Kusatetezeka komwe kumakupatsani mwayi wotuluka m'malo akutali a QEMU

Zawululidwa tsatanetsatane wa kusatetezeka kwakukulu (CVE-2019-14378) mu chogwirizira cha SLIRP chokhazikika chomwe chimagwiritsidwa ntchito mu QEMU kukhazikitsa njira yolumikizirana pakati pa adaputala ya netiweki yapaulendo ndi netiweki yobwerera ku mbali ya QEMU. Nkhaniyi imakhudzanso machitidwe a KVM-based virtualization (in Usermode) ndi Virtualbox, yomwe imagwiritsa ntchito slirp backend kuchokera ku QEMU, komanso mapulogalamu omwe amagwiritsa ntchito malo ochezera a pa Intaneti. libSLIRP (TCP/IP emulator).

Chiwopsezochi chimalola kuti code ichitidwe kumbali ya wolandila ndi ufulu wa kachitidwe ka QEMU pomwe paketi ya netiweki yopangidwa mwapadera imatumizidwa kuchokera ku dongosolo la alendo, lomwe limafunikira kugawikana. Chifukwa cha zolakwika mu ip_reass () ntchito, yomwe imatchedwa pomanganso mapaketi omwe akubwera, chidutswa choyamba sichingagwirizane ndi buffer yomwe yaperekedwa ndipo mchira wake udzalembedwa kumalo okumbukira pafupi ndi buffer.

Zoyesa kale zilipo chiwonetsero chogwira ntchito, chomwe chimapereka mwayi wolambalala ASLR ndikuchita ma code pochotsa kukumbukira kwa main_loop_tlg array, kuphatikiza QEMTimerList yokhala ndi zogwira zotchedwa ndi timer.
Chiwopsezo chakhazikitsidwa kale Fedora ΠΈ SUSE/OpenSUSE, koma amakhala osakonzedwa mkati Debian, Arch Linux ΠΈ FreeBSD. The Ubuntu ΠΈ RHEL Vuto silikuwoneka chifukwa chosagwiritsa ntchito slirp. Chiwopsezocho sichinakhazikitsidwe pakutulutsidwa kwaposachedwa libslirp 4.0 (kukonza kulipo pano ngati chigamba).

Source: opennet.ru

Kuwonjezera ndemanga