{"id":100168,"date":"2021-05-14T16:23:07","date_gmt":"2021-05-14T14:23:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2021-05-14T16:23:07","modified_gmt":"2021-05-14T14:23:07","slug":"uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"Zranite\u013enosti v subsyst\u00e9me eBPF, ktor\u00e9 umo\u017e\u0148uj\u00fa vykon\u00e1va\u0165 k\u00f3d na \u00farovni jadra Linuxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Boli zisten\u00e9 dve nov\u00e9 zranite\u013enosti v subsyst\u00e9me eBPF, ktor\u00fd umo\u017e\u0148uje sp\u00fa\u0161\u0165a\u0165 spracovate\u013eov v r\u00e1mci jadra Linuxu v \u0161peci\u00e1lnej virtu\u00e1lnej machine s JIT. Obe zranite\u013enosti poskytuj\u00fa mo\u017enos\u0165 vykona\u0165 vlastn\u00fd k\u00f3d s pr\u00e1vami jadra, mimo izolovanej virtu\u00e1lnej machine eBPF. Inform\u00e1cie o probl\u00e9moch zverejnil t\u00edm Zero Day Initiative, ktor\u00fd organizuje s\u00fa\u0165a\u017ee Pwn2Own, kde tento rok boli demon\u0161trovan\u00e9 tri \u00fatoky na Ubuntu Linux, pri ktor\u00fdch boli vyu\u017eit\u00e9 predt\u00fdm nezn\u00e1me zranite\u013enosti (neuv\u00e1dza sa, \u010di s\u00fa zranite\u013enosti v eBPF spojen\u00e9 s t\u00fdmito \u00fatokmi).   <\/p>\n<ul>\n<li class=\"l\"> CVE-2021-3490 \u2014 zranite\u013enos\u0165 sp\u00f4soben\u00e1 absenciou kontroly prete\u010denia 32-bitov\u00fdch hodn\u00f4t pri vykon\u00e1van\u00ed bitov\u00fdch oper\u00e1ci\u00ed AND, OR a XOR v eBPF ALU32. \u00dato\u010dn\u00edk m\u00f4\u017ee vyu\u017ei\u0165 t\u00fato chybu na \u010d\u00edtanie a z\u00e1pis \u00fadajov mimo hran\u00edc pridelen\u00e9ho vyrovn\u00e1vacieho pam\u00e4\u0165ov\u00e9ho bloku. Probl\u00e9m s oper\u00e1ciou XOR sa prejavuje od verzie jadra 5.7-rc1, zatia\u013e \u010do AND a OR \u2014 od vydania 5.10-rc1.\n<li class=\"l\"> CVE-2021-3489 \u2014 zranite\u013enos\u0165 sp\u00f4soben\u00e1 chybou v implement\u00e1cii kruhovej vyrovn\u00e1vacej pam\u00e4te, s\u00favisiaca s t\u00fdm, \u017ee funkcia bpf_ringbuf_reserve nekontrolovala, \u010di m\u00f4\u017ee by\u0165 ve\u013ekos\u0165 pridelen\u00e9ho priestoru pam\u00e4te men\u0161ia ako skuto\u010dn\u00e1 ve\u013ekos\u0165 kruhovej vyrovn\u00e1vacej pam\u00e4te ringbuf. Probl\u00e9m sa prejavuje od vydania 5.8-rc1.  <\/ul>\n<p>\u0160tatus opravy zranite\u013enost\u00ed v distrib\u00faci\u00e1ch je mo\u017en\u00e9 sledova\u0165 na t\u00fdchto str\u00e1nkach: Ubuntu, Debian, RHEL, Fedora, SUSE, Arch. Opravy s\u00fa tie\u017e dostupn\u00e9 vo forme patchov (CVE-2021-3489, CVE-2021-3490). Mo\u017enos\u0165 exploit\u00e1cie probl\u00e9mu z\u00e1vis\u00ed od dostupnosti syst\u00e9mov\u00e9ho volania eBPF pre pou\u017e\u00edvate\u013ea. Napr\u00edklad v predvolenej konfigur\u00e1cii v RHEL je na exploit\u00e1ciu zranite\u013enosti potrebn\u00e9, aby mal pou\u017e\u00edvate\u013e pr\u00e1va CAP_SYS_ADMIN.         <\/p>\n<p>Osobitne by sa mala spomen\u00fa\u0165 \u010fal\u0161ia zranite\u013enos\u0165 v jadre Linux \u2014 CVE-2021-32606, ktor\u00e1 umo\u017e\u0148uje lok\u00e1lnemu pou\u017e\u00edvate\u013eovi zv\u00fd\u0161i\u0165 svoje opr\u00e1vnenia na \u00farove\u0148 root. Probl\u00e9m sa prejavuje od jadra Linux 5.11 a je sp\u00f4soben\u00fd pretekaj\u00facim stavom v implement\u00e1cii protokolu CAN ISOTP, ktor\u00fd umo\u017e\u0148uje zmeni\u0165 parametre viazania na z\u00e1suvku z d\u00f4vodu nedostatku riadneho uzamknutia vo funkcii isotp_setsockopt() pri spracovan\u00ed pr\u00edznaku CAN_ISOTP_SF_BROADCAST.    <\/p>\n<p>Po uzavret\u00ed soketu ISOTP na\u010falej pretrv\u00e1va v\u00e4zba na soket pr\u00edjemcu, ktor\u00fd m\u00f4\u017ee pokra\u010dova\u0165 v pou\u017e\u00edvan\u00ed \u0161trukt\u00far s\u00favisiacich so soketom aj po uvo\u013enen\u00ed s nimi spojenej pam\u00e4te (use-after-free z d\u00f4vodu pr\u00edstupu pri volan\u00ed isotp_rcv() k u\u017e uvo\u013enenej \u0161trukt\u00fare isotp_sock). Manipul\u00e1ciou s \u00fadajmi je mo\u017en\u00e9 dosiahnu\u0165 predefinovanie ukazovate\u013ea na funkciu sk_error_report() a vykona\u0165 vlastn\u00fd k\u00f3d na \u00farovni jadra.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55150\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT. \u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430, \u0432\u043d\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b eBPF. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 Zero Day Initiative, \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f Pwn2Own, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0442\u0440\u0438 \u0430\u0442\u0430\u043a\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-05-14T14:23:07+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-05-14T14:23:07+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v subsyst\u00e9me eBPF, ktor\u00e9 umo\u017e\u0148uj\u00fa vykona\u0165 k\u00f3d na \u00farovni jadra Linuxu | ProHoster","description":"Boli identifikovan\u00e9 dve nov\u00e9 zranite\u013enosti v subsyst\u00e9me eBPF, ktor\u00e9 umo\u017e\u0148uj\u00fa sp\u00fa\u0161\u0165a\u0165 spracovate\u013eov v jadre Linuxu v \u0161peci\u00e1lnej virtu\u00e1lnej stroji s JIT.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-14T14:23:07+00:00","article:modified_time":"2021-05-14T14:23:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-14 21:05:35","updated":"2022-10-09 15:55:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=100168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=100168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=100168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=100168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}