{"id":99421,"date":"2021-03-13T22:22:39","date_gmt":"2021-03-13T20:22:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii"},"modified":"2021-03-13T22:22:39","modified_gmt":"2021-03-13T20:22:40","slug":"uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","title":{"rendered":"O vulnerabilitate \u00een subsistemul iSCSI al nucleului Linux permite cre\u0219terea privilegiilor","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O vulnerabilitate (CVE-2021-27365) a fost descoperit\u0103 \u00een codul subsistemului iSCSI din nucleul Linux, care permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 execute cod la nivelul nucleului \u0219i s\u0103 ob\u021bin\u0103 privilegii root \u00een sistem. Un prototip func\u021bional al exploatului este disponibil pentru testare. Vulnerabilitatea a fost corectat\u0103 \u00een actualiz\u0103rile nucleului Linux 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260 \u0219i 4.4.260. Actualiz\u0103rile pachetelor cu nucleul sunt disponibile \u00een distribu\u021biile Debian, Ubuntu, SUSE\/openSUSE, Arch Linux \u0219i Fedora. Corec\u021biile pentru RHEL nu au fost \u00eenc\u0103 publicate. <\/p>\n

Problema este cauzat\u0103 de o eroare \u00een func\u021bia iscsi_host_get_param() din modulul libiscsi, introdus\u0103 \u00een 2006 \u00een timpul dezvolt\u0103rii subsistemului iSCSI. Din cauza lipsei unor verific\u0103ri adecvate ale dimensiunii, anumite atribute de tip string iSCSI, cum ar fi hostname sau username, pot dep\u0103\u0219i valoarea PAGE_SIZE (4 KB). Vulnerabilitatea poate fi exploatat\u0103 prin trimiterea de mesaje Netlink de c\u0103tre un utilizator f\u0103r\u0103 privilegii, stabilind atributele iSCSI la valori care dep\u0103\u0219esc PAGE_SIZE. \u00cen timpul citirii acestor date atribuite prin sysfs sau seqfs, se activeaz\u0103 codul care trimite atributele \u00een func\u021bia sprintf pentru a le copia \u00eentr-un buffer cu dimensiunea PAGE_SIZE. <\/p>\n

Exploatarea vulnerabilit\u0103\u021bii \u00een distribu\u021bii depinde de suportul pentru \u00eenc\u0103rcarea automat\u0103 a modulului nucleului scsi_transport_iscsi atunci c\u00e2nd se \u00eencearc\u0103 crearea unui socket NETLINK_ISCSI. \u00cen distribu\u021biile \u00een care acest modul se \u00eencarc\u0103 automat, atacul poate fi realizat indiferent de utilizarea func\u021bionalit\u0103\u021bii iSCSI. Totu\u0219i, pentru aplicarea cu succes a exploatului, este necesar\u0103 \u00eenregistrarea a cel pu\u021bin unui transport iSCSI. \u00cen acest scop, se poate folosi modulul nucleului ib_iser, care se \u00eencarc\u0103 automat atunci c\u00e2nd un utilizator f\u0103r\u0103 privilegii \u00eencearc\u0103 s\u0103 creeze un socket NETLINK_RDMA. <\/p>\n

\u00cenc\u0103rcarea automat\u0103 a modulelor necesare pentru exploatarea vulnerabilit\u0103\u021bilor este suportat\u0103 \u00een CentOS 8, RHEL 8 \u0219i Fedora, atunci c\u00e2nd se instaleaz\u0103 pachetul rdma-core, care este o dependen\u021b\u0103 pentru unele pachete populare \u0219i este instalat \u00een mod implicit \u00een configura\u021biile pentru sta\u021bii de lucru, sisteme server cu GUI \u0219i medii gazd\u0103 de virtualizare. Totu\u0219i, rdma-core nu este instalat atunci c\u00e2nd se folose\u0219te o versiune server \u00een mod exclusiv \u00een modul consol\u0103, iar la instalarea unei imagini de instalare minime. De exemplu, pachetul este inclus \u00een livrarea de baz\u0103 Fedora 31 Workstation, dar nu este inclus \u00een Fedora 31 Server. Debian \u0219i Ubuntu sunt mai pu\u021bin vulnerabile, deoarece pachetul rdma-core \u00eencarc\u0103 modulele nucleului necesare pentru atac doar \u00een prezen\u021ba hardware-ului RDMA.

\"O<\/center> <\/p>\n

Ca o solu\u021bie de ocolire a protec\u021biei, se poate interzice \u00eenc\u0103rcarea automat\u0103 a modulului libiscsi: echo \"install libiscsi \/bin\/true\" >> \/etc\/modprobe.d\/disable-libiscsi.conf <\/p>\n

\u00cen plus, \u00een subsistemul iSCSI au fost remediate alte dou\u0103 vulnerabilit\u0103\u021bi mai pu\u021bin periculoase, care pot duce la scurgeri de date din nucleu: CVE-2021-27363 (scurgerea informa\u021biilor despre descriptorul de transport iSCSI prin sysfs) \u0219i CVE-2021-27364 (citirea dintr-o zon\u0103 din afara limitelor buffer-ului). Aceste vulnerabilit\u0103\u021bi pot fi folosite pentru a interac\u021biona prin socket netlink cu subsistemul iSCSI f\u0103r\u0103 a avea privilegiile necesare. De exemplu, un utilizator neprivilegiat poate s\u0103 se conecteze la iSCSI \u0219i s\u0103 trimit\u0103 comanda \"end a session\" pentru a \u00eentrerupe sesiunea.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u0435 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b iSCSI \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 \u044f\u0434\u0440\u0430 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-27365), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 Linux 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260 \u0438 4.4.260. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u044f\u0434\u0440\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Debian, Ubuntu, SUSE\/openSUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":99422,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een subsistemul iSCSI al nucleului Linux, care permite cre\u0219terea privilegiilor | ProHoster","description":"\u00cen codul subsistemului iSCSI din nucleul Linux a fost identificat\u0103 o vulnerabilitate (CVE-2021-27365), care permite unui utilizator local neprivilegiat s\u0103 execute cod la nivel de nucleu \u0219i s\u0103 ob\u021bin\u0103 privilegii root \u00een sistem.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 iSCSI \u044f\u0434\u0440\u0430 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u0435 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b iSCSI \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 \u044f\u0434\u0440\u0430 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-27365), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-13T20:22:40+00:00","article:modified_time":"2021-03-13T20:22:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99421","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-13 20:38:21","updated":"2022-09-28 06:45:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=99421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99421\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/99422"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=99421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=99421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=99421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}