{"id":103411,"date":"2022-02-22T15:37:00","date_gmt":"2022-02-22T13:37:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2022-02-22T15:37:00","modified_gmt":"2022-02-22T13:37:00","slug":"uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"Luka w systemie netfilter, pozwalaj\u0105ca na wykonanie kodu w poziomie j\u0105dra Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W Netfilter, podsystemie j\u0105dra Linux, u\u017cywanym do filtrowania i modyfikacji pakiet\u00f3w sieciowych, zidentyfikowano luk\u0119 (CVE-2022-25636), umo\u017cliwiaj\u0105c\u0105 uruchomienie kodu na poziomie j\u0105dra. Zg\u0142oszono przygotowanie przyk\u0142adu exploita, kt\u00f3ry pozwala lokalnemu u\u017cytkownikowi na podniesienie swoich uprawnie\u0144 w Ubuntu 21.10 z wy\u0142\u0105czonym mechanizmem ochrony KASLR. Problem wyst\u0119puje od wersji j\u0105dra 5.4. Poprawka jest na razie dost\u0119pna w postaci \u0142atki (nie stworzono jeszcze odpowiednich wyda\u0144 j\u0105dra). \u015aledzi\u0107 publikacje aktualizacji pakiet\u00f3w w dystrybucjach mo\u017cna na stronach: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n

Vulnerability is caused by an error in calculating the size of the array flow->rule->action.entries in the function nft_fwd_dup_netdev_offload (defined in the file net\/netfilter\/nf_dup_netdev.c), which may lead to the recording of attacker-controlled data in the memory area outside the allocated buffer. The error manifests when configuring 'dup' and 'fwd' rules in chains where hardware packet processing acceleration (offload) is applied. Since the overflow occurs before the creation of the packet filtering rule and the offload support check, the vulnerability is also applicable to network devices that do not support hardware acceleration, such as the loopback interface. <\/p>\n

Zauwa\u017cono, \u017ce problem jest do\u015b\u0107 prosty do wykorzystania, poniewa\u017c warto\u015bci wychodz\u0105ce poza bufor mog\u0105 nadpisa\u0107 wska\u017anik do struktury net_device, a dane o nadpisanej warto\u015bci wracaj\u0105 do przestrzeni u\u017cytkownika, co umo\u017cliwia poznanie adres\u00f3w w pami\u0119ci potrzebnych do przeprowadzenia ataku. Aby wykorzysta\u0107 luk\u0119, konieczne jest stworzenie okre\u015blonych regu\u0142 w nftables, co jest mo\u017cliwe tylko przy posiadaniu uprawnie\u0144 CAP_NET_ADMIN, kt\u00f3re mog\u0105 by\u0107 zdobyte przez nieuprzywilejowanego u\u017cytkownika w odr\u0119bnej przestrzeni nazw (network namespaces). Luka ta mo\u017ce by\u0107 r\u00f3wnie\u017c wykorzystana do atak\u00f3w na systemy izolacji kontener\u00f3w.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-25636), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430. \u0417\u0430\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 Ubuntu 21.10 c \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u044b KASLR. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u044f\u0434\u0440\u0430 5.4. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430 (\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u044f\u0434\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103411","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka w podsystemie netfilter, pozwalaj\u0105ca na uruchomienie kodu na poziomie j\u0105dra Linux | ProHoster","description":"W Netfilter, podsystemie j\u0105dra Linux, u\u017cywanym do filtrowania i modyfikacji pakiet\u00f3w sieciowych, zidentyfikowano luk\u0119 (CVE-2022-25636), umo\u017cliwiaj\u0105c\u0105 uruchomienie kodu na poziomie j\u0105dra.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 netfilter, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-25636), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-22T13:37:00+00:00","article:modified_time":"2022-02-22T13:37:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103411","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-22 13:37:41","updated":"2022-09-30 11:50:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/103411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=103411"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/103411\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=103411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=103411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=103411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}