_deactivate netfilter apak\u0161sist\u0113m\u0101 un \u013cauj izpild\u012bt kodu ar saknes ties\u012bb\u0101m. Uzbrukumam nepiecie\u0161ams piek\u013cuve nftables, kuru var ieg\u016bt, ja ir CAP_NET_ADMIN ties\u012bbas jebkur\u0101 lietot\u0101ju identifikatoru telp\u0101 (user namespace) vai t\u012bkla telp\u0101 (network namespace), kas tiek nodro\u0161in\u0101tas, piem\u0113ram, izol\u0113tajos konteineros. <\/p>\n

Exploiti ir sagatavoti KernelCTF (Kernel Capture the Flag) iniciat\u012bvas dal\u012bbnieku, kur\u0101 uz\u0146\u0113mums Google izmaks\u0101 atl\u012bdz\u012bbu par ievainojam\u012bbu atkl\u0101\u0161anu Linux kodol\u0101. S\u0101kotn\u0113ji probl\u0113mas tika uzskat\u012btas par vien\u0101m no daudz\u0101m potenci\u0101laj\u0101m ievainojam\u012bb\u0101m kodol\u0101 \u2014 piem\u0113ram, j\u016bnij\u0101 izlaistaj\u0101 kodola paketes atjaunin\u0101jum\u0101 5.10 Debian tika izlabotas 345 (!) potenci\u0101las ievainojam\u012bbas, papildus CVE-2024-26808. Katru ned\u0113\u013cu kodol\u0101 tiek atkl\u0101tas vair\u0101kas desmitiem jaunu ievainojam\u012bbu, kuras iepriek\u0161 nebija identific\u0113tas k\u0101 dro\u0161\u012bbas probl\u0113mas (piem\u0113ram, pag\u0101ju\u0161aj\u0101 ned\u0113\u013c\u0101 tika atz\u012bm\u0113tas 68 ievainojam\u012bbas).
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u043c \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libnv \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0430\u0441\u044c \u0434\u043e\u043b\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430 \u0430\u0442\u0430\u043a\u0435. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 libnv \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c FreeBSD \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u044f\u0434\u0440\u0435 \u0438 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0438\u0437 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 \u043a\u043b\u044e\u0447\/\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043c\u0435\u0436\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043d\u043e\u043c \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119988","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0101te libnv FreeBSD un vulnerabilit\u0101tes Netfilter Linux | ProHoster","description":"Izskatoties uz izlai\u017eam\u0101 labojuma septembra s\u0101kum\u0101, libnv bibliot\u0113k\u0101 ir atkl\u0101ta lo\u0123isk\u0101 k\u013c\u016bda, d\u0113\u013c kuras ievainojam\u012bba netika pien\u0101c\u012bgi nov\u0113rsta un sist\u0113ma palika pak\u013cauta uzbrukumiem.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 libnv \u0432\u043e FreeBSD \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Netfilter \u0432 Linux | ProHoster","og:description":"\u0412 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u043c \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libnv \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0430\u0441\u044c \u0434\u043e\u043b\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430 \u0430\u0442\u0430\u043a\u0435.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-libnv-vo-freebsd-i-uyazvimosti-v-netfilter-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-30T07:21:07+00:00","article:modified_time":"2024-09-30T07:21:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119988","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 06:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:55:19","updated":"2026-01-23 06:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/119988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=119988"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/119988\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=119988"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=119988"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=119988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}