Kusagadzikana mu e2fsck kana uchigadzira akagadzirwa madhairekitori

Mune e2fsck utility inopihwa sechikamu chepakeji eprwoprogs, kuzivikanwa vulnerability (CVE-2019-5188), iyo inokutendera kuti uite kodhi yeanorwisa kana uchitarisa faira system ine akagadzirirwa akagadzirwa madhairekitori. Kusagadzikana kwakasimbiswa mukuburitswa 1.43.3 kusvika 1.45.4. Kusagadzikana kwakagadziriswa mukuvandudza e2fsck 1.45.5. Mumakiti ekugovera dambudziko richiri risina kugadziriswa (Debian, Arch Linux, SUSE/openSUSE, Ubuntu, RHEL).

Kukanganisa kunokonzerwa nekukanganisa mutate_name () basa mufaira rehash.c, rinoshandiswa pakuvaka patsva matafura ehashi ane chekuita nedhairekitori, kuve nechokwadi chekuti mafaera ese ari mudhairekitori anoenderana nedhairekitori. Huwori hwehash_entry structure ine chekuita nedhairekitori inogona kuita kuti anorwisa anyore data kune imwe nzvimbo iri kunze kwebhafa yakagoverwa. Kana mafaera akati wandei ane zita rimwechete akaonekwa muhashi tafura seakabatanidzwa kune dhairekitori, iyo e2fsck utility inotumidza zvakare mafaera akapetwa nekuwedzera ~ 0, ~ 1, nezvimwe kune zita. Kuchengeta zita idzva kwenguva pfupi panguva yekupa zita, buffer ye256 bytes muhukuru inopihwa pane stack.

Ukuru hwe data inofanira kukopwa inotarirwa neshoko rokuti "entry-> name_len & 0xff", asi kukosha kwekupinda-> zita_len rinotakurwa kubva pane chimiro pane disk pane kuverengwa kubva pakukura chaiko kwezita. Kana saizi iri zero, saka iyo array index inotora kukosha -1 uye mamiriro anogadzirwa kuti afashuke nepakati pemuganho wezasi webuffer (integer underflow) uye kupfuudza imwe data pastack ine kukosha "~ 0". Kune 64-bit masisitimu, kushandiswa kwekusagadzikana kunoongororwa sezvisingaite uye hakudi kurambidzwa pakukura kwestack (ulimit -s unlimited). Kune 32-bit masisitimu, kubiridzira kunoonekwa sekugoneka, asi mhedzisiro inotsamira zvakanyanya pamaitirwo ezvinoitwa zvakaunganidzwa nemuunganidzi.

Kuti uite kurwisa, munhu anorwisa anofanirwa kukanganisa iyo data neimwe nzira muchikamu ne ext2, ext3 kana ext4 faira system. Sezvo kuvhiya uku kuchida ropafadzo dzepamusoro, kusazvibata kunoisa njodzi kana iyo e2fsck utility inoongorora ekunze madhiraivha kana kunze yakagamuchirwa mifananidzo yeFS.

Source: opennet.ru

Voeg