{"id":170807,"date":"2026-05-16T06:24:35","date_gmt":"2026-05-16T04:24:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy"},"modified":"2026-05-16T06:24:35","modified_gmt":"2026-05-16T04:24:35","slug":"qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","title":{"rendered":"QEMUtiny \u2014 zranite\u013enosti v QEMU, ktor\u00e9 umo\u017e\u0148uj\u00fa pr\u00edstup k hostite\u013esk\u00e9mu prostrediu z hos\u0165ovsk\u00e9ho syst\u00e9mu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V\u00fdskumn\u00edci, ktor\u00ed ned\u00e1vno objavili zranite\u013enos\u0165 Fragnesia v jadre Linux, zverejnili inform\u00e1cie o zranite\u013enostiach v QEMU, ktor\u00e9 umo\u017e\u0148uj\u00fa z hostite\u013esk\u00e9ho prostredia z\u00edska\u0165 root pr\u00edstup z hos\u0165ovacej s\u00fastavy. Probl\u00e9me bolo pridelen\u00e9 k\u00f3dov\u00e9 meno QEMUtiny, av\u0161ak CVE identifik\u00e1tor e\u0161te nebol ur\u010den\u00fd. Bol pripraven\u00fd exploit, ktor\u00fd vyu\u017e\u00edva dve zranite\u013enosti v k\u00f3de emul\u00e1tora zariadenia CXL (Compute Express Link). <\/p>\n
Obe zranite\u013enosti s\u00fa pr\u00edtomn\u00e9 v k\u00f3de cxl-mailbox-utils.c. Prv\u00e1 zranite\u013enos\u0165 sa prejavuje od vydania QEMU 7.1.0 a vedie k \u010d\u00edtaniu pam\u00e4te z oblasti mimo pridelen\u00e9ho vyrovn\u00e1vacieho pam\u00e4te, preto\u017ee funkcia cmd_logs_get_log() chybne interpretuje po\u017eadovan\u00fa posun CEL-logu ako index v poli, hoci je ur\u010den\u00fd v bajtoch. Druh\u00e1 zranite\u013enos\u0165 sa prejavuje od QEMU 11.0.0 a vedie k prete\u010deniu vyrovn\u00e1vacej pam\u00e4te vo funkcii cmd_features_set_feature() z d\u00f4vodu spracovania posunu na \u0161trukt\u00farach pri z\u00e1pise atrib\u00fatov bez kontroly, \u010di vypo\u010d\u00edtan\u00e1 hodnota \u201eoffset + bytes_to_copy\u201c sa zmest\u00ed do ve\u013ekosti vybranej \u0161trukt\u00fary. <\/p>\n
V skuto\u010dnosti je \u00fatok mo\u017en\u00fd iba na posledn\u00fa vetvu QEMU 11.0.0. O oprave zatia\u013e neboli poskytnut\u00e9 \u017eiadne inform\u00e1cie, uveden\u00e9 je iba, \u017ee pred zverejnen\u00edm zranite\u013enosti bola inform\u00e1cia o nej zaslan\u00e1 v\u00fdvoj\u00e1rom QEMU, ktor\u00ed odpovedali, \u017ee podpora zariadenia CXL v QEMU bola implementovan\u00e1 nie na pou\u017eitie po\u010das virtualiz\u00e1cie. <\/p>\n
Exploit bol testovan\u00fd s k\u00f3dovou z\u00e1klad\u0148ou QEMU z 11. m\u00e1ja s posledn\u00fdm commitem 5e61afe. Fungovanie exploit-u z\u00e1vis\u00ed od rozlo\u017eenia \u0161trukt\u00far v pam\u00e4ti ka\u017edej konkr\u00e9tnej zostavy QEMU a syst\u00e9movej libc, ale pod\u013ea n\u00e1zoru v\u00fdskumn\u00edkov, vyu\u017eit\u00edm zranite\u013enosti na skenovanie pam\u00e4te, ktor\u00e1 vedie k \u010d\u00edtaniu z oblasti mimo bufferu, m\u00f4\u017ee by\u0165 vytvoren\u00fd univerz\u00e1lny exploit, ktor\u00fd funguje s r\u00f4znymi verziami QEMU. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"