\u00cen interfa\u021ba de intrare\/ie\u0219ire asincron\u0103 io_uring, furnizat\u0103 de nucleul Linux, a fost descoperit\u0103 o vulnerabilitate (CVE-2024-0582) care permite unui utilizator f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 drepturi de root \u00een sistem. Pentru a exploata aceast\u0103 vulnerabilitate, este suficient un acces local obi\u0219nuit la sistem, f\u0103r\u0103 a necesita manipul\u0103ri cu spa\u021biile de nume. \u00cen prezent, exist\u0103 un exploit func\u021bional disponibil public, precum \u0219i o a doua tehnic\u0103 de exploatare a vulnerabilit\u0103\u021bii care a fost detaliat\u0103. <\/p>\n
Vulnerabilitatea este cauzat\u0103 de accesarea unui bloc de memorie deja eliberat (use-after-free) \u00een subsistemul io_uring, care apare \u00een urma \u00eenregistr\u0103rii \u0219i eliber\u0103rii unui buffer circular creat cu flag-ul IORING_REGISTER_PBUF_RING. \u00cen cazul aplic\u0103rii opera\u021biei mmap() asupra buffer-ului, acesta r\u0103m\u00e2ne reflectat \u00een spa\u021biul utilizatorului dup\u0103 finalizarea opera\u021biei de eliberare (IORING_UNREGISTER_PBUF_RING). Folosind aceast\u0103 particularitate, atacatorul poate citi \u0219i scrie date \u00een paginile de memorie returnate sistemului de distribu\u021bie a memoriei kernel-ului. <\/p>\n
Problema apare \u00eencep\u00e2nd cu versiunea nucleului Linux 6.4 \u0219i a fost eliminat\u0103 \u00een versiunile 6.7 \u0219i 6.6.5, precum \u0219i \u00een pachetul nucleului 6.5.0-21, preg\u0103tit pentru Ubuntu 22.04 \u0219i 23.10. Este demn de men\u021bionat c\u0103, \u00een nucleul principal, problema a fost rezolvat\u0103 \u00een decembrie 2023, proiectul Google Zero a deschis accesul la mesajul de eroare semnaliz\u00e2nd prezen\u021ba vulnerabilit\u0103\u021bii pe 8 ianuarie, iar pachetul cu nucleul corectat 6.5 pentru Ubuntu a fost format doar pe 22 februarie 2024. \u00cen alte distribu\u021bii, urm\u0103rirea corec\u021biei \u0219i expunerii la vulnerabilitate poate fi vizualizat\u0103 pe paginile: Debian, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
Primul exploit manipuleaz\u0103 crearea unui num\u0103r mare de pagini de memorie controlate de atacator pentru a determina layout-ul de memorie \u00een kernel \u0219i accesul la paginile fizice adiacente, folosind ca far con\u021binutul unor structuri de socketuri de re\u021bea umplute \u00eentr-un mod specific. Pentru a rula codul \u00een exploit, este utilizat un \u201egadjet\u201d (o succesiune de instruc\u021biuni existente \u00een kernel), care duce la executarea func\u021biei call_usermodehelper_exec, destinat s\u0103 porneasc\u0103 procese \u00een spa\u021biul utilizatorului din kernel. <\/p>\n
Al doilea exploit se bazeaz\u0103 pe faptul c\u0103, atunci c\u00e2nd toate blocurile slab din cache sunt epuizate (de exemplu, c\u00e2nd un fi\u0219ier este deschis de mai multe ori), paginile de memorie libere la care are acces atacatorul sunt utilizate de sistemul de distribu\u021bie a memoriei pentru a crea un nou bloc slab, iar toate noile structuri de fi\u0219iere \u00eencep s\u0103 fie plasate \u00een acest bloc. Prin urmare, anumite structuri de fi\u0219iere vor ajunge \u00een paginile de memorie pe care atacatorul le poate citi \u0219i scrie. Exploatarea const\u0103 \u00een organizarea accesului la fi\u0219ierul dorit \u00een cache-ul de fi\u0219iere \u0219i \u00een modificarea c\u00e2mpului f_mode \u00een structurile de fi\u0219iere asociate, care define\u0219te drepturile de acces, ceea ce permite accesul \u00een scriere la un fi\u0219ier sistem relevant, de exemplu, \\\/etc\\passwd. \u0412 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0430\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430\/\u0432\u044b\u0432\u043e\u0434\u0430 io_uring, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u044f\u0434\u0440\u043e\u043c Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-0582), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c\u0438 \u0438\u043c\u0451\u043d. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u043c\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114696","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een subsistemul io_uring, care permite ob\u021binerea privilegiilor de root | ProHoster","description":"\u00cen interfa\u021ba de intrare\/ie\u0219ire asincron\u0103 io_uring, oferit\u0103 de kernelul Linux, a fost identificat\u0103 o vulnerabilitate (CVE-2024-0582), care permite unui utilizator neprivilegiat s\u0103 ob\u021bin\u0103 drepturi de root \u00een sistem.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-io_uring-pozvolyayushhaya-poluchit-privilegii-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 io_uring, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 root | ProHoster","og:description":"\u0412 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0430\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430\/\u0432\u044b\u0432\u043e\u0434\u0430 io_uring, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u044f\u0434\u0440\u043e\u043c Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-0582), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-io_uring-pozvolyayushhaya-poluchit-privilegii-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-01T10:25:54+00:00","article:modified_time":"2024-04-01T10:25:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114696"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114696\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"