{"id":110411,"date":"2023-10-04T08:10:45","date_gmt":"2023-10-04T06:10:45","guid":{"rendered":"https:\/\/prohoster.info\/?p=110411"},"modified":"2023-10-04T08:10:45","modified_gmt":"2023-10-04T06:10:45","slug":"uyazvimost-v-glibc-ld-so-pozvolyayushhaya-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimost-v-glibc-ld-so-pozvolyayushhaya-poluchit-prava-root-v-sisteme","title":{"rendered":"Vulnerability in Glibc ld.so allowing root access on the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Company Qualys has discovered a dangerous vulnerability (CVE-2023-4911) in the ld.so linker provided with the standard C library Glibc (GNU libc). This vulnerability allows a local user to escalate their privileges on the system by setting specially crafted data in the GLIBC_TUNABLES environment variable before executing a file with the suid root flag, for example, \/usr\/bin\/su. <\/p>\n

The successful exploitation of the vulnerability has been demonstrated in Fedora 37 and 38, Ubuntu 22.04 and 23.04, Debian 12 and 13. It is presumed that the vulnerability is present in any other distributions using Glibc. Distributions based on the Musl C library, such as Alpine Linux, are not affected. The vulnerability has been patched in an update released on October 2. Updates for packages in distributions can be tracked on the pages of Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, Gentoo, ALT Linux. <\/p>\n

Ranljivost je posledica sprememb, ki so bile uvedene aprila 2021 in so postale del izdaje glibc 2.34. Zaradi napake v kodi za obdelavo nizov, ki je navedena v spremenljivki okolja GLIBC_TUNABLES, nepravilna kombinacija parametrov v tej spremenljivki povzro\u010da pisanje raz\u010dlenjenega vrednosti izven dodeljenega pomnilnika. Problem se poka\u017ee, ko namesto obi\u010dajnih zaporedij «name=val», parametri dolo\u010dajo dvojno dodelitev «name=name=val». V tem primeru se dodelitev obdeluje dvakrat, najprej kot «name=name=val», nato pa kot «name=val». Zaradi tak\u0161nega dvojnega obdelovanja nastane rezultat «name=name=val:name=val», katerega velikost presega velikost pomnilnika tunestr. <\/p>\n

Raziskovalci so razvili stabilno delujo\u010do exploite, ki omogo\u010da pridobitev pravic root pri uporabi skoraj vsake programske opreme s flago suid root. Izjema so orodje sudo (spremeni vrednost ELF RUNPATH), orodja chage in passwd v Fedori (za\u0161\u010ditena z lo\u010denimi pravili SELinux) ter orodje snap-confine v Ubuntuju (za\u0161\u010ditena z lo\u010denimi pravili AppArmor). Predlagana metoda izkori\u0161\u010danja prav tako ne deluje v RHEL 8 in RHEL 9, \u010deprav sta ta razli\u010dica izpostavljena ranljivosti (za napad je potrebno ustvariti drug exploit). Koda exploita bo objavljena kasneje, po popolni odpravi ranljivosti. Preverite, ali je va\u0161 sistem izpostavljen ranljivosti, z spodnjo navedeno ukazno vrstico, ki se bo v primeru te\u017eave zaklju\u010dila s crashom: env -i \"GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A\" \"Z=`printf '192x' 1`\" \/usr\/bin\/su --help <\/p>\n

Zaznamuje se odprava \u0161e dveh ranljivosti v Glibc: <\/p>\n