{"id":37426,"date":"2019-10-31T22:17:33","date_gmt":"2019-10-31T19:17:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu\/"},"modified":"2019-10-31T22:17:33","modified_gmt":"2019-10-31T19:17:33","slug":"uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","title":{"rendered":"Kwetsbaarheid die ontsnappen uit een ge\u00efsoleerde QEMU-omgeving mogelijk maakt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Onthuld<\/a><\/noindex> details van een kritieke kwetsbaarheid (CVE-2019-14378<\/a><\/noindex>) in de SLIRP-handler, die standaard wordt toegepast in QEMU om een communicatieweer te cre\u00ebren tussen de virtuele netwerkadapter in het gastbesturingssysteem en de netwerkbackend aan de QEMU-kant. Het probleem betreft ook virtualisatiesystemen die zijn gebaseerd op KVM (in de modus Usermode<\/a><\/noindex>) en Virtualbox, waarin de slirp-backend van QEMU wordt gebruikt, evenals applicaties die de netwerkstack in de gebruikersruimte libSLIRP<\/a><\/noindex> (TCP\/IP-emulator) gebruiken.<\/p>\n

De kwetsbaarheid maakt uitvoering van code aan de kant van het hostsysteem mogelijk met de rechten van het QEMU-behandelingsproces bij het verzenden van een speciaal geformatiseerd, zeer groot netwerkpakket vanuit het gastbesturingssysteem, waarvoor fragmentatie vereist is. Door een fout in de functie ip_reass(), die wordt aangeroepen bij het opnieuw samenstellen van binnenkomende pakketten, kan het eerste fragment niet in de toegewezen buffer passen en kan de staart in de geheugenruimten na de buffer worden geschreven. <\/p>\n

Voor het testen is er al beschikbaar is<\/a><\/noindex> een werkend prototype van de exploit ontwikkeld, waarin een omzeiling van ASLR en uitvoering van code via het overschrijven van het main_loop_tlg-geheugenarray is voorzien, inclusief de lijst QEMUTimerList met handlers die op basis van timers worden opgeroepen.
\nDe kwetsbaarheid is al verholpen in Fedora<\/a><\/noindex> en SUSE\/openSUSE<\/a><\/noindex>, maar blijft onopgelost in Debian<\/a><\/noindex>, Arch Linux<\/a><\/noindex> en FreeBSD<\/a><\/noindex>wordt een tabel met wijzigingen en instructies voor de overgang naar de nieuwe configuratie gegeven. Voor meer informatie, zie Ubuntu<\/a><\/noindex> en RHEL<\/a><\/noindex> het probleem doet zich niet voor vanwege het niet gebruiken van slirp. De kwetsbaarheid blijft onopgelost in de laatste versie van libslirp 4.0<\/a><\/noindex> (de patch is voorlopig beschikbaar als patch<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Bron: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-14378) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 SLIRP, \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 QEMU \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0430\u043d\u0430\u043b\u0430 \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0430\u0434\u0430\u043f\u0442\u0435\u0440\u043e\u043c \u0432 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u043c \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 QEMU. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 KVM (\u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Usermode) \u0438 Virtualbox, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u044d\u043a\u0435\u043d\u0434 slirp \u0438\u0437 QEMU, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37426","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kwetsbaarheid die ontsnappen uit een ge\u00efsoleerde QEMU-omgeving mogelijk maakt | ProHoster","description":"Details van een kritieke kwetsbaarheid onthuld (","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f QEMU | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:17:33+00:00","article:modified_time":"2019-10-31T19:17:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37426","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:27:24","updated":"2026-01-23 17:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/37426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=37426"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/37426\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=37426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=37426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=37426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}