{"id":103489,"date":"2022-03-07T21:36:38","date_gmt":"2022-03-07T19:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya"},"modified":"2022-03-07T21:36:38","modified_gmt":"2022-03-07T19:36:38","slug":"uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","title":{"rendered":"A vulnerability in the Linux kernel allows the distortion of read-only files.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O kernel Linux a identificat o vulnerabilitate (CVE-2022-0847) care permite suprascrierea con\u021binutului cache-ului de pagin\u0103 pentru orice fi\u0219iere, inclusiv pentru cele aflate \u00een modul numai pentru citire, deschise cu flag-ul O_RDONLY sau plasate \u00een sisteme de fi\u0219iere montate \u00een modul numai pentru citire. Din punct de vedere practic, vulnerabilitatea poate fi utilizat\u0103 pentru a injecta cod \u00een procese arbitrare sau pentru a distorsiona datele din fi\u0219ierele deschise. De exemplu, este posibil s\u0103 se schimbe con\u021binutul fi\u0219ierului authorized_keys pentru procesul sshd. Un prototip de exploit este disponibil pentru testare. <\/p>\n

Problemei i s-a atribuit numele de cod Dirty Pipe, \u00een analogie cu vulnerabilitatea critic\u0103 Dirty COW identificat\u0103 \u00een 2016. Se observ\u0103 c\u0103, din punct de vedere al pericolului, Dirty Pipe se situeaz\u0103 la acela\u0219i nivel ca Dirty COW, dar este semnificativ mai u\u0219or de exploatat. Vulnerabilitatea a fost descoperit\u0103 \u00een urma analizei pl\u00e2ngerilor legate de deteriorarea periodic\u0103 a fi\u0219ierelor desc\u0103rcate prin re\u021bea pe un sistem care \u00eencarc\u0103 arhive comprimate de pe un server de logare (37 de daune \u00een 3 luni pe un sistem supus la o \u00eenc\u0103rcare mare), \u00een care a fost utilizat\u0103 opera\u021biunea splice() \u0219i canale f\u0103r\u0103 nume. <\/p>\n

Vulnerabilitatea apare \u00eencep\u00e2nd cu kernel-ul Linux 5.8, lansat \u00een august 2020, adic\u0103 este prezent \u00een Debian 11, dar nu afecteaz\u0103 kernel-ul de baz\u0103 \u00een Ubuntu 20.04 LTS. Kernel-urile RHEL 8.x \u0219i openSUSE\/SUSE 15 sunt \u00een principiu bazate pe ramuri mai vechi, dar nu este exclus ca modificarea care a provocat problema s\u0103 fi fost backportat\u0103 \u00een ele (informa\u021bii precise nu sunt disponibile deocamdat\u0103). Se poate urm\u0103ri publicarea actualiz\u0103rilor pachetelor \u00een distribu\u021bii la urm\u0103toarele pagini: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. Corectarea vulnerabilit\u0103\u021bii a fost oferit\u0103 \u00een versiunile 5.16.11, 5.15.25 \u0219i 5.10.102. Corectarea a fost, de asemenea, inclus\u0103 \u00een kernel-ul utilizat \u00een platforma Android. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de lipsa ini\u021bializ\u0103rii valorii «buf->flags» \u00een codul func\u021biilor copy_page_to_iter_pipe() \u0219i push_pipe(), av\u00e2nd \u00een vedere c\u0103 memoria alocat\u0103 pentru structur\u0103 nu este cur\u0103\u021bat\u0103, iar \u00een urma unor manevre cu canale f\u0103r\u0103 nume, \u00een «buf->flags» poate ap\u0103rea o valoare dintr-o alt\u0103 opera\u021biune. Folosind aceast\u0103 caracteristic\u0103, un utilizator local cu privilegii reduse poate ob\u021bine apari\u021bia valorii PIPE_BUF_FLAG_CAN_MERGE \u00een flag, ceea ce permite organizarea rescrierii datelor \u00een cache-ul paginilor prin simpla scriere a unor noi date \u00eentr-un canal f\u0103r\u0103 nume (pipe) preg\u0103tit \u00een prealabil. <\/p>\n

Pentru a ataca, fi\u0219ierul \u021bint\u0103 trebuie s\u0103 fie accesibil pentru citire, dat fiind c\u0103 la scrierea \u00een pipe nu se verific\u0103 drepturile de acces, substituirea \u00een cache-ul paginilor poate fi efectuat\u0103 inclusiv pentru fi\u0219iere aflate \u00een sec\u021biuni montate doar pentru citire (de exemplu, pentru fi\u0219ierele de pe CD-ROM). Dup\u0103 substituirea informa\u021biilor \u00een cache-ul paginilor, procesul la citirea datelor din fi\u0219ier va ob\u021bine datele nu cele reale, ci cele substituite. <\/p>\n

Exploatarea const\u0103 \u00een crearea unui canal f\u0103r\u0103 nume \u0219i umplerea acestuia cu date aleatorii pentru a ob\u021bine setarea flag-ului PIPE_BUF_FLAG_CAN_MERGE \u00een toate structurile circulare asociate. Ulterior, datele sunt citite din canal, dar flag-ul r\u0103m\u00e2ne setat \u00een toate instan\u021bele structurii pipe_buffer \u00een structurile circulare pipe_inode_info. Apoi se execut\u0103 apelul splice() pentru a citi datele din fi\u0219ierul \u021bint\u0103 \u00een canalul f\u0103r\u0103 nume, \u00eencep\u00e2nd de la offset-ul corect. La scrierea datelor \u00een acest canal f\u0103r\u0103 nume, din cauza set\u0103rii flag-ului PIPE_BUF_FLAG_CAN_MERGE, datele din cache-ul paginilor vor fi rescrise, \u00een loc s\u0103 se creeze o nou\u0103 instan\u021b\u0103 a structurii pipe_buffer.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0847), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c O_RDONLY \u0438\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u043f\u0440\u0438\u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f. \u0421 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438\u043b\u0438 \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103489","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een nucleul Linux, care permite distorsionarea fi\u0219ierelor disponibile doar pentru citire | ProHoster","description":"A fost identificat\u0103 o vulnerabilitate \u00een nucleul Linux (CVE-2022-0847) care permite rescrierea con\u021binutului cache-ului paginilor pentru orice fi\u0219iere, inclusiv cele aflate \u00een mod doar pentru citire, deschise cu flag-ul O_RDONLY sau amplasate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0847), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c O_RDONLY \u0438\u043b\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-07T19:36:38+00:00","article:modified_time":"2022-03-07T19:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-07 19:37:31","updated":"2022-10-03 12:20:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103489"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103489\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}