{"id":114603,"date":"2024-03-27T12:25:57","date_gmt":"2024-03-27T10:25:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd"},"modified":"2024-03-27T12:25:57","modified_gmt":"2024-03-27T10:25:58","slug":"uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","title":{"rendered":"Vulnerabilidades no n\u00facleo do Linux que permitem elevar suas permiss\u00f5es atrav\u00e9s do nf_tables e ksmbd.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

No Netfilter, um subsistema do n\u00facleo Linux usado para filtrar e modificar pacotes de rede, foi descoberta uma vulnerabilidade (CVE-2024-1086) que permite a um usu\u00e1rio local executar c\u00f3digo no n\u00edvel do kernel e elevar suas permiss\u00f5es no sistema. O problema \u00e9 causado por uma libera\u00e7\u00e3o dupla de mem\u00f3ria (double-free) no m\u00f3dulo nf_tables, que permite a opera\u00e7\u00e3o do filtro de pacotes nftables. O pesquisador de seguran\u00e7a que identificou a vulnerabilidade desenvolveu e publicou um prot\u00f3tipo funcional de exploit. <\/p>\n

A efic\u00e1cia do exploit foi demonstrada nas vers\u00f5es atuais do Debian e do Ubuntu com kernels Linux de 5.14 a 6.6, bem como em um ambiente com o KernelCTF (Capture the Flag), que inclui patches adicionais para bloquear m\u00e9todos t\u00edpicos de opera\u00e7\u00e3o dos exploits e que \u00e9 utilizado pela Google em seu programa de recompensas por encontrar vulnerabilidades. A taxa de sucesso do exploit \u00e9 estimada em 99,4%. O artigo acompanhante detalha o processo de cria\u00e7\u00e3o de um complexo exploit multicamada e a forma de contornar os mecanismos de prote\u00e7\u00e3o e contramedidas presentes no kernel.

\"Vulnerabilidades<\/center> <\/p>\n

O problema est\u00e1 relacionado a um erro na fun\u00e7\u00e3o nft_verdict_init(), que permite o uso de valores positivos como c\u00f3digo de erro para rejei\u00e7\u00e3o de pacotes (DROP) em hooks, o que pode ser utilizado para chamar, na fun\u00e7\u00e3o nf_hook_slow(), uma opera\u00e7\u00e3o de libera\u00e7\u00e3o de mem\u00f3ria para um buffer que j\u00e1 havia recebido uma chamada para free(). O problema surge quando a opera\u00e7\u00e3o NF_DROP \u00e9 gerada incorretamente e o kernel inicialmente interpreta NF_DROP, mas depois libera o buffer e retorna o status NF_ACCEPT. Essa situa\u00e7\u00e3o resulta em que, apesar da libera\u00e7\u00e3o do buffer associado ao pacote, seu processamento n\u00e3o \u00e9 interrompido e \u00e9 passado para outro manipulador que, por sua vez, chama a fun\u00e7\u00e3o de libera\u00e7\u00e3o de mem\u00f3ria novamente. <\/p>\n

A vulnerabilidade aparece a partir da vers\u00e3o 3.15 do n\u00facleo Linux, mas o exploit funciona com n\u00facleos a partir da vers\u00e3o 5.14. A corre\u00e7\u00e3o da vulnerabilidade foi proposta na vers\u00e3o 6.8-rc1 do n\u00facleo Linux e, no final de fevereiro, foi integrada nas branches est\u00e1veis 5.15.149, 6.1.76 e 6.6.15. Para acompanhar a corre\u00e7\u00e3o da vulnerabilidade nos distribui\u00e7\u00f5es, podem ser visitadas as p\u00e1ginas: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

Al\u00e9m disso, pode ser destacada uma s\u00e9rie de vulnerabilidades no m\u00f3dulo ksmbd, que oferece uma implementa\u00e7\u00e3o de sistema de arquivos integrada no n\u00facleo Linux. servidor<\/a> com base no protocolo SMB: A vulnerabilidade CVE-2024-26592 permite a execu\u00e7\u00e3o remota de c\u00f3digo com privil\u00e9gios de kernel em sistemas com o m\u00f3dulo ksmbd ativado, sem autentica\u00e7\u00e3o. O problema \u00e9 causado por uma condi\u00e7\u00e3o de corrida no c\u00f3digo de manipula\u00e7\u00e3o de conex\u00f5es TCP, que ocorre devido \u00e0 falta de bloqueios adequados ao trabalhar com o objeto. <\/p>\n

