{"id":100168,"date":"2021-05-14T16:23:07","date_gmt":"2021-05-14T14:23:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2021-05-14T16:23:07","modified_gmt":"2021-05-14T14:23:07","slug":"uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"Vulnerabilitetet n\u00eb n\u00ebn-sistemin e eBPF, t\u00eb cilat lejojn\u00eb ekzekutimin e kodit n\u00eb nivelin e b\u00ebrtham\u00ebs Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb zbuluar dy dob\u00ebsi t\u00eb reja n\u00eb n\u00ebnnd\u00ebrtes\u00ebn e eBPF, e cila lejon ekzekutimin e trajtuesve brenda b\u00ebrtham\u00ebs Linux n\u00eb nj\u00eb makin\u00eb virtuale speciale me JIT. T\u00eb dyja dob\u00ebsit\u00eb ofrojn\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb ekzekutuar kodin tuaj me t\u00eb drejtat e b\u00ebrtham\u00ebs, jasht\u00eb makin\u00ebs virtuale t\u00eb izoluara eBPF. Informacioni mbi probleme \u00ebsht\u00eb publikuar nga ekipi i Zero Day Initiative, i cili organizon garat Pwn2Own, gjat\u00eb t\u00eb cilave k\u00ebt\u00eb vit u demonstruan tre sulme ndaj Ubuntu Linux, t\u00eb cilat p\u00ebrdor\u00ebn dob\u00ebsi t\u00eb panjohura m\u00eb par\u00eb (nuk \u00ebsht\u00eb raportuar n\u00ebse dob\u00ebsit\u00eb n\u00eb eBPF lidhen me k\u00ebto sulme). <\/p>\n
\n
CVE-2021-3490 \u2014 nj\u00eb vulnerabilitet i shkaktuar nga mungesa e kontrollit t\u00eb daljes p\u00ebrtej kufijve t\u00eb vlerave 32-bit gjat\u00eb kryerjes s\u00eb operacioneve bitore AND, OR dhe XOR n\u00eb eBPF ALU32. Nj\u00eb sulmues mund t\u00eb shfryt\u00ebzoj\u00eb k\u00ebt\u00eb gabim p\u00ebr t\u00eb lexuar dhe shkruar t\u00eb dh\u00ebna jasht\u00eb kufijve t\u00eb memorie t\u00eb rezervuar. Problemi me operacionin XOR shfaqet q\u00eb nga versioni 5.7-rc1 i b\u00ebrtham\u00ebs, nd\u00ebrsa AND dhe OR \u2014 q\u00eb nga publikimi 5.10-rc1.\n
CVE-2021-3489 \u2014 nj\u00eb vulnerabilitet i shkaktuar nga nj\u00eb gabim n\u00eb implementimin e buffer-it t\u00eb unaz\u00ebs dhe lidhet me faktin se funksioni bpf_ringbuf_reserve nuk kontrollonte n\u00ebse madh\u00ebsia e hap\u00ebsir\u00ebs s\u00eb rezervuar mund t\u00eb ishte m\u00eb e vog\u00ebl se madh\u00ebsia reale e buffer-it t\u00eb unaz\u00ebs ringbuf. Problemi shfaqet q\u00eb nga publikimi 5.8-rc1. <\/ul>\n
Statusi i rregullimeve t\u00eb dob\u00ebsive n\u00eb shp\u00ebrndarjet mund t\u00eb ndjeket n\u00eb k\u00ebto faqe: Ubuntu, Debian, RHEL, Fedora, SUSE, Arch. Rregullimet jan\u00eb gjithashtu t\u00eb disponueshme n\u00eb form\u00ebn e patch-eve (CVE-2021-3489, CVE-2021-3490). Mund\u00ebsia p\u00ebr t\u00eb shfryt\u00ebzuar problemin varet nga disponueshm\u00ebria e thirrjes sistemike eBPF p\u00ebr p\u00ebrdoruesin. P\u00ebr shembull, n\u00eb konfigurimin e parazgjedhur n\u00eb RHEL, p\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsin\u00eb k\u00ebrkohet q\u00eb p\u00ebrdoruesi t\u00eb ket\u00eb t\u00eb drejtat CAP_SYS_ADMIN. <\/p>\n
Ve\u00e7an\u00ebrisht, mund t\u00eb p\u00ebrmendet nj\u00eb tjet\u00ebr vulnerabilitet n\u00eb b\u00ebrtham\u00ebn Linux \u2014 CVE-2021-32606, i cili lejon nj\u00eb p\u00ebrdorues lokal t\u00eb rris\u00eb privilegjet e tij n\u00eb nivelin root. Problemi shfaqet q\u00eb nga b\u00ebrthama Linux 5.11 dhe shkaktohet nga nj\u00eb gjendje garanc\u00eb n\u00eb implementimin e protokollit CAN ISOTP, e cila lejon ndryshimin e parametrave t\u00eb lidhjes me soketin p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb vendosjes s\u00eb bllokimeve t\u00eb duhura n\u00eb funksionin isotp_setsockopt() gjat\u00eb p\u00ebrpunimit t\u00eb flagut CAN_ISOTP_SF_BROADCAST. <\/p>\n
Pas mbylljes s\u00eb soketit, ISOTP vazhdon t\u00eb ruaj\u00eb lidhjen me soketin e marr\u00ebsit, i cili mund t\u00eb vazhdoj\u00eb t\u00eb p\u00ebrdor\u00eb struktura t\u00eb lidhura me soketin pas lirimit t\u00eb memorjes s\u00eb lidhur me to (use-after-free p\u00ebr shkak t\u00eb fuqizimit gjat\u00eb thirrjes isotp_rcv() n\u00eb nj\u00eb struktur\u00eb isotp_sock q\u00eb \u00ebsht\u00eb liruar tashm\u00eb). N\u00ebp\u00ebrmjet manipulimeve me t\u00eb dh\u00ebnat, mund t\u00eb arrihet t\u00eb mbizot\u00ebrohet treguesi n\u00eb funksionin sk_error_report() dhe t\u00eb ekzekutohet kodi juaj n\u00eb nivelin e b\u00ebrtham\u00ebs. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"