{"id":114603,"date":"2024-03-27T12:25:57","date_gmt":"2024-03-27T10:25:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd"},"modified":"2024-03-27T12:25:57","modified_gmt":"2024-03-27T10:25:58","slug":"uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een nucleul Linux care permit cre\u0219terea privilegiilor prin nf_tables \u0219i ksmbd.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen Netfilter, subsistemul kernel-ului Linux utilizat pentru filtrarea \u0219i modificarea pachetelor de re\u021bea, a fost descoperit\u0103 o vulnerabilitate (CVE-2024-1086) care permite unui utilizator local s\u0103 execute cod la nivel de kernel \u0219i s\u0103 \u00ee\u0219i creasc\u0103 privilegii \u00een sistem. Problema este cauzat\u0103 de o eliberare dubl\u0103 de memorie (double-free) \u00een modulul nf_tables, care asigur\u0103 func\u021bionarea filtrului de pachete nftables. Cercet\u0103torul \u00een securitate care a descoperit vulnerabilitatea a dezvoltat \u0219i publicat un prototip de exploat. <\/p>\n

Func\u021bionarea exploit-ului a fost demonstrat\u0103 \u00een versiunile actuale ale Debian \u0219i Ubuntu cu kerneluri Linux 5.14 \u2014 6.6, precum \u0219i \u00een medii cu kernel KernelCTF (Capture the Flag), care include patch-uri suplimentare pentru blocarea metodelor tipice de func\u021bionare a exploit-urilor \u0219i care este utilizat de Google \u00een programul s\u0103u de recompense pentru descoperirea vulnerabilit\u0103\u021bilor. Rata de succes a exploit-ului este evaluat\u0103 la 99.4%. \u00cen articolul de \u00eenso\u021bire, este analizat \u00een detaliu procesul de creare a unui exploit complex \u00een mai multe niveluri \u0219i modul de ocolire a mecanismelor de protec\u021bie \u0219i de contracarare a exploit-urilor prezente \u00een kernel.

\"Vulnerabilit\u0103\u021bi<\/center> <\/p>\n

Problema este legat\u0103 de o eroare \u00een func\u021bia nft_verdict_init(), care permite utilizarea valorilor pozitive ca \u0219i coduri de eroare pentru respingerea pachetelor (DROP) \u00een hook-uri, ceea ce poate fi folosit pentru a provoca \u00een func\u021bia nf_hook_slow() o a doua opera\u021biune de eliberare de memorie pentru un buffer care deja a fost eliberat. Problema apare atunci c\u00e2nd opera\u021bia NF_DROP este generat\u0103 cu o eroare \u0219i kernel-ul interpreteaz\u0103 ini\u021bial NF_DROP, dar apoi elibereaz\u0103 buffer-ul \u0219i returneaz\u0103 statutul NF_ACCEPT. Aceast\u0103 situa\u021bie duce la faptul c\u0103, \u00een ciuda eliber\u0103rii buffer-ului asociat pachetului, procesarea sa nu se opre\u0219te, ci este transmis\u0103 unui alt handler care, la r\u00e2ndul s\u0103u, a doua oar\u0103 apeleaz\u0103 func\u021bia de eliberare a memoriei. <\/p>\n

Vulnerabilitatea se manifest\u0103 \u00eencep\u00e2nd cu versiunea kernel-ului Linux 3.15, dar exploatul func\u021bioneaz\u0103 cu kernel-uri \u00eencep\u00e2nd cu versiunea 5.14. Repararea vulnerabilit\u0103\u021bii a fost propus\u0103 \u00een lansarea kernel-ului Linux 6.8-rc1 \u0219i, la sf\u00e2r\u0219itul lunii februarie, a fost transferat\u0103 \u00een ramurile stabile 5.15.149, 6.1.76 \u0219i 6.6.15. \u00cen distribu\u021biile de Linux, se poate urm\u0103ri corectarea vulnerabilit\u0103\u021bii pe paginile: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n

De asemenea, se poate men\u021biona o serie de vulnerabilit\u0103\u021bi \u00een modulul ksmbd, care ofer\u0103 o implementare \u00eencorporat\u0103 \u00een kernel-ul Linux a unui sistem de fi\u0219iere. server<\/a> bazat pe protocolul SMB: Vulnerabilitatea CVE-2024-26592 permite executarea codului la distan\u021b\u0103 f\u0103r\u0103 autentificare cu privilegii de kernel pe sistemele cu modulul ksmbd activat. Problema este cauzat\u0103 de o condi\u021bie de rivalitate \u00een codul de procesare a conexiunilor TCP, care apare din lipsa bloc\u0103rilor adecvate atunci c\u00e2nd se lucreaz\u0103 cu obiectul. <\/p>\n

