Chiwopsezo mu Linux kernel network stack

Chiwopsezo chadziwika mu code ya TCP-based RDS protocol handler (Reliable Datagram Socket, net/rds/tcp.c) (CVE-2019-11815), zomwe zingayambitse mwayi wopita kumalo okumbukira omasulidwa kale ndi kukana ntchito (mwinamwake, mwayi wogwiritsa ntchito vutoli kuti ukonzekere kuphedwa kwa code sikuchotsedwa). Vutoli limayamba chifukwa cha mpikisano womwe ungachitike mukamagwira ntchito ya rds_tcp_kill_sock ndikuchotsa zitsulo zapaintaneti.

Kufotokozera Mtengo wa NVD Vutoli limalembedwa kuti lingagwiritsidwe ntchito patali pamaneti, koma kutengera kufotokozera Malangizo, popanda kupezeka kwanuko m'dongosolo ndikusintha malo a mayina, sikungatheke kukonzekera kuwukira patali. Makamaka, malinga ndi malingaliro Madivelopa a SUSE, chiwopsezochi chimangogwiritsidwa ntchito kwanuko kokha; kukonza kuwukira ndizovuta kwambiri ndipo kumafuna mwayi wowonjezera mudongosolo. Ngati mu NVD mlingo wangozi umayesedwa pa 9.3 (CVSS v2) ndi 8.1 (CVSS v2) mfundo, ndiye malinga ndi chiwerengero cha SUSE ngoziyo imayesedwa pa 6.4 mfundo pa 10.

Oimira Ubuntu nawonso kuyamikiridwa kuopsa kwa vutoli kumaonedwa kuti n’kochepa. Pa nthawi yomweyo, malinga ndi CVSS v3.0 specifications, vuto amapatsidwa mkulu mlingo kuukira zovuta ndi exploitability amapatsidwa 2.2 mfundo 10.

Kuweruza lipoti kuchokera ku Cisco, chiwopsezochi chimagwiritsidwa ntchito patali potumiza mapaketi a TCP ku mautumiki apakompyuta. RDS ndipo pali kale prototype ya ntchito. Momwe chidziwitsochi chikugwirizanirana ndi zenizeni sichinadziwikebe; mwina lipotilo limangopanga malingaliro a NVD mwaluso. Wolemba zambiri Kugwiritsa ntchito kwa VulDB sikunapangidwe ndipo vutoli limangogwiritsidwa ntchito kwanuko.

Vuto limapezeka mu maso pamaso pa 5.0.8 ndipo lidatsekedwa ndi Marichi kukonza, kuphatikizidwa mu kernel 5.0.8. M'magawidwe ambiri vuto limakhalabe losathetsedwa (Debian, RHEL, Ubuntu, SUSE). Kukonzekera kwatulutsidwa kwa SLE12 SP3, openSUSE 42.3 ndi Fedora.

Source: opennet.ru