{"id":105336,"date":"2022-10-19T15:37:24","date_gmt":"2022-10-19T13:37:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme"},"modified":"2022-10-19T15:37:24","modified_gmt":"2022-10-19T13:37:24","slug":"uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme","title":{"rendered":"Zranite\u013enos\u0165 v podsysteme io_uring jadra Linux, ktor\u00e1 umo\u017e\u0148uje zv\u00fd\u0161i\u0165 privil\u00e9gia v syst\u00e9me","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V implement\u00e1cii rozhrania asynchr\u00f3nneho vstupu\/v\u00fdstupu io_uring, ktor\u00e9 je s\u00fa\u010das\u0165ou jadra Linux od verzie 5.1, bola identifikovan\u00e1 zranite\u013enos\u0165 (CVE-2022-2602), ktor\u00e1 umo\u017e\u0148uje neprivilegovan\u00e9mu u\u017e\u00edvate\u013eovi z\u00edska\u0165 pr\u00e1va root v syst\u00e9me. Probl\u00e9m bol potvrden\u00fd vo vetve 5.4 a v jadr\u00e1ch od verzie 5.15. <\/p>\n
Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 pr\u00edstupom k u\u017e uvo\u013enen\u00e9mu bloku pam\u00e4te (use-after-free) v podsysteme io_uring, ktor\u00fd vznik\u00e1 v d\u00f4sledku z\u00e1vodu pri spracovan\u00ed po\u017eiadavky io_uring na cie\u013eov\u00fd s\u00fabor po\u010das vykon\u00e1vania zberu odpadu pre Unix-sockety, ak zber odpadu uvo\u013en\u00ed v\u0161etky zaregistrovan\u00e9 s\u00faborov\u00e9 deskriptor a s\u00faborov\u00fd deskriptor, s ktor\u00fdm pracuje io_uring. Na umel\u00e9 vytvorenie podmienok na prejav zranite\u013enosti je mo\u017en\u00e9 zadr\u017ea\u0165 po\u017eiadavku pomocou userfaultfd do okamihu, ke\u010f d\u00f4jde k uvo\u013eneniu pam\u00e4te zberom odpadu. <\/p>\n
V\u00fdskumn\u00edci, ktor\u00ed identifikovali probl\u00e9m, ozn\u00e1mili vytvorenie funk\u010dn\u00e9ho exploitu, ktor\u00fd pl\u00e1nuj\u00fa zverejni\u0165 25. okt\u00f3bra, aby dali u\u017e\u00edvate\u013eom \u010das na in\u0161tal\u00e1ciu aktualiz\u00e1ci\u00ed. Oprava je zatia\u013e dostupn\u00e1 vo forme patchu. Aktualiz\u00e1cie pre distrib\u00facie zatia\u013e neboli vydan\u00e9, ale ich zverejnenie je mo\u017en\u00e9 sledova\u0165 na str\u00e1nkach: Debian, Ubuntu, Gentoo, RHEL, Fedora, SUSE\/openSUSE, Arch. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"