Vulnerabilitatea CVE-2023-52440 permite, de asemenea, executarea codului la distan\u021b\u0103 cu privilegii de kernel, dar este cauzat\u0103 de un overflow de buffer \u00een procesarea cheilor de sesiune incorecte din lipsa unei verific\u0103ri corespunz\u0103toare a dimensiunii datelor primite de la utilizator \u00eenainte de a fi copiate \u00een bufferul de dimensiune fix\u0103. <\/p>\n

Vulnerabilit\u0103\u021bile (1, 2, 3) CVE-2024-26594, CVE-2023-52442 \u0219i CVE-2023-52441 \u00een ksmbd permit determinarea con\u021binutului memoriei kernel-ului la distan\u021b\u0103 f\u0103r\u0103 autentificare. Vulnerabilitatea CVE-2024-26594 este cauzat\u0103 de o verificare incorect\u0103 a datelor la procesarea token-urilor SMB2 Mech primite, ceea ce duce la returnarea datelor dincolo de buffer. Vulnerabilitatea CVE-2023-52442 este cauzat\u0103 de lipsa unei verific\u0103ri corespunz\u0103toare a datelor de intrare \u00een procesarea cererilor legate \u00een lan\u021b (chained). Vulnerabilitatea CVE-2023-52441 este cauzat\u0103 de lipsa unei verific\u0103ri necesare a datelor de intrare \u00een procesarea cererilor de negociere a conexiunii SMB2. <\/p>\n

Vulnerabilit\u0103\u021bile CVE-2024-26594 \u0219i CVE-2024-26592 au fost remediate \u00een kernelul 6.8 \u0219i \u00een actualiz\u0103rile corective ale versiunilor stabile anterioare 6.1.75, 6.6.14, 6.7.2. Celelalte vulnerabilit\u0103\u021bi au fost remediate \u00een kernelul 6.5 \u0219i \u00een actualiz\u0103rile 5.15.145, 6.1.53, 6.4.16. <\/p>\n

\u00cen concluzie, se poate men\u021biona activarea unei noi echipe de dezvoltatori ai kernel-ului Linux, creat\u0103 pentru analiza vulnerabilit\u0103\u021bilor \u0219i evaluarea conexiunii \u00eentre corec\u021biile aduse \u00een kernel \u0219i problemele de securitate. \u00cen februarie, dezvoltatorii kernel-ului au creat un serviciu propriu CNA (CVE Numbering Authority), care a primit autoritatea de a atribui CVE-uri vulnerabilit\u0103\u021bilor \u00een mod independent. P\u00e2n\u0103 atunci, atribuirea CVE \u0219i analiza conexiunii corec\u021biilor cu posibilele vulnerabilit\u0103\u021bi se aflau \u00een sarcina dezvoltatorilor de distribu\u021bii, iar vulnerabilit\u0103\u021bile poten\u021biale nu erau eviden\u021biate \u0219i figurau laolalt\u0103 cu corec\u021biile obi\u0219nuite. Rezultatele muncii noului serviciu au dep\u0103\u0219it toate a\u0219tept\u0103rile \u2014 zilnic, \u00een kernel sunt marcate p\u00e2n\u0103 la c\u00e2teva zeci de noi vulnerabilit\u0103\u021bi care anterior nu fuseser\u0103 semnalate ca probleme de securitate. De exemplu, pe 26 martie au fost atribuite noi CVE-uri pentru 14 vulnerabilit\u0103\u021bi care anterior nu fuseser\u0103 considerate probleme de securitate, iar pe 25 martie \u2014 41 de vulnerabilit\u0103\u021bi.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 (double-free) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 nf_tables, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0431\u043e\u0442\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u0103\u021bi \u00een nucleul Linux care permit cre\u0219terea privilegiilor prin nf_tables \u0219i ksmbd | ProHoster","description":"\u00cen Netfilter, subsistemul nucleului Linux folosit pentru filtrarea \u0219i modificarea pachetelor de re\u021bea, a fost identificat\u0103 o vulnerabilitate (CVE-2024-1086) care permite unui utilizator local s\u0103 execute cod la nivel de nucleu \u0219i s\u0103 \u00ee\u0219i creasc\u0103 privilegii.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 nf_tables \u0438 ksmbd | ProHoster","og:description":"\u0412 Netfilter, \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1086), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-yadre-linux-pozvolyayushhie-podnyat-svoi-privilegii-cherez-nf_tables-i-ksmbd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-27T10:25:58+00:00","article:modified_time":"2024-03-27T10:25:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:46","updated":"2026-02-22 15:29:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114603"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114603\/revisions"}],"predecessor-version":[{"id":162202,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114603\/revisions\/162202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/114604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}