{"id":120749,"date":"2024-11-28T21:45:59","date_gmt":"2024-11-28T19:45:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root"},"modified":"2024-11-28T21:45:59","modified_gmt":"2024-11-28T19:45:59","slug":"uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","title":{"rendered":"Vulnerabilitate \u00een tuned care permite executarea codului cu drepturi de root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen procesul de fundal dezvoltat de compania Red Hat, tuned, care efectueaz\u0103 optimizarea automat\u0103 a set\u0103rilor hardware \u0219i a nucleului \u00een func\u021bie de sarcina curent\u0103, a fost identificat\u0103 o vulnerabilitate (CVE-2024-52336) care permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 execute orice comenzi cu drepturi de root. <\/p>\n

Problema const\u0103 \u00een implementarea metodei DBus \u201ecom.redhat.tuned.instance_create\u201d, utilizat\u0103 pentru crearea instan\u021belor pluginurilor, \u00een care pot fi transmise parametrii \u201escript_pre\u201d \u0219i \u201escript_post\u201d pentru a specifica scripturile care se execut\u0103 \u00eenainte sau dup\u0103 crearea instan\u021bei pluginului. Problema este c\u0103 set\u0103rile Polkit permit oric\u0103rui utilizator local conectat la sistem, f\u0103r\u0103 autentificare, s\u0103 trimit\u0103 o solicitare DBus la aceast\u0103 metod\u0103, \u00een timp ce procesul tuned ruleaz\u0103 cu privilegii root \u0219i execut\u0103 scripturile specificate \u00een parametrii \u201escript_pre\u201d \u0219i \u201escript_post\u201d tot cu privilegii root. De exemplu, pentru a rula scriptul \/path\/to\/myscript.sh cu privilegii root, utilizatorul trebuie doar s\u0103 execute comanda: gdbus call -y -d com.redhat.tuned -o \/Tuned \\ -m com.redhat.tuned.control.instance_create cpu myinstance \\ \u2018{\u201escript_pre\u201d: \u201e\/path\/to\/myscript.sh\u201d, \u201edevices\u201d: \u201e*\u201d}\u2019 <\/p>\n

\u00cen metoda DBus \u201ecom.redhat.tuned.instance_create\u201d exist\u0103, de asemenea, o vulnerabilitate mai pu\u021bin periculoas\u0103 (CVE-2024-52337), cauzat\u0103 de absen\u021ba cur\u0103\u021b\u0103rii valorii numelui instan\u021bei pluginului atunci c\u00e2nd este afi\u0219at\u0103 \u00een jurnal. Atacatorul poate ad\u0103uga un nume care con\u021bine un caracter de sf\u00e2r\u0219it de linie \u0219i caractere escape pentru emulatorul de terminal, care pot fi utilizate pentru a compromite structura jurnalului \u0219i a efectua ac\u021biuni la afi\u0219area ie\u0219irii comenzii \u201etuned-adm get_instances\u201d \u00een terminal. EVIL=`echo -e \u201ethis is\\nevil\\033[?1047h\u201d` gdbus call -y -d com.redhat.tuned -o \/Tuned -m com.redhat.tuned.control.instance_create cpu \u201e$EVIL\u201d \u2018{\u201edevices\u201d: \u201e*\u201d}\u2019 <\/p>\n

Vulnerabilit\u0103\u021bile se manifest\u0103 \u00eencep\u00e2nd cu versiunea tuned 2.23, lansat\u0103 la \u00eenceputul lunii iunie 2024, \u0219i au fost remediate \u00een versiunea tuned 2.24.1. Din distribu\u021biile mari, problemele au fost corectate \u00een RHEL 9, Fedora 40, Arch Linux \u0219i Gentoo. \u00cen versiunile stabile ale Ubuntu, Debian \u0219i SUSE\/openSUSE, vulnerabilit\u0103\u021bile nu se manifest\u0103, deoarece acestea includ versiuni mai vechi de tuned (<2.23), care nu sunt afectate de vulnerabilit\u0103\u021bi.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Red Hat \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 tuned, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0435\u043c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u044f\u0434\u0440\u0430 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0442\u0435\u043a\u0443\u0449\u0435\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-52336), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043b\u044e\u0431\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 DBus-\u043c\u0435\u0442\u043e\u0434\u0430 «com.redhat.tuned.instance_create», \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b «script_pre» \u0438 «script_post» \u0434\u043b\u044f \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120749","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een tuned care permite executarea codului cu drepturi de root | ProHoster","description":"\u00cen procesul de fundal dezvoltat de compania Red Hat, tuned, care efectueaz\u0103 optimizarea automat\u0103 a set\u0103rilor hardware \u0219i a nucleului \u00een func\u021bie de sarcina curent\u0103, a fost identificat\u0103 o vulnerabilitate (CVE-2024-52336) care permite.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 tuned, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Red Hat \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 tuned, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0435\u043c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u044f\u0434\u0440\u0430 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0442\u0435\u043a\u0443\u0449\u0435\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-52336), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-11-28T19:45:59+00:00","article:modified_time":"2024-11-28T19:45:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120749","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:22:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:22:22","updated":"2026-01-23 08:22:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=120749"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120749\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=120749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=120749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=120749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}