{"id":99693,"date":"2021-04-09T16:22:51","date_gmt":"2021-04-09T14:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-podsisteme-ebpf-yadra-linux"},"modified":"2021-04-09T16:22:51","modified_gmt":"2021-04-09T14:22:51","slug":"uyazvimosti-v-podsisteme-ebpf-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een subsistemul eBPF al nucleului Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen subsistemul eBPF, care permite rularea handler-elor pentru urm\u0103rirea, analiza func\u021bion\u0103rii subsistemelor \u0219i gestionarea traficului, efectuate \u00een interiorul nucleului Linux \u00eentr-o ma\u0219in\u0103 virtual\u0103 special\u0103 cu JIT, a fost descoperit\u0103 o vulnerabilitate (CVE-2021-29154) care permite unui utilizator local s\u0103 execute cod la nivel de nucleu. Problema se manifest\u0103 p\u00e2n\u0103 la versiunea 5.11.12 (inclusiv) \u0219i nu a fost \u00eenc\u0103 corectat\u0103 \u00een distribu\u021biile (Debian, Ubuntu, RHEL, Fedora, SUSE, Arch). Corectarea este disponibil\u0103 sub form\u0103 de patch. <\/p>\n

Conform declara\u021biilor cercet\u0103torilor care au identificat vulnerabilitatea, ace\u0219tia au reu\u0219it s\u0103 dezvolte un prototip func\u021bional de exploit pentru sistemele x86 de 32 \u0219i 64 de bi\u021bi, care poate fi utilizat de utilizatori f\u0103r\u0103 privilegii. \u00cen acest context, compania Red Hat men\u021bioneaz\u0103 c\u0103 gravitatea problemei depinde de disponibilitatea apelului de sistem eBPF pentru utilizator. De exemplu, \u00een RHEL \u0219i \u00een majoritatea altor distribu\u021bii Linux, \u00een configura\u021bia implicit\u0103, vulnerabilitatea poate fi exploatat\u0103 dac\u0103 BPF JIT este activat \u0219i utilizatorul dispune de drepturile CAP_SYS_ADMIN. Ca m\u0103sur\u0103 de precau\u021bie, se recomand\u0103 dezactivarea BPF JIT folosind comanda: echo 0 > \/proc\/sys\/net\/core\/bpf_jit_enable <\/p>\n

Problema este cauzat\u0103 de o eroare de calcul a deplas\u0103rii pentru instruc\u021biunile de bran\u0219are \u00een timpul gener\u0103rii codului ma\u0219in\u0103 de c\u0103tre compilatorul JIT. \u00cen special, \u00een timpul gener\u0103rii instruc\u021biunilor de bran\u0219are, nu se ia \u00een considerare faptul c\u0103 deplasarea se poate schimba dup\u0103 etapa de optimizare. Aceast\u0103 deficien\u021b\u0103 poate fi exploatat\u0103 pentru a genera cod ma\u0219in\u0103 anormal \u0219i a-l executa la nivel de nucleu. <\/p>\n

Este notabil c\u0103 aceasta nu este singura vulnerabilitate din subsistemul eBPF \u00een ultima vreme. La sf\u00e2r\u0219itul lunii martie, \u00een nucleu au fost identificate \u00eenc\u0103 dou\u0103 vulnerabilit\u0103\u021bi (CVE-2020-27170, CVE-2020-27171), care ofer\u0103 posibilitatea de a folosi eBPF pentru a ocoli protec\u021bia \u00eempotriva vulnerabilit\u0103\u021bilor de tip Spectre, permi\u021b\u00e2nd determinarea con\u021binutului memoriei nucleului ca urmare a cre\u0103rii condi\u021biilor pentru executarea speculativ\u0103 a anumitor opera\u021biuni. Pentru o atac Spectre este necesar\u0103 existen\u021ba unei secven\u021be specifice de instruc\u021biuni \u00een codul privilegiat, care conduc la execu\u021bia speculativ\u0103 a instruc\u021biunilor. \u00cen eBPF au fost g\u0103site mai multe modalit\u0103\u021bi de generare a unor astfel de instruc\u021biuni prin manipularea programelor BPF transmise pentru execu\u021bie. <\/p>\n

Vulnerabilitatea CVE-2020-27170 este generat\u0103 de prezen\u021ba unor manipul\u0103ri cu pointere \u00een verificatorul BPF, care cauzeaz\u0103 opera\u021bii speculative de acces la zone dincolo de limitele bufferului. Vulnerabilitatea CVE-2020-27171 este legat\u0103 de o eroare de aritmetic\u0103 \u00eentreag\u0103 (integer underflow) \u00een manipularea pointerelor, ceea ce duce la accesul speculativ la date \u00een afara bufferului. Problemele men\u021bionate au fost deja remediate \u00een versiunile nucleului 5.11.8, 5.10.25, 5.4.107, 4.19.182 \u0219i 4.14.227, iar acestea au fost incluse \u00een actualiz\u0103rile nucleului majorit\u0103\u021bii distribu\u021biilor Linux. Cercet\u0103torii au preg\u0103tit un prototip de exploat care permite unui utilizator f\u0103r\u0103 privilegii s\u0103 extrag\u0103 date din memoria nucleului.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29154), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 5.11.12 (\u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e) \u0438 \u0435\u0449\u0451 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 (Debian, Ubuntu, RHEL, Fedora, SUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99693","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bile din subsistemul eBPF al nucleului Linux | ProHoster","description":"\u00cen subsistemul eBPF, care permite rularea handlerelor pentru trasare, analiza activit\u0103\u021bii subsistemelor \u0219i gestionarea traficului, executate \u00een interiorul nucleului Linux \u00eentr-o ma\u0219in\u0103 virtual\u0103 special\u0103 cu JIT, a fost identificat\u0103 o vulnerabilitate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-09T14:22:51+00:00","article:modified_time":"2021-04-09T14:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99693","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-09 14:30:13","updated":"2022-09-30 04:24:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=99693"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99693\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=99693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=99693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=99693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}