{"id":104680,"date":"2022-07-21T09:36:51","date_gmt":"2022-07-21T07:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown"},"modified":"2022-07-21T09:36:51","modified_gmt":"2022-07-21T07:36:51","slug":"uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","title":{"rendered":"O vulnerabilitate \u00een nucleul Linux, care permite ocolirea restric\u021biilor modului Lockdown","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O vulnerabilitate a fost descoperit\u0103 \u00een kernelul Linux (CVE-2022-21505), care permite ocolirea u\u0219oar\u0103 a mecanismului de protec\u021bie Lockdown, ce limiteaz\u0103 accesul utilizatorului root la kernel \u0219i blocheaz\u0103 c\u0103ile de ocolire a UEFI Secure Boot. Pentru a ocoli, se propune utilizarea subsistemului IMA (Integrity Measurement Architecture) al kernelului, care este destinat verific\u0103rii integrit\u0103\u021bii componentelor sistemului de operare prin semn\u0103turi digitale \u0219i hash-uri. <\/p>\n

\u00cen modul lockdown, accesul la \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, modul de depanare kprobes, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), anumite interfe\u021be ACPI \u0219i registrele MSR ale CPU-ului este restric\u021bionat, iar apelurile kexec_file \u0219i kexec_load sunt blocate. De asemenea, trecerea \u00een modul de repaus este interzis\u0103, utilizarea DMA pentru dispozitivele PCI este limitat\u0103, importul codului ACPI din variabilele EFI este interzis, iar manipul\u0103rile cu porturile de intrare\/ie\u0219ire, inclusiv modificarea num\u0103rului de \u00eentrerupere \u0219i a portului de intrare\/ie\u0219ire pentru portul serial, sunt interzise. <\/p>\n

Vulnerabilitatea const\u0103 \u00een faptul c\u0103, atunci c\u00e2nd se utilizeaz\u0103 parametrul de \u00eenc\u0103rcare «ima_appraise=log», este permis\u0103 apelarea kexec pentru a \u00eenc\u0103rca o nou\u0103 copie a kernelului, dac\u0103 \u00een sistem nu este activat modul Secure Boot \u0219i modul Lockdown este folosit separat de acesta. IMA nu permite activarea modului «ima_appraise» atunci c\u00e2nd Secure Boot este activ, dar nu ia \u00een considerare posibilitatea utiliz\u0103rii Lockdown separat de Secure Boot.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-21505), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u0435\u0433\u043a\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u0414\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u044f\u0434\u0440\u0430 IMA (Integrity Measurement Architecture), \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0445\u044d\u0448\u0430\u043c. \u0412 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \/dev\/mem, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104680","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilitate \u00een kernelul Linux, care permite ocolirea restric\u021biilor modulului Lockdown | ProHoster","description":"O vulnerabilitate a fost descoperit\u0103 \u00een kernelul Linux (CVE-2022-21505), care permite ocolirea u\u0219oar\u0103 a mecanismului de protec\u021bie Lockdown, ce limiteaz\u0103 accesul utilizatorului root la kernel \u0219i blocheaz\u0103 c\u0103ile de ocolire a UEFI Secure Boot.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0436\u0438\u043c\u0430 Lockdown | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-21505), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u0435\u0433\u043a\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-pozvolyayushhaya-obojti-ogranicheniya-rezhima-lockdown","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-21T07:36:51+00:00","article:modified_time":"2022-07-21T07:36:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104680","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-21 07:37:49","updated":"2022-09-28 19:29:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=104680"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104680\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=104680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=104680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=104680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}