{"id":103125,"date":"2022-01-29T15:37:09","date_gmt":"2022-01-29T13:37:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx"},"modified":"2022-01-29T15:37:09","modified_gmt":"2022-01-29T13:37:09","slug":"uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","title":{"rendered":"Zranite\u013enosti v OpenSSL, Glibc, util-linux, ovl\u00e1da\u010doch i915 a vmwgfx.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Bola odhalen\u00e1 slabina (CVE-2021-4160) v kryptografickej kni\u017enici OpenSSL, sp\u00f4soben\u00e1 chybou v implement\u00e1cii sumariz\u00e1cie v funkcii BN_mod_exp, \u010do vedie k vr\u00e1teniu nespr\u00e1vneho v\u00fdsledku oper\u00e1cie umocnenia. Probl\u00e9m sa prejavuje len na zariadeniach zalo\u017een\u00fdch na architekt\u00farach MIPS32 a MIPS64, a m\u00f4\u017ee vies\u0165 k ohrozeniu algoritmov zalo\u017een\u00fdch na eliptick\u00fdch krivk\u00e1ch, vr\u00e1tane t\u00fdch, ktor\u00e9 s\u00fa predvolene pou\u017e\u00edvan\u00e9 v TLS 1.3. Probl\u00e9m bol vyrie\u0161en\u00fd v decembrov\u00fdch aktualiz\u00e1ci\u00e1ch OpenSSL 1.1.1m a 3.0.1. <\/p>\n
Upozor\u0148uje sa, \u017ee realiz\u00e1cia re\u00e1lnych \u00fatokov zameran\u00fdch na z\u00edskanie inform\u00e1ci\u00ed o s\u00fakromn\u00fdch k\u013e\u00fa\u010doch pomocou identifikovanej chyby sa pova\u017euje za mo\u017en\u00fa, ale nepravdepodobn\u00fa, pr\u00edli\u0161 zlo\u017eit\u00fa na vykonanie a vy\u017eaduj\u00facu obrovsk\u00e9 v\u00fdpo\u010dtov\u00e9 zdroje pre RSA, DSA a algoritmus Diffie-Hellman (DH). \u00datok na TLS je vyl\u00fa\u010den\u00fd, preto\u017ee v roku 2016, pri odstr\u00e1nen\u00ed zranite\u013enosti CVE-2016-0701, bolo zak\u00e1zan\u00e9 zdie\u013eanie jedn\u00e9ho s\u00fakromn\u00e9ho k\u013e\u00fa\u010da DH klientmi. <\/p>\n
Nieko\u013eko zranite\u013enost\u00ed (CVE-2022-0330) v grafickom ovl\u00e1da\u010di i915, t\u00fdkaj\u00facich sa absencie resetovania TLB pre GPU. V pr\u00edpade, \u017ee sa nepou\u017e\u00edva IOMMU (transl\u00e1cia adries), zranite\u013enos\u0165 umo\u017e\u0148uje z pou\u017e\u00edvate\u013esk\u00e9ho priestoru z\u00edska\u0165 pr\u00edstup k n\u00e1hodn\u00fdm str\u00e1nkam pam\u00e4te. Probl\u00e9m m\u00f4\u017ee by\u0165 vyu\u017eit\u00fd na po\u0161kodenie alebo \u010d\u00edtanie \u00fadajov z n\u00e1hodn\u00fdch oblast\u00ed pam\u00e4te. Probl\u00e9m sa prejavuje na v\u0161etk\u00fdch integrovan\u00fdch a diskr\u00e9tnych GPU Intel. Oprava bola uskuto\u010dnen\u00e1 pridan\u00edm povinn\u00e9ho resetovania TLB pred vykonan\u00edm ka\u017edej oper\u00e1cie vr\u00e1tenia GPU do syst\u00e9mu, \u010do povedie k zn\u00ed\u017eeniu v\u00fdkonu. Vplyv na v\u00fdkon z\u00e1vis\u00ed od GPU, vykon\u00e1van\u00fdch oper\u00e1ci\u00ed na GPU a za\u0165a\u017eenia syst\u00e9mu. Oprava je zatia\u013e dostupn\u00e1 len vo forme z\u00e1platy.\n