A vulnerabilidade CVE-2023-52440 tamb\u00e9m permite a execu\u00e7\u00e3o remota de c\u00f3digo com privil\u00e9gios de kernel, mas \u00e9 causada por um overflow de buffer ao processar chaves de sess\u00e3o inv\u00e1lidas devido \u00e0 falta de verifica\u00e7\u00e3o adequada do tamanho dos dados recebidos do usu\u00e1rio antes de copi\u00e1-los para um buffer de tamanho fixo. <\/p>\n

As vulnerabilidades (1, 2, 3) CVE-2024-26594, CVE-2023-52442 e CVE-2023-52441 no ksmbd permitem, sem autentica\u00e7\u00e3o, a determina\u00e7\u00e3o do conte\u00fado da mem\u00f3ria do kernel. A vulnerabilidade CVE-2024-26594 \u00e9 causada pela verifica\u00e7\u00e3o incorreta de dados ao processar tokens SMB2 Mech recebidos, resultando no retorno de dados fora da \u00e1rea do buffer. A vulnerabilidade CVE-2023-52442 \u00e9 causada pela falta de verifica\u00e7\u00e3o adequada dos dados de entrada ao processar solicita\u00e7\u00f5es encadeadas. A vulnerabilidade CVE-2023-52441 \u00e9 causada pela falta de verifica\u00e7\u00e3o necess\u00e1ria dos dados de entrada ao processar solicita\u00e7\u00f5es de negocia\u00e7\u00e3o de conex\u00e3o SMB2. <\/p>\n

As vulnerabilidades CVE-2024-26594 e CVE-2024-26592 foram corrigidas no kernel 6.8 e em atualiza\u00e7\u00f5es corretivas das vers\u00f5es est\u00e1veis anteriores 6.1.75, 6.6.14, 6.7.2. As demais vulnerabilidades foram corrigidas no kernel 6.5 e nas atualiza\u00e7\u00f5es 5.15.145, 6.1.53, 6.4.16. <\/p>\n

Por fim, vale mencionar a ativa\u00e7\u00e3o de uma nova equipe de desenvolvedores do kernel Linux, criada para analisar a exist\u00eancia de vulnerabilidades e avaliar a rela\u00e7\u00e3o entre as corre\u00e7\u00f5es introduzidas no kernel e problemas de seguran\u00e7a. Em fevereiro, os desenvolvedores do kernel estabeleceram seu pr\u00f3prio servi\u00e7o CNA (CVE Numbering Authority), que recebeu a autoridade para atribuir CVE-IDs de vulnerabilidades de forma independente. Antes disso, a atribui\u00e7\u00e3o de CVEs e a an\u00e1lise da rela\u00e7\u00e3o das corre\u00e7\u00f5es com poss\u00edveis vulnerabilidades eram responsabilidade dos desenvolvedores de distribui\u00e7\u00f5es, e no kernel, as potenciais vulnerabilidades n\u00e3o eram destacadas e figuravam ao lado de corre\u00e7\u00f5es comuns. Os resultados do novo servi\u00e7o superaram todas as expectativas \u2014 diariamente, o kernel destaca at\u00e9 v\u00e1rias dezenas de novas vulnerabilidades que antes n\u00e3o eram sinalizadas como problemas de seguran\u00e7a. Por exemplo, em 26 de mar\u00e7o, novos CVE-IDs foram atribu\u00eddos a 14 vulnerabilidades que anteriormente n\u00e3o eram consideradas como problemas de seguran\u00e7a, e em 25 de mar\u00e7o \u2014 41 vulnerabilidades.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidades no n\u00facleo Linux que permitem elevar privil\u00e9gios atrav\u00e9s de nf_tables e ksmbd | ProHoster","description":"No Netfilter, uma subsistema do n\u00facleo Linux usado para filtrar e modificar pacotes de rede, foi descoberta uma vulnerabilidade (CVE-2024-1086), que permite a um usu\u00e1rio local executar c\u00f3digo no n\u00edvel do n\u00facleo e aumentar seus privil\u00e9gios.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 nf_tables \u0438 ksmbd | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-27T10:25:58+00:00","article:modified_time":"2024-03-27T10:25:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:46","updated":"2026-02-22 15:29:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=114603"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114603\/revisions"}],"predecessor-version":[{"id":162202,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114603\/revisions\/162202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/114604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=114603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=114603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=114603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}