{"id":107498,"date":"2023-03-24T12:48:20","date_gmt":"2023-03-24T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=107498"},"modified":"2023-03-24T20:21:30","modified_gmt":"2023-03-24T18:21:30","slug":"uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"Zranite\u013enos\u0165 v OverlayFS, ktor\u00e1 umo\u017e\u0148uje zv\u00fd\u0161i\u0165 vlastn\u00e9 privil\u00e9gi\u00e1.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V jadre Linux bola v implement\u00e1cii s\u00faborov\u00e9ho syst\u00e9mu OverlayFS odhalen\u00e1 zranite\u013enos\u0165 (CVE-2023-0386), ktor\u00fa je mo\u017en\u00e9 vyu\u017ei\u0165 na z\u00edskanie root pr\u00edstupu na syst\u00e9moch, kde je nain\u0161talovan\u00e1 pods\u00fastava FUSE a povolen\u00e9 montovanie oddielov OverlayFS neprivilegovan\u00fdm pou\u017e\u00edvate\u013eom (od jadra Linux 5.11 s povolen\u00edm neprivilegovan\u00fdch user namespace). Probl\u00e9m bol odstr\u00e1nen\u00fd vo vetve jadra 6.2. Publikovanie aktualiz\u00e1ci\u00ed bal\u00ed\u010dkov v distrib\u00faci\u00e1ch je mo\u017en\u00e9 sledova\u0165 na str\u00e1nkach: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch.           <\/p>\n<p>\u00datok sa vykon\u00e1va prostredn\u00edctvom kop\u00edrovania s\u00faborov s flagmi setgid\/setuid z oddielu pripojen\u00e9ho v re\u017eime nosuid do oddielu OverlayFS, ktor\u00fd m\u00e1 vrstvy spojen\u00e9 s oddielom, ktor\u00fd povo\u013euje vykon\u00e1vanie suid s\u00faborov. Zranite\u013enos\u0165 je podobn\u00e1 probl\u00e9mu CVE-2021-3847, zisten\u00e9mu v roku 2021, ale m\u00e1 ni\u017e\u0161ie po\u017eiadavky na vyu\u017eitie \u2014 v star\u0161om probl\u00e9me sa vy\u017eadovali manipul\u00e1cie s xattrs, ktor\u00e9 s\u00fa obmedzen\u00e9 pri pou\u017e\u00edvan\u00ed priestorov identifik\u00e1torov pou\u017e\u00edvate\u013eov (user namespace), a v novom probl\u00e9me sa pou\u017e\u00edvaj\u00fa bity setgid\/setuid, ktor\u00e9 sa \u0161peci\u00e1lne nevyhodnocuj\u00fa v user namespace.    <\/p>\n<p>Algoritmus vykonania \u00fatoku:  <\/p>\n<ul>\n<li class=\"l\"> S\u00faborov\u00fd syst\u00e9m je pripojen\u00fd pomocou subsyst\u00e9mu FUSE, v ktorom je spustite\u013en\u00fd s\u00fabor patriaci pou\u017e\u00edvate\u013eovi root s flagmi setuid\/setgid, dostupn\u00fd v\u0161etk\u00fdm pou\u017e\u00edvate\u013eom na z\u00e1pis. Pri pripojen\u00ed FUSE nastavuje re\u017eim \u201enosuid\u201c.\n<li class=\"l\"> Zru\u0161uj\u00fa sa (unshare) priestory identifik\u00e1torov pou\u017e\u00edvate\u013eov a bodov montovania (user\/mount namespace).\n<li class=\"l\"> OverlayFS je pripojen\u00fd s ur\u010den\u00edm predt\u00fdm vytvoren\u00e9ho s\u00faborov\u00e9ho syst\u00e9mu v FUSE ako spodnej vrstvy a hornou vrstvou na b\u00e1ze adres\u00e1ra, ktor\u00fd povo\u013euje z\u00e1pis. Adres\u00e1r hornej vrstvy by mal by\u0165 umiestnen\u00fd v s\u00faborovom syst\u00e9me, pri ktor\u00e9ho pripojen\u00ed sa nepou\u017e\u00edva flag \u201enosuid\u201c.\n<li class=\"l\"> Pre suid s\u00fabor v FUSE oddiele sa n\u00e1strojom touch zmen\u00ed \u010das modifik\u00e1cie, \u010do vedie k jeho kop\u00edrovaniu do hornej vrstvy OverlayFS.\n<li class=\"l\"> Pri kop\u00edrovan\u00ed jadro nezru\u0161\u00ed flagy setgid\/setuid, \u010do vedie k tomu, \u017ee sa s\u00fabor objav\u00ed v oddiele, ktor\u00fd povoluje spracovanie setgid\/setuid.