{"id":103645,"date":"2022-03-29T15:37:18","date_gmt":"2022-03-29T13:37:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec"},"modified":"2022-03-29T15:37:18","modified_gmt":"2022-03-29T13:37:19","slug":"v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","title":{"rendered":"V jadre Linuxu boli zisten\u00e9 zranite\u013enosti v nf_tables, watch_queue a IPsec","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V jadre Linux bolo odhalen\u00fdch nieko\u013eko nebezpe\u010dn\u00fdch zranite\u013enost\u00ed, ktor\u00e9 umo\u017e\u0148uj\u00fa lok\u00e1lnemu pou\u017e\u00edvate\u013eovi zv\u00fd\u0161i\u0165 svoje privil\u00e9gia v syst\u00e9me. Pre v\u0161etky zva\u017eovan\u00e9 probl\u00e9my boli pripraven\u00e9 funk\u010dn\u00e9 prototypy exploitov.    <\/p>\n<ul>\n<li class=\"l\"> Zranite\u013enos\u0165 (CVE-2022-0995) v subsyst\u00e9me sledovania udalost\u00ed watch_queue vedie k z\u00e1pisu \u00fadajov do oblasti pam\u00e4te jadra mimo pridelen\u00e9ho vyrovn\u00e1vacieho bloku. \u00datok m\u00f4\u017ee vykona\u0165 ak\u00fdko\u013evek nepriviligovan\u00fd pou\u017e\u00edvate\u013e a m\u00f4\u017ee vies\u0165 k spusteniu vlastn\u00e9ho k\u00f3du s pr\u00e1vami jadra. Zranite\u013enos\u0165 je pr\u00edtomn\u00e1 vo funkcii watch_queue_set_size() a s\u00favis\u00ed s pokusom o vy\u010distenie v\u0161etk\u00fdch ukazovate\u013eov v zozname, aj ke\u010f pre ne nebola pridelen\u00e1 pam\u00e4\u0165. Probl\u00e9m sa prejavuje pri zostavovan\u00ed jadra s vo\u013ebou CONFIG_WATCH_QUEUE=y, ktor\u00e1 sa pou\u017e\u00edva vo v\u00e4\u010d\u0161ine distrib\u00faci\u00ed Linuxu.\n<p>Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 v zmene pridanej do jadra 11. marca. Sledovanie publik\u00e1cie aktualiz\u00e1ci\u00ed bal\u00edkov v distrib\u00faci\u00e1ch je mo\u017en\u00e9 na t\u00fdchto str\u00e1nkach: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. Prototyp exploitov je u\u017e verejne dostupn\u00fd a umo\u017e\u0148uje z\u00edska\u0165 pr\u00edstup root pri spusten\u00ed na Ubuntu 21.10 s jadrom 5.13.0-37.      <center><img decoding=\"async\" alt=\"V jadre Linuxu boli zisten\u00e9 zranite\u013enosti v nf_tables, watch_queue a IPsec\" src=\"\/wp-content\/uploads\/2022\/03\/9cdfd5bdf66d257757d1a4c600b96249.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<li class=\"l\"> Zranite\u013enos\u0165 (CVE-2022-27666) v moduloch jadra esp4 a esp6 s implement\u00e1ciou ESP-transform\u00e1ci\u00ed (Encapsulating Security Payload) pre IPsec, pou\u017e\u00edvan\u00fdch pri IPv4 a IPv6. Zranite\u013enos\u0165 umo\u017e\u0148uje lok\u00e1lnemu pou\u017e\u00edvate\u013eovi s be\u017en\u00fdmi privil\u00e9gii prep\u00edsa\u0165 objekty v pam\u00e4ti jadra a zv\u00fd\u0161i\u0165 svoje privil\u00e9gi\u00e1 v syst\u00e9me. Probl\u00e9m je sp\u00f4soben\u00fd nedostatkom kontroly vyhraden\u00e9ho ve\u013ekosti pam\u00e4te a skuto\u010dne z\u00edskan\u00fdch \u00fadajov, pri\u010dom maxim\u00e1lna ve\u013ekos\u0165 spr\u00e1vy mohla presahova\u0165 maxim\u00e1lnu ve\u013ekos\u0165 pam\u00e4te vyhradenej pre \u0161trukt\u00faru skb_page_frag_refill.