Foi identificada uma vulnerabilidade na interface de entrada\/sa\u00edda ass\u00edncrona io_uring, fornecida pelo n\u00facleo Linux (CVE-2024-0582), que permite que um usu\u00e1rio n\u00e3o privilegiado obtenha direitos de root no sistema. Para explorar a vulnerabilidade, \u00e9 suficiente ter acesso local comum ao sistema, sem necessidade de manipula\u00e7\u00f5es com espa\u00e7os de nomes. Atualmente, um exploit funcional est\u00e1 publicamente dispon\u00edvel e uma segunda t\u00e9cnica de explora\u00e7\u00e3o da vulnerabilidade est\u00e1 detalhada. <\/p>\n
A vulnerabilidade \u00e9 causada por um acesso a um bloco de mem\u00f3ria que j\u00e1 foi liberado (use-after-free) no subsistema io_uring, ocorrendo durante o registro e libera\u00e7\u00e3o de um buffer de anel criado com a flag IORING_REGISTER_PBUF_RING. Em situa\u00e7\u00f5es onde a opera\u00e7\u00e3o mmap() \u00e9 aplicada ao buffer, ele continua refletido no espa\u00e7o do usu\u00e1rio ap\u00f3s a execu\u00e7\u00e3o da opera\u00e7\u00e3o de libera\u00e7\u00e3o (IORING_UNREGISTER_PBUF_RING). Usando essa caracter\u00edstica, um atacante pode ler e gravar dados nas p\u00e1ginas de mem\u00f3ria retornadas pelo sistema de gerenciamento de mem\u00f3ria do n\u00facleo. <\/p>\n
O problema surgiu a partir do lan\u00e7amento do n\u00facleo Linux 6.4 e foi corrigido nas vers\u00f5es 6.7 e 6.6.5, assim como no pacote com o n\u00facleo 6.5.0-21, preparado para Ubuntu 22.04 e 23.10. \u00c9 not\u00e1vel que no n\u00facleo principal o problema foi corrigido em dezembro de 2023, o projeto Google Zero divulgou um aviso sobre a exist\u00eancia da vulnerabilidade em 8 de janeiro, e o pacote com o n\u00facleo corrigido 6.5 para Ubuntu foi formado apenas em 22 de fevereiro de 2024. Em outras distribui\u00e7\u00f5es, pode-se acompanhar a corre\u00e7\u00e3o e a vulnerabilidade nas p\u00e1ginas: Debian, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
O primeiro exploit manipula a cria\u00e7\u00e3o de um grande n\u00famero de p\u00e1ginas de mem\u00f3ria controladas pelo atacante para determinar o layout de mem\u00f3ria no kernel e acessar p\u00e1ginas de mem\u00f3ria f\u00edsicas adjacentes, usando como far\u00f3is o conte\u00fado de estruturas de sockets de rede preenchidas de forma espec\u00edfica. Para executar o c\u00f3digo no exploit, \u00e9 utilizado um \"gadget\" (uma sequ\u00eancia de instru\u00e7\u00f5es existentes no kernel), que leva \u00e0 execu\u00e7\u00e3o da fun\u00e7\u00e3o call_usermodehelper_exec, destinada a iniciar processos no espa\u00e7o do usu\u00e1rio a partir do kernel. <\/p>\n
O segundo exploit se baseia no fato de que, quando todos os blocos de slab no cache se esgotam (por exemplo, ao abrir um arquivo v\u00e1rias vezes), p\u00e1ginas de mem\u00f3ria livres, \u00e0s quais o atacante ainda tem acesso, s\u00e3o utilizadas pelo sistema de aloca\u00e7\u00e3o de mem\u00f3ria para criar um novo bloco de slab e todas as novas estruturas de arquivos come\u00e7am a ser alocadas nesse bloco. Assim, algumas estruturas de arquivos acabar\u00e3o em p\u00e1ginas de mem\u00f3ria que o atacante pode ler e escrever. A explora\u00e7\u00e3o se resume em organizar a inser\u00e7\u00e3o do arquivo desejado no cache de arquivos e substituir, nas estruturas de arquivos associadas, o campo f_mode que determina os direitos de acesso, permitindo que um arquivo de sistema cr\u00edtico, como \/etc\/passwd, se torne grav\u00e1vel. \u0412 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0430\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430\/\u0432\u044b\u0432\u043e\u0434\u0430 io_uring, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u044f\u0434\u0440\u043e\u043c Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-0582), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c\u0438 \u0438\u043c\u0451\u043d. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u043c\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114696","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidade no subsistema io_uring que permite obter privil\u00e9gios de root | ProHoster","description":"Uma vulnerabilidade (CVE-2024-0582) foi identificada na interface de entrada\/sa\u00edda ass\u00edncrona io_uring, fornecida pelo n\u00facleo do Linux, que permite a um usu\u00e1rio n\u00e3o privilegiado obter direitos de root no sistema.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-podsisteme-io_uring-pozvolyayushhaya-poluchit-privilegii-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 io_uring, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root | ProHoster","og:description":"\u0412 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0430\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430\/\u0432\u044b\u0432\u043e\u0434\u0430 io_uring, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u044f\u0434\u0440\u043e\u043c Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-0582), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-podsisteme-io_uring-pozvolyayushhaya-poluchit-privilegii-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-01T10:25:54+00:00","article:modified_time":"2024-04-01T10:25:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=114696"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114696\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=114696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=114696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=114696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"