En Linux-kjernen er det oppdaget en s\u00e5rbarhet (CVE-2022-42896) som potensielt kan utnyttes for \u00e5 utf\u00f8re kode eksternt p\u00e5 kjernniv\u00e5 ved \u00e5 sende spesialtilpassede L2CAP-pakker via Bluetooth. I tillegg er det oppdaget et lignende problem (CVE-2022-42895) i L2CAP-behandleren, som kan f\u00f8re til lekkasje av kjernens minne i pakker med konfigurasjonsinformasjon. Den f\u00f8rste s\u00e5rbarheten er aktiv siden august 2014 (kjerne 3.16), mens den andre har v\u00e6rt aktiv siden oktober 2011 (kjerne 3.0). S\u00e5rbarhetene er blitt utbedret i versjoner av Linux-kjernen 6.1.0, 6.0.8, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154 og 5.15.78. Du kan f\u00f8lge med p\u00e5 rettelsene i distribusjoner p\u00e5 f\u00f8lgende sider: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
For demonstrasjon av mulighetene for fjernangrep er det publisert prototyper av utnyttelser som fungerer p\u00e5 Ubuntu 22.04. For \u00e5 utf\u00f8re angrepet m\u00e5 angriperen befinne seg innen rekkevidde av Bluetooth \u2014 forh\u00e5ndspairing er ikke n\u00f8dvendig, men Bluetooth m\u00e5 v\u00e6re aktivert p\u00e5 datamaskinen. Det er tilstrekkelig \u00e5 kjenne MAC-adressen til offeret, som kan bestemmes ved sniffing eller beregnes basert p\u00e5 Wi-Fi MAC-adressen p\u00e5 enkelte enheter. <\/p>\n
Den f\u00f8rste s\u00e5rbarheten (CVE-2022-42896) skyldes tilgang til et allerede frigitt minneomr\u00e5de (use-after-free) i implementeringen av funksjonene l2cap_connect og l2cap_le_connect_req \u2014 etter opprettelsen av kanalen gjennom callback-kallet new_connection, ble det ikke satt en l\u00e5s, men en timer ble konfigurert (__set_chan_timer), som ved utl\u00f8p kaller funksjonen l2cap_chan_timeout og rengj\u00f8r kanalen uten \u00e5 sjekke fullf\u00f8ringen av arbeidet med kanalen i funksjonene l2cap_le_connect*. <\/p>\n
Som standard er tidsbegrensningen 40 sekunder, og det ble antatt at en race condition ikke kunne oppst\u00e5 med en slik forsinkelse. Det viste seg imidlertid at p\u00e5 grunn av en annen feil i SMP-behandleren kan timeren utl\u00f8ses umiddelbart, noe som f\u00f8rer til en race condition. Problemet i l2cap_le_connect_req kan f\u00f8re til minnelekkasje i kjernen, mens l2cap_connect kan f\u00f8re til overskriving av minneinnhold og utf\u00f8ring av egen kode. Den f\u00f8rste angrepsmetoden kan utf\u00f8res ved bruk av Bluetooth LE 4.0 (siden 2009), og den andre ved bruk av Bluetooth BR\/EDR 5.2 (siden 2020). <\/p>\n
Den andre s\u00e5rbarheten (CVE-2022-42895) er for\u00e5rsaket av lekkasje av resterende data fra minnet i funksjonen l2cap_parse_conf_req, noe som kan bli brukt til \u00e5 hente informasjon om pekere til kjerneressurser eksternt ved \u00e5 sende spesialtilpassede konfigurasjonsforesp\u00f8rsel. I funksjonen l2cap_parse_conf_req ble det brukt en struktur l2cap_conf_efs, hvor det ikke ble utf\u00f8rt forh\u00e5ndsinitialisering av tildelt minne, og gjennom manipulering med flagget FLAG_EFS_ENABLE kunne det bli oppn\u00e5dd inbakt i pakken gamle data fra stakken. Problemet manifesterer seg bare i systemer der kjernen er kompilert med alternativet CONFIG_BT_HS (som standard deaktivert, men aktivert i noen distribusjoner, for eksempel Ubuntu). For et vellykket angrep kreves ogs\u00e5 at parameteren HCI_HS_ENABLED settes til true via kontrollgrensesnittet (som standard ikke i bruk). \u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 Bluetooth. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u043f\u043e\u0445\u043e\u0436\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2022-42895) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 L2CAP, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106088","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheter i Linux-kjernen som kan utnyttes eksternt via Bluetooth | ProHoster","description":"En s\u00e5rbarhet (CVE-2022-42896) er oppdaget i Linux-kjernen, som potensielt kan utnyttes til \u00e5 organisere ekstern kj\u00f8re av kode p\u00e5 kjern niv\u00e5 ved \u00e5 sende en spesialtilpasset L2CAP-pakke.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 Bluetooth | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/no\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-15T11:06:35+00:00","article:modified_time":"2022-12-15T11:06:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/106088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=106088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/106088\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=106088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=106088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=106088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"