Chiwopsezo (CVE-2023-43641) chadziwika mu laibulale ya libcue, yomwe imagwiritsidwa ntchito kusanthula metadata yomwe ili ndi chidziwitso chokhudza dongosolo ndi kutalika kwa nyimbo zomvera, zomwe zimalola kuti ma code azichitika pokonza mafayilo opangidwa mwapadera. Laibulale imagwiritsidwa ntchito pazosewerera makanema ndi osintha ma audio, kuphatikiza Audacious, ndipo itha kugwiritsidwa ntchito kusokoneza machitidwe powawonetsa zomwe sadalitsika.
Kuphatikiza apo, laibulale ya libcue imagwiritsidwa ntchito mukusaka kwa tracker-miners komwe kumagwiritsidwa ntchito m'malo ogwiritsa ntchito a GNOME. Popeza tracker-miners imangolemba mafayilo atsopano m'ndandanda wakunyumba, kuti awononge machitidwe a GNOME ndikupangitsa kuti owukira achite, zomwe zimangofunika kuti wogwiritsa ntchito angoyika fayilo yopangidwa mwapadera ku ~/Downloads, ~/Music or ~ /Kanema wamavidiyo, osatsegula (mwachitsanzo, nthawi zina, kudina ulalo pa msakatuli ndikokwanira).
Ofufuza omwe adazindikira kuti ali pachiwopsezo adakonza zogwirira ntchito ndikuwonetsa kuthekera kogwiritsa ntchito malo ozikidwa pa Ubuntu 23.04 ndi Fedora 38. Kachidindo kameneka kadzasindikizidwa pambuyo pake kuti apatse ogwiritsa ntchito nthawi yoyika zosintha zomwe zimachotsa chiwopsezo. Kugwiritsiridwa ntchito kumakhala kokhazikika pakugwira ntchito, koma kumafuna kusintha kwa kugawa kulikonse.
Kusatetezekaku kumachitika chifukwa chakusefukira kwa chiwerengero cha INDEX parameter ndipo kumawoneka pofotokoza manambala akulu kwambiri pagawoli omwe sakugwirizana ndi mtundu wa "int". Kuti mutembenuzire chingwe kukhala nambala, gwiritsani ntchito ntchito ya atoi, mwachitsanzo, ngati mutchula nambala 4294567296, idzasinthidwa kukhala -400000. Chiwopsezocho chimayamba chifukwa cha kusayang'ana mtengo wotsatira kuti muwonetsetse kuti chingakhale cholakwika. Zotsatira zake, mu code pambuyo pa kutembenuka kwa atoi, ntchito "track-> index[i] = ind" ikuchitika, momwe "i" ikhoza kupatsidwa nambala yolakwika kuti iwononge malo okumbukira kunja kwa buffer ndi mtengo. "ind", yomwe imayikidwanso kuchokera ku fayilo yomwe ikukonzedwa.
Pa magawo ambiri a GNOME, tracker-miners imathandizidwa mwachisawawa ndikuyikidwa ngati kudalira kwambiri kwa Nautilus file manager (GNOME Files). Kuti mulepheretse tracker-miners kwa ogwiritsa ntchito pano, mutha kugwiritsa ntchito malamulo awa: systemctl --user mask tracker-store.service tracker-miner-fs.service tracker-miner-rss.service tracker-extract.service tracker-miner-apps .service tracker-writeback .service tracker reset --hard
Source: opennet.ru
