{"id":101712,"date":"2021-10-21T10:22:53","date_gmt":"2021-10-21T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux"},"modified":"2021-10-21T10:22:53","modified_gmt":"2021-10-21T08:22:53","slug":"raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","title":{"rendered":"Tehnica de exploatare a vulnerabilit\u0103\u021bii \u00een subsistemul tty al kernel-ului Linux a fost dezv\u0103luit\u0103.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la echipa Google Project Zero au publicat o metod\u0103 de exploatare a vulnerabilit\u0103\u021bii (CVE-2020-29661) \u00een implementarea gestionatorului ioctl TIOCSPGRP din sub-sistemul tty al nucleului Linux, precum \u0219i au analizat \u00een detaliu mecanismele de protec\u021bie care ar putea bloca astfel de vulnerabilit\u0103\u021bi. <\/p>\n

Eroarea problematic\u0103 a fost corectat\u0103 \u00een nucleul Linux pe 3 decembrie anul trecut. Problema se manifest\u0103 \u00een nucleele p\u00e2n\u0103 la versiunea 5.9.13, dar majoritatea distribu\u021biilor au remediat problema \u00een actualiz\u0103rile de pachete cu nucleu propuse anul trecut (Debian, RHEL, SUSE, Ubuntu, Fedora, Arch). O vulnerabilitate similar\u0103 (CVE-2020-29660) a fost g\u0103sit\u0103 \u00een implementarea apelului ioctl TIOCGSID, dar aceasta a fost de asemenea remediat\u0103 pe scar\u0103 larg\u0103. <\/p>\n

Problema este generat\u0103 de o eroare \u00een stabilirea blocajelor, care duce la o stare de competi\u021bie \u00een codul drivers\/tty\/tty_jobctrl.c \u0219i a fost exploatat\u0103 pentru a crea condi\u021bii de accesarea memoriei dup\u0103 eliberare (use-after-free), exploatabile din spa\u021biul utilizatorului prin manipularea apelului ioctl TIOCSPGRP. Un exploit func\u021bional a fost demonstrat pentru cre\u0219terea privilegiilor \u00een Debian 10 cu nucleul 4.19.0-13-amd64. <\/p>\n

\u00cen articolul publicat, accentul nu este pus at\u00e2t pe tehnica de creare a unui exploit func\u021bional, ci pe ce instrumente exist\u0103 \u00een nucleu pentru a proteja \u00eempotriva unor astfel de vulnerabilit\u0103\u021bi. Concluzia este descurajant\u0103, metode precum segmentarea memoriei \u00een heap \u0219i controlul accesului la memorie dup\u0103 eliberare nu sunt utilizate de fapt, deoarece duc la sc\u0103deri de performan\u021b\u0103, iar protec\u021bia bazat\u0103 pe CFI (Control Flow Integrity), care blocheaz\u0103 exploiturile \u00een stadiile t\u00e2rzii ale atacului, necesit\u0103 \u00eembun\u0103t\u0103\u021biri. <\/p>\n

C\u00e2nd se consider\u0103 ce ar putea schimba situa\u021bia pe termen lung, se subliniaz\u0103 utilizarea analizatorilor statici avansa\u021bi sau folosirea unor limbaje care asigur\u0103 un management sigur al memoriei, precum Rust \u0219i dialecte ale limbii C cu anota\u021bii extinse (de exemplu, Checked C), \u00een etapa de compilare, care verific\u0103 starea blocajelor, obiectelor \u0219i pointerilor. Printre metodele de protec\u021bie se men\u021bioneaz\u0103 activarea modului panic_on_oops, trecerea structurilor nucleului \u00een mod doar pentru citire \u0219i limitarea accesului la apelurile de sistem prin mecanisme precum seccomp.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-29661) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ioctl-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 TIOCSPGRP \u0438\u0437 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u044f\u0434\u0440\u0430 Linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u044f\u0434\u0440\u0435 Linux \u0435\u0449\u0451 3 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u044f\u0434\u0440\u0430\u0445 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.9.13, \u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101712","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tehnica de exploatare a vulnerabilit\u0103\u021bii \u00een subsistemul tty al nucleului Linux a fost dezv\u0103luit\u0103 | ProHoster","description":"Cercet\u0103torii echipei Google Project Zero au publicat o metod\u0103 de exploatare a vulnerabilit\u0103\u021bii (CVE-2020-29661) \u00een implementarea handler-ului ioctl TIOCSPGRP din subsistemul tty al nucleului Linux \u0219i au analizat \u00een detaliu mecanismele.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-29661) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ioctl-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 TIOCSPGRP \u0438\u0437 tty-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u044f\u0434\u0440\u0430 Linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-21T08:22:53+00:00","article:modified_time":"2021-10-21T08:22:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101712","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-21 08:23:00","updated":"2022-09-28 02:15:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101712"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101712\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}