V jadre Linux bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2022-42896), ktor\u00e1 m\u00f4\u017ee potenci\u00e1lne umo\u017eni\u0165 vzdialen\u00e9 vykon\u00e1vanie k\u00f3du na \u00farovni jadra prostredn\u00edctvom zaslania \u0161peci\u00e1lne form\u00e1tovan\u00e9ho L2CAP paketu cez Bluetooth. Okrem toho bola zisten\u00e1 \u010fal\u0161ia podobn\u00e1 probl\u00e9m (CVE-2022-42895) v spracovan\u00ed L2CAP, ktor\u00e1 m\u00f4\u017ee vies\u0165 k \u00faniku obsahu pam\u00e4te jadra v paktoch so sp\u00f4sobmi konfigur\u00e1cie. Prv\u00e1 zranite\u013enos\u0165 sa prejavuje od augusta 2014 (jadro 3.16) a druh\u00e1 od okt\u00f3bra 2011 (jadro 3.0). Zranite\u013enosti boli odstr\u00e1nen\u00e9 v verzi\u00e1ch jadra Linux 6.1.0, 6.0.8, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154 a 5.15.78. Opravy v distrib\u00faci\u00e1ch je mo\u017en\u00e9 sledova\u0165 na nasleduj\u00facich str\u00e1nkach: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
Na demon\u0161tr\u00e1ciu mo\u017enosti uskuto\u010dnenia vzdialen\u00e9ho \u00fatoku boli zverejnen\u00e9 prototypy exploitov funguj\u00facich na Ubuntu 22.04. Na vykonanie \u00fatoku mus\u00ed by\u0165 \u00fato\u010dn\u00edk v dosahu Bluetooth \u2014 predbe\u017en\u00e9 sp\u00e1rovanie nie je potrebn\u00e9, ale Bluetooth mus\u00ed by\u0165 na po\u010d\u00edta\u010di zapnut\u00e9. Na \u00fatok sta\u010d\u00ed pozna\u0165 MAC adresu zariadenia obete, ktor\u00fa je mo\u017en\u00e9 ur\u010di\u0165 prostredn\u00edctvom sniffingu alebo na niektor\u00fdch zariadeniach vypo\u010d\u00edta\u0165 na z\u00e1klade MAC adresy Wi-Fi. <\/p>\n
Prv\u00e1 zranite\u013enos\u0165 (CVE-2022-42896) je sp\u00f4soben\u00e1 pr\u00edstupom k u\u017e uvo\u013enenej oblasti pam\u00e4te (use-after-free) v implement\u00e1cii funkci\u00ed l2cap_connect a l2cap_le_connect_req \u2014 po vytvoren\u00ed kan\u00e1la cez callback volanie new_connection sa pre\u0148 nezapla blok\u00e1cia, ale nastavoval sa \u010dasova\u010d (__set_chan_timer), ktor\u00fd po uplynut\u00ed \u010dasov\u00e9ho limitu vyvol\u00e1val funkciu l2cap_chan_timeout a \u010distil kan\u00e1l bez overenia ukon\u010denia pr\u00e1ce s kan\u00e1lom vo funkci\u00e1ch l2cap_le_connect*. <\/p>\n
Predvolen\u00fd \u010dasov\u00fd limit je 40 sek\u00fand a predpokladalo sa, \u017ee pri takejto oneskoren\u00ed sa nem\u00f4\u017ee vyskytn\u00fa\u0165 stav prete\u010denia, av\u0161ak uk\u00e1zalo sa, \u017ee v d\u00f4sledku \u010fal\u0161ej chyby v spracovate\u013eovi SMP je mo\u017en\u00e9 dosiahnu\u0165 okam\u017eit\u00e9 vyvolanie \u010dasova\u010da a dosiahnu\u0165 stav prete\u010denia. Probl\u00e9m v l2cap_le_connect_req m\u00f4\u017ee vies\u0165 k \u00faniku pam\u00e4te jadra, zatia\u013e \u010do v l2cap_connect k prep\u00edsaniu obsahu pam\u00e4te a vykonaniu vlastn\u00e9ho k\u00f3du. Prv\u00e1 varianta \u00fatoku m\u00f4\u017ee by\u0165 vykonan\u00e1 pomocou Bluetooth LE 4.0 (od roku 2009), druh\u00e1 pri pou\u017eit\u00ed Bluetooth BR\/EDR 5.2 (od roku 2020). <\/p>\n
Druh\u00e1 zranite\u013enos\u0165 (CVE-2022-42895) je sp\u00f4soben\u00e1 \u00fanikom zvy\u0161kov\u00fdch \u00fadajov z pam\u00e4te vo funkcii l2cap_parse_conf_req, \u010do m\u00f4\u017ee by\u0165 vyu\u017eit\u00e9 na vzdialen\u00e9 z\u00edskanie inform\u00e1ci\u00ed o ukazovate\u013eoch na \u0161trukt\u00fary jadra prostredn\u00edctvom odosielania \u0161peci\u00e1lne upraven\u00fdch konfigur\u00e1ci\u00ed. Vo funkcii l2cap_parse_conf_req sa pou\u017e\u00edvala \u0161trukt\u00fara l2cap_conf_efs, pre ktor\u00fa nebola vykonan\u00e1 predch\u00e1dzaj\u00faca inicializ\u00e1cia pridelen\u00e9 pam\u00e4te a prostredn\u00edctvom manipul\u00e1cie s vlagom FLAG_EFS_ENABLE bolo mo\u017en\u00e9 dosiahnu\u0165 zahrnutie star\u00fdch \u00fadajov z z\u00e1sobn\u00edka do paketu. Probl\u00e9m sa prejavuje len v syst\u00e9moch, v ktor\u00fdch je jadro zostaven\u00e9 s mo\u017enos\u0165ou CONFIG_BT_HS (predvolene vypnut\u00e1, ale aktivovan\u00e1 v niektor\u00fdch distrib\u00faci\u00e1ch, ako je Ubuntu). Pre \u00faspe\u0161n\u00fd \u00fatok je tie\u017e potrebn\u00e9 nastavi\u0165 parameter HCI_HS_ENABLED cez ovl\u00e1dac\u00ed rozhranie na hodnotu true (predvolene sa nepou\u017e\u00edva). \u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 Bluetooth. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u043f\u043e\u0445\u043e\u0436\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2022-42895) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 L2CAP, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106088","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v jadre Linuxu, vzdialene zneu\u017e\u00edvan\u00e9 cez Bluetooth | ProHoster","description":"V jadre Linuxu bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2022-42896), ktor\u00e1 m\u00f4\u017ee by\u0165 potenci\u00e1lne vyu\u017eit\u00e1 na vzdialen\u00e9 vykon\u00e1vanie k\u00f3du na \u00farovni jadra prostredn\u00edctvom odoslania \u0161peci\u00e1lne upraven\u00e9ho L2CAP paketu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 Bluetooth | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-42896), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e L2CAP-\u043f\u0430\u043a\u0435\u0442\u0430 \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-yadre-linux-udalyonno-ekspluatiruemye-cherez-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-15T11:06:35+00:00","article:modified_time":"2022-12-15T11:06:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/106088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=106088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/106088\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=106088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=106088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=106088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"