{"id":107498,"date":"2023-03-24T12:48:20","date_gmt":"2023-03-24T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=107498"},"modified":"2023-03-24T20:21:30","modified_gmt":"2023-03-24T18:21:30","slug":"uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"Vulnerabilitate \u00een OverlayFS care permite escaladarea privilegiilor.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>O vulnerabilitate (CVE-2023-0386) a fost identificat\u0103 \u00een nucleul Linux \u00een implementarea sistemului de fi\u0219iere OverlayFS, care poate fi utilizat\u0103 pentru a ob\u021bine acces root pe sistemele care au instalat subsistemul FUSE \u0219i permit montarea parti\u021biilor OverlayFS de c\u0103tre utilizatori neprivilegia\u021bi (\u00eencep\u00e2nd cu nucleul Linux 5.11, cu activarea spa\u021biilor de nume pentru utilizatori neprivilegia\u021bi). Problema a fost rezolvat\u0103 \u00een ramura nucleului 6.2. Publica\u021bia actualiz\u0103rilor pachetelor \u00een distribu\u021bii poate fi urm\u0103rit\u0103 pe paginile: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch.           <\/p>\n<p>Atacul este realizat prin copierea fi\u0219ierelor cu flag-urile setgid\/setuid dintr-o parti\u021bie montat\u0103 \u00een modul nosuid, \u00een partici\u021bia OverlayFS, care are un strat asociat cu o parti\u021bie care permite executarea fi\u0219ierelor suid. Vulnerabilitatea este similar\u0103 cu problema CVE-2021-3847, identificat\u0103 \u00een 2021, dar cu cerin\u021be de exploatare mai reduse \u2014 \u00een vechea problem\u0103 erau necesare manipul\u0103ri cu xattrs, care sunt restric\u021bionate la utilizarea spa\u021biilor de nume de identificatori de utilizator (user namespace), iar \u00een noua problem\u0103 sunt utilizate bit-urile setgid\/setuid, care nu sunt tratate special \u00een user namespace.    <\/p>\n<p>Algoritmul pentru realizarea atacului:  <\/p>\n<ul>\n<li class=\"l\"> Un sistem de fi\u0219iere este montat folosind subsistemul FUSE, \u00een care exist\u0103 un fi\u0219ier executabil apar\u021bin\u00e2nd utilizatorului root cu flag-urile setuid\/setgid, disponibil pentru to\u021bi utilizatorii pentru scriere. La montare, FUSE seteaz\u0103 modul \u201enosuid\u201d.\n<li class=\"l\"> Se anuleaz\u0103 (unshare) spa\u021biile de nume pentru utilizatori \u0219i punctele de montare (user\/mount namespace).\n<li class=\"l\"> OverlayFS este montat specific\u00e2nd sistemul de fi\u0219iere creat anterior \u00een FUSE ca strat inferior \u0219i un strat superior bazat pe un director care permite scrierea. Directorul stratului superior trebuie s\u0103 fie situat \u00eentr-un sistem de fi\u0219iere care nu folose\u0219te flag-ul \u201enosuid\u201d la montare.\n<li class=\"l\"> Pentru fi\u0219ierul suid din sectiunea FUSE, se schimb\u0103 timpul de modificare cu utilitarul touch, ceea ce duce la copierea acestuia \u00een stratul superior al OverlayFS.\n<li class=\"l\"> La copiere, nucleul nu elimin\u0103 flag-urile setgid\/setuid, ceea ce duce la faptul c\u0103 fi\u0219ierul apare \u00een parti\u021bia care permite prelucrarea setgid\/setuid.\n<li class=\"l\"> Pentru a ob\u021bine drepturi root, este suficient s\u0103 se execute fi\u0219ierul cu flag-urile setgid\/setuid din directorul ata\u0219at la stratul superior al OverlayFS.  <\/ul>\n<p>De asemenea, se poate men\u021biona c\u0103 cercet\u0103torii din echipa Google Project Zero au dezv\u0103luit informa\u021bii despre trei vulnerabilit\u0103\u021bi care au fost remediate \u00een ramura principal\u0103 a nucleului Linux 5.15, dar care nu au fost transferate \u00een pachetele cu nucleul din RHEL 8.x\/9.x \u0219i CentOS Stream 9.  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-1252 \u2014 accesarea unei zone de memorie deja eliberate \u00een structura ovl_aio_req \u00een timpul efectu\u0103rii simultane a mai multor opera\u021biuni \u00eentr-un OverlayFS desf\u0103\u0219urat deasupra sistemului de fi\u0219iere Ext4. Vulnerabilitatea permite, \u00een mod poten\u021bial, cre\u0219terea privilegiilor \u00een sistem.\n<li class=\"l\"> CVE-2023-0590 \u2014 accesarea unei zone de memorie deja eliberate \u00een func\u021bia qdisc_graft(). Se presupune c\u0103 exploatarea se limiteaz\u0103 la o c\u0103dere nea\u0219teptat\u0103.\n<li class=\"l\"> CVE-2023-1249 \u2014 accesarea unei zone de memorie deja eliberate \u00een codul de scriere coredump, care apare din cauza unei apeluri omise mmap_lock \u00een file_files_note. Se consider\u0103 c\u0103 exploatarea se limiteaz\u0103 la o c\u0103dere nea\u0219teptat\u0103.    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58857\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 OverlayFS \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c (\u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u044f\u0434\u0440\u0430 Linux 5.11 \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 user namespace). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0442\u043a\u0435 \u044f\u0434\u0440\u0430 6.2. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107498","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OverlayFS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-03-24T10:48:20+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-24T18:21:30+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een OverlayFS, care permite cre\u0219terea privilegiilor | ProHoster","description":"O vulnerabilitate a fost identificat\u0103 \u00een nucleul Linux \u00een implementarea sistemului de fi\u0219iere OverlayFS (CVE-2023-0386), care poate fi utilizat\u0103 pentru a ob\u021bine acces root pe sistemele care au instalat\u0103 subsistemul FUSE \u0219i este permis.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OverlayFS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-24T10:48:20+00:00","article:modified_time":"2023-03-24T18:21:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/107498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=107498"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/107498\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=107498"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=107498"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=107498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}