{"id":53889,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-ld-so-openbsd"},"modified":"2020-02-18T14:01:50","modified_gmt":"2020-02-18T11:01:50","slug":"uyazvimost-v-ld-so-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-ld-so-openbsd","title":{"rendered":"Kwetsbaarheid in ld.so OpenBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dynamische loader ld.so<\/a><\/noindex>, die deel uitmaken van OpenBSD, kan onder bepaalde voorwaarden SUID\/SGID<\/a><\/noindex>-toepassingen de omgevingsvariabele LD_LIBRARY_PATH behouden en zo de belasting van externe code in de context van een proces met verhoogde privileges mogelijk maken. Patches ter oplossing van de kwetsbaarheid zijn beschikbaar voor de releases 6.5<\/a><\/noindex> en 6.6<\/a><\/noindex>. Binaire patches (syspatch<\/a><\/noindex>) voor de platforms amd64, i386 en arm64 zijn al in productie en zouden beschikbaar moeten zijn voor download op het moment van publicatie van dit nieuws.<\/p>\n

De kern van het probleem: tijdens het werk haalt ld.so eerst de waarde van de variabele LD_LIBRARY_PATH uit de omgeving, en zet deze met behulp van de functie _dl_split_path() om in een array van strings \u2014 padnamen naar mappen. Als later blijkt dat het huidige proces is opgestart als een SUID\/SGID-toepassing, worden de gemaakte array en de eigenlijke variabele LD_LIBRARY_PATH gewist. Als tijdens het werk _dl_split_path() tegen een tekort aan geheugen aanloopt (wat moeilijk is vanwege de expliciete beperking op de grootte van omgevingsvariabelen van 256 kB, maar theoretisch mogelijk), krijgt de variabele _dl_libpath de waarde NULL, en de daaropvolgende controle van deze variabele zorgt ervoor dat de oproep naar _dl_unsetenv(\u2018LD_LIBRARY_PATH\u2019) wordt overgeslagen.<\/p>\n

De kwetsbaarheid is gevonden door specialisten Qualys<\/a><\/noindex>, net als enkele eerder ontdekte<\/a><\/noindex> problemen. De onderzoekers die de kwetsbaarheid hebben ontdekt, hebben de snelheid van de oplossing opgemerkt: de patch werd voorbereid en updates werden binnen drie uur na kennisgeving door het OpenBSD-project vrijgegeven.<\/p>\n

Aanvulling: Het probleem heeft het nummer CVE-2019-19726<\/a><\/noindex>. In de mailinglijst oss-security is een offici\u00eble aankondiging<\/a><\/noindex>, inclusief een exploit-prototype dat werkt in OpenBSD 6.6, 6.5, 6.2 en 6.1 op de architecturen
\namd64 en i386 (de exploit kan ook worden aangepast voor andere architecturen).
\n Het probleem is exploiteerbaar in de standaardinstallatie en stelt een niet-geprivilegieerde lokale gebruiker in staat om code met root-rechten uit te voeren door het vervangen van een bibliotheek bij het starten van de suid-hulpmiddelen chpass of passwd. Voor het cre\u00ebren van de noodzakelijke voorwaarden voor exploitatie wordt een geheugenlimiet ingesteld via setrlimit.<\/p>\n

<\/a><\/noindex><\/p>\n

Bron: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f SUID\/SGID-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f LD_LIBRARY_PATH \u0438 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u041f\u0430\u0442\u0447\u0438 \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u043b\u044f \u0440\u0435\u043b\u0438\u0437\u043e\u0432 6.5 \u0438 6.6. \u0411\u0438\u043d\u0430\u0440\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 (syspatch) \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c amd64, i386 \u0438 arm64 \u0443\u0436\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u044b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53889","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kwetsbaarheid in ld.so OpenBSD | ProHoster","description":"De dynamische loader ld.so, onderdeel van OpenBSD, kan onder bepaalde voorwaarden","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-ld-so-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ld.so OpenBSD | ProHoster","og:description":"\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-ld-so-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53889","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:10:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:10:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/53889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=53889"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/53889\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=53889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=53889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=53889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}