{"id":102971,"date":"2022-01-16T03:36:38","date_gmt":"2022-01-16T01:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82"},"modified":"2022-01-16T03:36:38","modified_gmt":"2022-01-16T01:36:38","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","title":{"rendered":"O vulnerabilitate \u00een cryptsetup permite dezactivarea cript\u0103rii \u00een parti\u021biile LUKS2.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen pachetul Cryptsetup, folosit pentru criptarea parti\u021biilor de disc \u00een Linux, a fost identificat\u0103 o vulnerabilitate (CVE-2021-4122) care permite, prin modificarea metadatelor, dezactivarea cript\u0103rii \u00een parti\u021biile \u00een format LUKS2 (Linux Unified Key Setup). Pentru a exploata vulnerabilitatea, atacatorul trebuie s\u0103 aib\u0103 acces fizic la suportul criptat, adic\u0103 metoda are sens \u00een principal pentru atacuri asupra unit\u0103\u021bilor externe criptate, cum ar fi unit\u0103\u021bile Flash, la care infractorul are acces, dar nu cunoa\u0219te parola pentru decriptarea datelor. <\/p>\n

Atacul este aplicabil doar pentru formatul LUKS2 \u0219i este legat de manipularea metadatelor care r\u0103spund de activarea extensiei \u201eonline reencryption\u201d, permi\u021b\u00e2nd, atunci c\u00e2nd este necesar\u0103 schimbarea cheii de acces, ini\u021bierea procesului de recriptare a datelor \u00een fundal, f\u0103r\u0103 a opri lucrul cu parti\u021bia. Deoarece procesul de decriptare \u0219i criptare cu noua cheie dureaz\u0103 mult timp, \u201eonline reencryption\u201d ofer\u0103 posibilitatea de a nu \u00eentrerupe activitatea cu parti\u021bia, execut\u00e2nd recriptarea \u00een fundal, treptat, recript\u00e2nd datele de la o cheie la alta. De asemenea, exist\u0103 op\u021biunea de a alege o cheie \u021bint\u0103 goal\u0103, ceea ce permite transformarea parti\u021biei \u00eentr-o form\u0103 decriptat\u0103. <\/p>\n

Atacatorul poate efectua modific\u0103ri \u00een metadatele LUKS2 care simuleaz\u0103 o \u00eentrerupere de urgen\u021b\u0103 a execut\u0103rii opera\u021biei de decriptare ca urmare a unei erori \u0219i poate ob\u021bine decriptarea unei p\u0103r\u021bi a parti\u021biei dup\u0103 activarea \u0219i utilizarea dispozitivului modificat de c\u0103tre proprietar. \u00cen acest timp, utilizatorul care a conectat dispozitivul modificat \u0219i l-a deblocat cu parola corect\u0103 nu prime\u0219te nicio avertizare cu privire la desf\u0103\u0219urarea procesului de restaurare a opera\u021biei de recriptare \u00eentrerupt\u0103 \u0219i poate afla despre stadiul acestei opera\u021bii doar prin comanda \u201eluks Dump\u201d. Volumul datelor la care poate avea acces atacatorul depinde de dimensiunea antetului LUKS2, dar la dimensiunea prestabilit\u0103 (16 MiB) poate dep\u0103\u0219i 3 GB. <\/p>\n

Problema este cauzat\u0103 de faptul c\u0103, de\u0219i recriptarea necesit\u0103 calculul \u0219i verificarea hash-urilor pentru noile \u0219i vechile chei, pentru \u00eenceputul decript\u0103rii nu este necesar un hash dac\u0103 noul stadiu implic\u0103 absen\u021ba unei chei pentru criptare (plaintext). \u00cen plus, metadatele LUKS2, \u00een care este specificat algoritmul de criptare, nu sunt protejate \u00eempotriva modific\u0103rii \u00een cazul \u00een care ajung \u00een m\u00e2inile unui atacator. Pentru a bloca vulnerabilitatea, dezvoltatorii au ad\u0103ugat o protec\u021bie suplimentar\u0103 metadatelor LUKS2, pentru care acum se verific\u0103 un hash suplimentar, calculat pe baza cheilor cunoscute \u0219i a con\u021binutului metadatelor; adic\u0103 atacatorul nu mai poate modifica neobservat metadatele f\u0103r\u0103 a cunoa\u0219te parola pentru decriptare. <\/p>\n

Scenariul tipic de atac necesit\u0103 ca atacatorul s\u0103 aib\u0103 posibilitatea de a ob\u021bine de mai multe ori unitatea de stocare. La \u00eenceput, atacatorul care nu cunoa\u0219te parola de acces aduce modific\u0103ri \u00een zona de metadate, ini\u021biind decriptarea unei p\u0103r\u021bi a datelor la urm\u0103toarea activare a unit\u0103\u021bii. Apoi, unitatea este returnat\u0103 la locul ei, iar atacatorul a\u0219teapt\u0103 ca utilizatorul s\u0103 o conecteze, introduc\u00e2nd parola. \u00cen timpul activ\u0103rii dispozitivului de c\u0103tre utilizator, un proces de fundal de recriptare este lansat, \u00een cadrul c\u0103ruia o parte din datele criptate este \u00eenlocuit\u0103 cu date decriptate. Ulterior, dac\u0103 atacatorul reu\u0219e\u0219te s\u0103 ob\u021bin\u0103 din nou dispozitivul, o parte din datele de pe unitate se va afla \u00een format decriptat. <\/p>\n

Problema a fost identificat\u0103 de \u00eentre\u021bin\u0103torul proiectului cryptsetup \u0219i rezolvat\u0103 \u00een actualiz\u0103rile cryptsetup 2.4.3 \u0219i 2.3.7. Starea form\u0103rii actualiz\u0103rilor care rezolv\u0103 problema \u00een distribu\u021bii poate fi urm\u0103rit\u0103 pe aceste pagini: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. Vulnerabilitatea apare doar \u00eencep\u00e2nd cu versiunea cryptsetup 2.2.0, care a introdus suport pentru opera\u021bia \u201eonline reencryption\u201d. Ca solu\u021bie alternativ\u0103, se poate utiliza lansarea cu op\u021biunea \u201e--disable-luks2-reencryption\u201d.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2 (Linux Unified Key Setup). \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044e, \u0442.\u0435. \u043c\u0435\u0442\u043e\u0434 \u0438\u043c\u0435\u0435\u0442 \u0441\u043c\u044b\u0441\u043b \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u0438, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Flash-\u0434\u0438\u0441\u043a\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102971","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een cryptsetup care permite dezactivarea cript\u0103rii \u00een parti\u021biile LUKS2 | ProHoster","description":"\u00cen pachetul Cryptsetup, utilizat pentru criptarea parti\u021biilor de disc \u00een Linux, a fost identificat\u0103 o vulnerabilitate (CVE-2021-4122) care permite, prin modificarea metadatelor, dezactivarea cript\u0103rii \u00een parti\u021biile \u00een format LUKS2.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cryptsetup, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 LUKS2-\u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Cryptsetup, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0432 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-4122), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 LUKS2.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-cryptsetup-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%be%d1%82%d0%ba%d0%bb%d1%8e%d1%87%d0%b8%d1%82","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-01-16T01:36:38+00:00","article:modified_time":"2022-01-16T01:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102971","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-01-16 01:37:39","updated":"2022-09-28 07:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102971"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102971\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}