V subsyst\u00e9me eBPF, ktor\u00fd umo\u017e\u0148uje sp\u00fa\u0161\u0165a\u0165 obsluhy na sledovanie, anal\u00fdzu \u010dinnosti subsyst\u00e9mov a spr\u00e1vu prenosu, vykon\u00e1van\u00e9 v r\u00e1mci jadra Linuxu v \u0161peci\u00e1lnom virtu\u00e1lnom stroji s JIT, bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2021-29154), ktor\u00e1 umo\u017e\u0148uje lok\u00e1lnemu pou\u017e\u00edvate\u013eovi vykona\u0165 svoj k\u00f3d na \u00farovni jadra. Probl\u00e9m sa prejavuje a\u017e do verzie 5.11.12 (vr\u00e1tane) a e\u0161te nebol opraven\u00fd v distrib\u00faci\u00e1ch (Debian, Ubuntu, RHEL, Fedora, SUSE, Arch). Oprava je dostupn\u00e1 vo forme patchu. <\/p>\n
Pod\u013ea vyhl\u00e1senia v\u00fdskumn\u00edkov, ktor\u00ed odhalili zranite\u013enos\u0165, sa im podarilo vyvin\u00fa\u0165 funk\u010dn\u00fd prototyp exploit pre 32- a 64-bitov\u00e9 syst\u00e9my x86, ktor\u00fd m\u00f4\u017ee by\u0165 pou\u017eit\u00fd nepovolen\u00fdm pou\u017e\u00edvate\u013eom. Pri tom spolo\u010dnos\u0165 Red Hat uv\u00e1dza, \u017ee nebezpe\u010denstvo probl\u00e9mu z\u00e1vis\u00ed od dostupnosti syst\u00e9mov\u00e9ho volania eBPF pou\u017e\u00edvate\u013eovi. Napr\u00edklad v RHEL a v\u00e4\u010d\u0161ine in\u00fdch distrib\u00faci\u00ed Linuxu v predvolenej konfigur\u00e1cii m\u00f4\u017ee by\u0165 zranite\u013enos\u0165 zneu\u017eit\u00e1 pri zapnut\u00ed BPF JIT a pr\u00edtomnosti pr\u00e1v CAP_SYS_ADMIN u pou\u017e\u00edvate\u013ea. Ako obch\u00e1dzaj\u00face opatrenie sa odpor\u00fa\u010da vypn\u00fa\u0165 BPF JIT pomocou pr\u00edkazu: echo 0 > \/proc\/sys\/net\/core\/bpf_jit_enable <\/p>\n
Probl\u00e9m je sp\u00f4soben\u00fd chybou v presnosti v\u00fdpo\u010dtu posunutia pre pr\u00edkazy vetvenia po\u010das generovania strojov\u00e9ho k\u00f3du JIT-kompil\u00e1torom. Konkr\u00e9tne sa pri generovan\u00ed in\u0161trukci\u00ed vetvenia nezoh\u013ead\u0148uje, \u017ee posunutie sa m\u00f4\u017ee zmeni\u0165 po f\u00e1ze optimaliz\u00e1cie. Uveden\u00e1 nedostatok m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 na vytvorenie abnorm\u00e1lneho strojov\u00e9ho k\u00f3du a jeho vykonanie na \u00farovni jadra. <\/p>\n
Zauj\u00edmav\u00e9 je, \u017ee nie je to jedin\u00e1 zranite\u013enos\u0165 v subsyst\u00e9me eBPF v poslednej dobe. Na konci marca boli v jadre objaven\u00e9 \u010fal\u0161ie dve zranite\u013enosti (CVE-2020-27170, CVE-2020-27171), ktor\u00e9 poskytuj\u00fa mo\u017enos\u0165 vyu\u017ei\u0165 eBPF na ob\u00eddenie ochrany pred zranite\u013enos\u0165ami triedy Spectre, ktor\u00e9 umo\u017e\u0148uj\u00fa z\u00edska\u0165 obsah pam\u00e4te jadra na z\u00e1klade vytvorenia podmienok pre \u0161pekulat\u00edvne vykon\u00e1vanie ur\u010dit\u00fdch oper\u00e1ci\u00ed. Na \u00fatok Spectre je potrebn\u00e9, aby v privilegovanom k\u00f3de bola ur\u010dit\u00e1 sekvencia pr\u00edkazov, ktor\u00e1 vedie k \u0161pekulat\u00edvnemu vykon\u00e1vaniu in\u0161trukci\u00ed. V eBPF sa na\u0161lo nieko\u013eko sp\u00f4sobov generovania podobn\u00fdch in\u0161trukci\u00ed prostredn\u00edctvom manipul\u00e1cie s pred\u00e1van\u00fdmi BPF-programami. <\/p>\n
Zranite\u013enos\u0165 CVE-2020-27170 je sp\u00f4soben\u00e1 pr\u00edtomnos\u0165ou manipul\u00e1ci\u00ed s ukazovate\u013emi vo verific\u00e1tore BPF, ktor\u00e9 sp\u00f4sobuj\u00fa spekulat\u00edvne oper\u00e1cie pr\u00edstupu do oblasti mimo hran\u00edc buffera. Zranite\u013enos\u0165 CVE-2020-27171 sa t\u00fdka chyby celo\u010d\u00edselnej aritmetiky (integer underflow) pri pr\u00e1ci s ukazovate\u013emi, ktor\u00e1 vedie k spekulat\u00edvnemu pr\u00edstupu k \u00fadajom mimo buffera. Uveden\u00e9 probl\u00e9my boli u\u017e odstr\u00e1nen\u00e9 vo verzi\u00e1ch jadra 5.11.8, 5.10.25, 5.4.107, 4.19.182 a 4.14.227, a taktie\u017e s\u00fa s\u00fa\u010das\u0165ou aktualiz\u00e1ci\u00ed jadra v\u00e4\u010d\u0161iny distrib\u00faci\u00ed Linux. V\u00fdskumn\u00edci pripravili prototyp exploit, ktor\u00fd umo\u017e\u0148uje neprivilegovan\u00e9mu pou\u017e\u00edvate\u013eovi extrahova\u0165 \u00fadaje z pam\u00e4te jadra. \u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29154), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 5.11.12 (\u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e) \u0438 \u0435\u0449\u0451 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 (Debian, Ubuntu, RHEL, Fedora, SUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99693","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v subsyst\u00e9me eBPF jadra Linux | ProHoster","description":"V subsyst\u00e9me eBPF, ktor\u00fd umo\u017e\u0148uje sp\u00fa\u0161\u0165a\u0165 spracovate\u013eov na sledovanie, anal\u00fdzu \u010dinnosti subsyst\u00e9mov a spr\u00e1vu prem\u00e1vky, vykon\u00e1van\u00fdch v r\u00e1mci jadra Linux v \u0161peci\u00e1lnej virtu\u00e1lnej ma\u0161ine s JIT, bola zisten\u00e1 zranite\u013enos\u0165.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u044f\u0434\u0440\u0430 Linux \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0441 JIT, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-09T14:22:51+00:00","article:modified_time":"2021-04-09T14:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99693","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-09 14:30:13","updated":"2022-09-30 04:24:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=99693"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99693\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=99693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=99693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=99693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"