Chiwopsezo pakukhazikitsa socket ya AF_PACKET ya Linux kernel

Zaka zitatu pambuyo pa kuwonongeka kwa chiwopsezo (1, 2, 3, 4, 5) mu AF_PACKET subsystem ya Linux kernel kudziwika vuto linanso (CVE-2020-14386), kulola wogwiritsa ntchito wopanda mwayi kuti apereke nambala ngati mizu kapena kutuluka m'mitsuko yakutali ngati ali ndi mizu.

Kupanga socket ya AF_PACKET ndikugwiritsa ntchito zomwe zili pachiwopsezo kumafuna mwayi wa CAP_NET_RAW. Komabe, chilolezo chotchulidwacho chikhoza kupezedwa ndi wogwiritsa ntchito mwamwayi m'mabokosi opangidwa pamakina omwe ali ndi chithandizo cha malo ogwiritsira ntchito omwe atsegulidwa. Mwachitsanzo, malo ogwiritsira ntchito amathandizidwa mwachisawawa pa Ubuntu ndi Fedora, koma osayatsidwa pa Debian ndi RHEL. Pa Android, njira ya mediaserver ili ndi ufulu wopanga zitsulo za AF_PACKET, momwe chiwopsezocho chingagwiritsidwe ntchito.

Kusatetezeka kulipo mu ntchito ya tpacket_rcv ndipo kumachitika chifukwa cholakwika pakuwerengera kusintha kwa netoff. Wowukira atha kupanga momwe kusintha kwa netoff kumalembedwera pamtengo wocheperako kusiyana ndi maclen, zomwe zingayambitse kusefukira powerengera "macoff = netoff - maclen" ndikuyika molakwika cholozera ku buffer ya data yomwe ikubwera. Zotsatira zake, wowukira atha kuyambitsa kulemba kuchokera pa 1 mpaka 10 mabayiti kupita kudera lopitilira malire a buffer yomwe yaperekedwa. Zimadziwika kuti kupezerapo mwayi kukukula komwe kumakupatsani mwayi wopeza ufulu wa mizu mudongosolo.

Vutoli lilipo mu kernel kuyambira July 2008, i.e. imadziwonetsera yokha mu ma nuclei enieni. Kukonzekera kulipo ngati chigamba. Mutha kuyang'anira kupezeka kwa zosintha zamaphukusi pamagawidwe patsamba lotsatirali: Ubuntu, Fedora, SUSE, Debian, RHEL, Chipilala.

Source: opennet.ru

Kuwonjezera ndemanga