\n<p>Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 v jadre 7. marca (opraven\u00e1 v 5.17, 5.16.15 at\u010f.). Sledovanie publik\u00e1cie aktualiz\u00e1ci\u00ed bal\u00edkov v distrib\u00faci\u00e1ch je mo\u017en\u00e9 na t\u00fdchto str\u00e1nkach: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. Funk\u010dn\u00fd prototyp exploitov, ktor\u00fd umo\u017e\u0148uje be\u017en\u00e9mu pou\u017e\u00edvate\u013eovi z\u00edska\u0165 pr\u00edstup root v Ubuntu Desktop 21.10 v predvolenej konfigur\u00e1cii, u\u017e bol zverejnen\u00fd na GitHub. Uv\u00e1dza sa, \u017ee pri drobn\u00fdch \u00faprav\u00e1ch bude exploit fungova\u0165 aj v Fedore a Debiane. Zauj\u00edmav\u00e9 je, \u017ee exploit bol p\u00f4vodne pripraven\u00fd na s\u00fa\u0165a\u017ee pwn2own 2022, ale v\u00fdvoj\u00e1ri jadra odhalili a opravili s t\u00fdm spojen\u00fa chybu, preto sa rozhodlo zverejni\u0165 podrobnosti o zranite\u013enosti.      <center>  <video controls=\"\" style=\"width: 720px; height: 480px; max-width:100%\" src=\"https:\/\/etenal.me\/wp-content\/uploads\/2022\/03\/yes_root.mp4\" ><source src=\"https:\/\/etenal.me\/wp-content\/uploads\/2022\/03\/yes_root.mp4\" type=\"video\/mp4\"><\/video><\/center>    <\/p>\n<li class=\"l\"> Dve zranite\u013enosti (CVE-2022-1015, CVE-2022-1016) v subsyst\u00e9me netfilter v module nf_tables, ktor\u00fd zais\u0165uje \u010dinnos\u0165 paketov\u00e9ho filtra nftables. Prv\u00e1 probl\u00e9m umo\u017e\u0148uje lok\u00e1lnemu nepriviligovan\u00e9mu pou\u017e\u00edvate\u013eovi dosiahnu\u0165 z\u00e1pis mimo vyhraden\u00e9ho vyrovn\u00e1vacieho buffera na z\u00e1sobn\u00edku. Prete\u010denie sa vyskytuje pri spracovan\u00ed \u0161peci\u00e1lne form\u00e1tovan\u00fdch v\u00fdrazov nftables, ktor\u00e9 sa spracov\u00e1vaj\u00fa pri kontrole indexov zadan\u00fdch pou\u017e\u00edvate\u013eom, ktor\u00fd m\u00e1 pr\u00edstup k pravidl\u00e1m nftables.\n<p>Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 t\u00fdm, \u017ee v\u00fdvoj\u00e1ri predpokladali, \u017ee hodnota enum nft_registers reg je jeden bajt, zatia\u013e \u010do pri zapnut\u00ed ur\u010dit\u00fdch optimaliz\u00e1ci\u00ed kompil\u00e1tor pod\u013ea \u0161pecifik\u00e1cie C89 m\u00f4\u017ee pou\u017e\u00edva\u0165 32-bitov\u00fa hodnotu. Vzh\u013eadom na uveden\u00fa vlastnos\u0165 sa pou\u017e\u00edvan\u00e1 ve\u013ekos\u0165 pri kontrole a pride\u013eovan\u00ed pam\u00e4te nezodpoved\u00e1 skuto\u010dnej ve\u013ekosti \u00fadajov v \u0161trukt\u00fare, \u010do vedie k prekr\u00fdvaniu chvosta \u0161trukt\u00fary s ukazovate\u013emi v z\u00e1sobn\u00edku.    <\/p>\n<p>Probl\u00e9m m\u00f4\u017ee by\u0165 zneu\u017eit\u00fd na vykonanie vlastn\u00e9ho k\u00f3du na \u00farovni jadra, ale na \u00faspe\u0161n\u00fd \u00fatok je potrebn\u00fd pr\u00edstup k nftables, ktor\u00fd je mo\u017en\u00e9 z\u00edska\u0165 v samostatnom sie\u0165ovom priestore (network namespaces) pri existencii pr\u00e1v CLONE_NEWUSER alebo CLONE_NEWNET (napr\u00edklad pri mo\u017enosti spustenia izolovan\u00e9ho kontajnera). Zranite\u013enos\u0165 je tie\u017e \u00fazko spojen\u00e1 s optimaliz\u00e1ciami kompil\u00e1tora, ktor\u00e9 sa, napr\u00edklad, zap\u00ednaj\u00fa pri zostavovan\u00ed v re\u017eime CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y. Zneu\u017eitie zranite\u013enosti je mo\u017en\u00e9 od jadra Linux 5.12.    <\/p>\n<p>Druh\u00e1 zranite\u013enos\u0165 v netfilter je sp\u00f4soben\u00e1 pr\u00edstupom k u\u017e uvo\u013enenej oblasti pam\u00e4te (use-after-free) v spracovate\u013eovi nft_do_chain a m\u00f4\u017ee vies\u0165 k \u00faniku neinicializovan\u00fdch oblast\u00ed pam\u00e4te jadra, ktor\u00e9 m\u00f4\u017eu by\u0165 \u010d\u00edtan\u00e9 prostredn\u00edctvom manipul\u00e1ci\u00ed s v\u00fdrazmi nftables a pou\u017eit\u00e9, napr\u00edklad, na ur\u010denie adries ukazovate\u013eov pri v\u00fdvoji exploitov pre in\u00e9 zranite\u013enosti. Zneu\u017eitie zranite\u013enosti je mo\u017en\u00e9 od jadra Linux 5.13.    <\/p>\n<p>Zranite\u013enosti boli odstr\u00e1nen\u00e9 v dne\u0161n\u00fdch oprav\u00e1ch jadra 5.17.1, 5.16.18, 5.15.32, 5.10.109, 5.4.188, 4.19.237, 4.14.274 a 4.9.309. Inform\u00e1cie o publikovan\u00ed aktualiz\u00e1ci\u00ed bal\u00edkov v distrib\u00faci\u00e1ch je mo\u017en\u00e9 sledova\u0165 na t\u00fdchto str\u00e1nkach: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. V\u00fdskumn\u00edk, ktor\u00fd identifikoval probl\u00e9my, uviedol, \u017ee pripravuje funk\u010dn\u00e9 exploit\u00e1cie pre obidve zranite\u013enosti, ktor\u00e9 pl\u00e1nuje zverejni\u0165 o nieko\u013eko dn\u00ed po tom, ako distrib\u00facie vydaj\u00fa aktualiz\u00e1cie bal\u00edkov s jadrom.      <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56931\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0995) \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u0439 watch_queue, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u043e\u043c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u043b\u044e\u0431\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0438 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0443\u0441\u043a\u0443 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103646,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103645","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 nf_tables, watch_queue \u0438 IPsec | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-03-29T13:37:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-03-29T13:37:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vo jadre Linuxu boli identifikovan\u00e9 zneu\u017eite\u013en\u00e9 zranite\u013enosti v nf_tables, watch_queue a IPsec | ProHoster","description":"V jadre Linux bolo odhalen\u00fdch nieko\u013eko nebezpe\u010dn\u00fdch zranite\u013enost\u00ed, ktor\u00e9 umo\u017e\u0148uj\u00fa lok\u00e1lnemu pou\u017e\u00edvate\u013eovi zv\u00fd\u0161i\u0165 svoje privil\u00e9gia v syst\u00e9me. Pre v\u0161etky zva\u017eovan\u00e9 probl\u00e9my boli pripraven\u00e9 funk\u010dn\u00e9 prototypy exploitov.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 nf_tables, watch_queue \u0438 IPsec | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-29T13:37:19+00:00","article:modified_time":"2022-03-29T13:37:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103645","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-29 13:38:31","updated":"2022-09-30 01:21:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/103645","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=103645"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/103645\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/103646"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=103645"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=103645"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=103645"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}