\n<li class=\"l\"> Na z\u00edskanie pr\u00e1v root sta\u010d\u00ed spusti\u0165 s\u00fabor s flagami setgid\/setuid z adres\u00e1ra pripojen\u00e9ho k hornej vrstve OverlayFS.  <\/ul>\n<p>\u010ealej mo\u017eno poznamena\u0165 odhalenie v\u00fdskumn\u00edkmi z t\u00edmu Google Project Zero inform\u00e1ci\u00ed o troch zranite\u013enostiach, ktor\u00e9 boli opraven\u00e9 v hlavnej vetve jadra Linux 5.15, ale neboli prenesen\u00e9 do bal\u00ed\u010dkov s jadrom z RHEL 8.x\/9.x a CentOS Stream 9.  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-1252 \u2014 pr\u00edstup k u\u017e uvo\u013enenej oblasti pam\u00e4te v \u0161trukt\u00fare ovl_aio_req pri s\u00fabe\u017enom vykon\u00e1van\u00ed viacer\u00fdch oper\u00e1ci\u00ed v OverlayFS, vy\u017eaduj\u00facej sa nad s\u00faborov\u00fdm syst\u00e9mom Ext4. Potenci\u00e1lne t\u00e1to zranite\u013enos\u0165 umo\u017e\u0148uje zv\u00fd\u0161i\u0165 svoje privil\u00e9gi\u00e1 v syst\u00e9me.\n<li class=\"l\"> CVE-2023-0590 \u2014 pr\u00edstup k u\u017e uvo\u013enenej oblasti pam\u00e4te v funkcii qdisc_graft(). Predpoklad\u00e1 sa, \u017ee vyu\u017eitie je obmedzen\u00e9 na havarijn\u00e9 ukon\u010denie.\n<li class=\"l\"> CVE-2023-1249 \u2014 pr\u00edstup k u\u017e uvo\u013enenej oblasti pam\u00e4te v k\u00f3de z\u00e1pisu coredump, vypl\u00fdvaj\u00faceho z vynechan\u00e9ho volania mmap_lock vo file_files_note. Predpoklad\u00e1 sa, \u017ee vyu\u017eitie je obmedzen\u00e9 na havarijn\u00e9 ukon\u010denie.    <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58857\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 OverlayFS \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c (\u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u044f\u0434\u0440\u0430 Linux 5.11 \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 user namespace). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0442\u043a\u0435 \u044f\u0434\u0440\u0430 6.2. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107498","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OverlayFS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-03-24T10:48:20+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-24T18:21:30+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v OverlayFS, ktor\u00e1 umo\u017e\u0148uje zv\u00fd\u0161i\u0165 svoje opr\u00e1vnenia | ProHoster","description":"V jadre Linuxu bola zisten\u00e1 zranite\u013enos\u0165 v implement\u00e1cii s\u00faborov\u00e9ho syst\u00e9mu OverlayFS (CVE-2023-0386), ktor\u00fa je mo\u017en\u00e9 vyu\u017ei\u0165 na z\u00edskanie root-pr\u00edstupu na syst\u00e9moch, v ktor\u00fdch je nain\u0161talovan\u00e1 pods\u00fastava FUSE a je povolen\u00e1.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OverlayFS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b OverlayFS \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-0386), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 FUS\u0415 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-24T10:48:20+00:00","article:modified_time":"2023-03-24T18:21:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=107498"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107498\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=107498"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=107498"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=107498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}