Zranite\u013enos\u0165 (CVE-2022-22942) v grafickom ovl\u00e1da\u010di vmwgfx, pou\u017e\u00edvanom na implement\u00e1ciu 3D akceler\u00e1cie v prostrediach VMware. Probl\u00e9m umo\u017e\u0148uje neopr\u00e1vnen\u00e9mu pou\u017e\u00edvate\u013eovi z\u00edska\u0165 pr\u00edstup k s\u00faborom, ktor\u00e9 s\u00fa otvoren\u00e9 in\u00fdmi procesmi v syst\u00e9me. Pre vykonanie \u00fatoku je potrebn\u00fd pr\u00edstup k zariadeniu \/dev\/dri\/card0 alebo \/dev\/dri\/rendererD128, ako aj mo\u017enos\u0165 vykona\u0165 volanie ioctl() s z\u00edskan\u00fdm descriptorom s\u00faboru.\n
Zranite\u013enosti (CVE-2021-3996, CVE-2021-3995) v kni\u017enici libmount dod\u00e1vanej v bal\u00edku util-linux, ktor\u00e9 umo\u017e\u0148uj\u00fa neprivilegovan\u00e9mu pou\u017e\u00edvate\u013eovi odmontova\u0165 diskov\u00e9 oddiely bez potrebn\u00fdch opr\u00e1vnen\u00ed. Probl\u00e9m bol identifikovan\u00fd po\u010das auditu SUID-root programov umount a fusermount.\n
Zranite\u013enosti v \u0161tandardnej C kni\u017enici Glibc, ktor\u00e9 zasahuj\u00fa do funkci\u00ed realpath (CVE-2021-3998) a getcwd (CVE-2021-3999).\n
\n
Probl\u00e9m v realpath() vypl\u00fdva z n\u00e1vratu nekorektnej hodnoty pri ur\u010dit\u00fdch podmienkach, obsahuj\u00facej nevy\u010disten\u00e9 zvy\u0161kov\u00e9 d\u00e1ta zo z\u00e1sobn\u00edka. Pre SUID-root program fusermount je zranite\u013enos\u0165 mo\u017en\u00e9 vyu\u017ei\u0165 na z\u00edskanie d\u00f4vern\u00fdch \u00fadajov z pam\u00e4te procesu, napr\u00edklad inform\u00e1ci\u00ed o ukazovate\u013eoch.\n
Probl\u00e9m v getcwd() umo\u017e\u0148uje dosiahnu\u0165 prete\u010denie vyrovn\u00e1vacej pam\u00e4te o jeden bajt. Probl\u00e9m je sp\u00f4soben\u00fd chybou, ktor\u00e1 je pr\u00edtomn\u00e1 od roku 1995. Na spustenie prete\u010denia sta\u010d\u00ed v samostatnom mennom priestore vykona\u0165 volanie chdir() na adres\u00e1r \u201e\/\u201c. Neuv\u00e1dza sa, \u010di je zranite\u013enos\u0165 obmedzen\u00e1 len na havarovanie procesu, ale v minulosti existovali pr\u00edpady vytv\u00e1rania pracovn\u00fdch exploitov pre podobn\u00e9 zranite\u013enosti, napriek skepticizmu v\u00fdvoj\u00e1rov. <\/ul>\n
Zranite\u013enos\u0165 (CVE-2022-23220) v bal\u00edku usbview, ktor\u00e1 umo\u017e\u0148uje lok\u00e1lnym pou\u017e\u00edvate\u013eom prihl\u00e1sen\u00fdm do syst\u00e9mu cez SSH vykon\u00e1va\u0165 k\u00f3d s pr\u00e1vami roota, v d\u00f4sledku existencie v pravidl\u00e1ch PolKit nastavenia (allow_any=yes) na spustenie n\u00e1stroja usbview pod pou\u017e\u00edvate\u013eom root bez autentifik\u00e1cie. Explot\u00e1cia spo\u010d\u00edva v pou\u017eit\u00ed mo\u017enosti \u201e--gtk-module\u201c na na\u010d\u00edtanie vlastnej kni\u017enice do usbview. Probl\u00e9m bol odstr\u00e1nen\u00fd vo verzii usbview 2.2. <\/ul>\n