{"id":100767,"date":"2021-07-15T16:22:45","date_gmt":"2021-07-15T14:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-yadra-linux-netfilter"},"modified":"2021-07-15T16:22:45","modified_gmt":"2021-07-15T14:22:45","slug":"uyazvimost-v-podsisteme-yadra-linux-netfilter","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","title":{"rendered":"O vulnerabilitate \u00een subsistemul kernel-ului Linux Netfilter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen Netfilter, subsistemul nucleului Linux utilizat pentru filtrarea \u0219i modificarea pachetelor de re\u021bea, a fost descoperit\u0103 o vulnerabilitate (CVE-2021-22555) care permite unui utilizator local s\u0103 ob\u021bin\u0103 privilegii root \u00een sistem, inclusiv \u00een cadrul unui container izolat. A fost preg\u0103tit un prototip func\u021bional de exploit pentru a ocoli mecanismele de protec\u021bie KASLR, SMAP \u0219i SMEP. Cercet\u0103torul care a descoperit vulnerabilitatea a primit de la Google o recompens\u0103 de 20.000 de dolari pentru identificarea metodei de ocolire a izol\u0103rii containerelor Kubernetes \u00een clusterul kCTF. <\/p>\n

Problema apare \u00eencep\u00e2nd cu nucleul 2.6.19, lansat acum 15 ani, \u0219i este cauzat\u0103 de o eroare \u00een gestionarii IPT_SO_SET_REPLACE \u0219i IP6T_SO_SET_REPLACE, care duce la o dep\u0103\u0219ire a buffer-ului atunci c\u00e2nd se trimit parametrii special crea\u021bi prin apelarea setsockopt \u00een modul compatibil. \u00cen condi\u021bii normale, apelul compat_setsockopt() poate fi efectuat doar de utilizatorul root, dar privilegii necesare pentru atac pot fi ob\u021binute \u0219i de un utilizator neprivilegiat \u00een sistemele cu suport activat pentru spa\u021biile de nume ale identificatorilor de utilizator (user namespaces). <\/p>\n

Utilizatorul poate crea un container cu un utilizator root separat \u0219i poate exploata o vulnerabilitate din acesta. De exemplu, \u201euser namespaces\u201d este activat implicit \u00een Ubuntu \u0219i Fedora, dar nu este activat \u00een Debian \u0219i RHEL. Patch-ul care remediaz\u0103 vulnerabilitatea a fost acceptat \u00een kernelul Linux pe 13 aprilie. Actualiz\u0103rile pachetelor au fost deja \u00eentocmite de proiectele Debian, Arch Linux \u0219i Fedora. \u00cen Ubuntu, RHEL \u0219i SUSE, actualiz\u0103rile sunt \u00een stadiu de preg\u0103tire. <\/p>\n

Problema apare \u00een func\u021bia xt_compat_target_from_user() din cauza calculului incorect al dimensiunii memoriei atunci c\u00e2nd se salveaz\u0103 structurile nucleului dup\u0103 transformarea dintr-o reprezentare pe 32 de bi\u021bi \u00een una pe 64 de bi\u021bi. Eroarea permite scrierea a patru octe\u021bi nuli \u00een orice pozi\u021bie din afara bufferului alocat, limitat\u0103 de decalajul 0x4C. Aceast\u0103 posibilitate s-a dovedit suficient\u0103 pentru a crea un exploit care poate ob\u021bine drepturi root - prin cur\u0103\u021barea pointer-ului m_list->next din structura msg_msg, fiind create condi\u021biile pentru accesarea datelor dup\u0103 eliberarea memoriei (use-after-free), care au fost apoi utilizate pentru ob\u021binerea de informa\u021bii despre adrese \u0219i modificarea altor structuri prin manipularea cu apelul de sistem msgsnd().
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-22555), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0441\u044c \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435. \u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b KASLR, SMAP \u0438 SMEP. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u0442 Google \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435, \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 20 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0437\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100767","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een subsistemul nucleului Linux Netfilter | ProHoster","description":"\u00cen Netfilter, subsistemul nucleului Linux utilizat pentru filtrarea \u0219i modificarea pachetelor de re\u021bea, a fost identificat\u0103 o vulnerabilitate (CVE-2021-22555) care permite unui utilizator local s\u0103 ob\u021bin\u0103 privilegii root \u00een sistem.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux Netfilter | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-22555), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-15T14:22:45+00:00","article:modified_time":"2021-07-15T14:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100767","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-15 14:42:50","updated":"2022-10-01 06:19:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100767"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100767\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}