{"id":100168,"date":"2021-05-14T16:23:07","date_gmt":"2021-05-14T14:23:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2021-05-14T16:23:07","modified_gmt":"2021-05-14T14:23:07","slug":"uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"Vulnerabilitete n\u00eb n\u00ebndrejtorin\u00eb e eBPF, q\u00eb lejojn\u00eb ekzekutimin e kodit n\u00eb nivelin e b\u00ebrtham\u00ebs Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb gjetur dy vulnerabilitete t\u00eb reja n\u00eb n\u00ebn-sistem eBPF, i cili lejon ekzekutimin e trajtesave brenda b\u00ebrtham\u00ebs Linux n\u00eb nj\u00eb makin\u00eb virtuale t\u00eb ve\u00e7ant\u00eb me JIT. T\u00eb dy vulnerabilitetet japin mund\u00ebsin\u00eb p\u00ebr t\u00eb ekzekutuar kodin me t\u00eb drejta b\u00ebrthamore, jasht\u00eb makin\u00ebs virtuale t\u00eb izoluar eBPF. Informacionin rreth problemeve e publikoi ekipi Zero Day Initiative, i cili organizon gara Pwn2Own, gjat\u00eb t\u00eb cilave k\u00ebt\u00eb vit u demonstruan tre sulme ndaj Ubuntu Linux, q\u00eb p\u00ebrdor\u00ebn vulnerabilitete t\u00eb panjohura deri m\u00eb tani (nuk raportohen lidhjet e vulnerabiliteteve n\u00eb eBPF me k\u00ebto sulme). <\/p>\n
\n
CVE-2021-3490 \u2014 dob\u00ebsia shkaktohet nga mungesa e kontrollit t\u00eb daljes p\u00ebrtej kufijve t\u00eb vlerave 32-bit kur kryhen operacione t\u00eb bit\u00ebve AND, OR dhe XOR n\u00eb eBPF ALU32. Nj\u00eb sulmues mund t\u00eb p\u00ebrfitoj\u00eb nga ky gabim p\u00ebr t\u00eb lexuar dhe shkruar t\u00eb dh\u00ebna jasht\u00eb kufijve t\u00eb tamponit t\u00eb ndar\u00eb. Problemi me operacionin XOR shfaqet q\u00eb nga versioni i b\u00ebrtham\u00ebs 5.7-rc1, nd\u00ebrsa AND dhe OR \u2014 q\u00eb nga l\u00ebshimi 5.10-rc1.\n
CVE-2021-3489 \u2014 dob\u00ebsia shkaktohet nga nj\u00eb gabim n\u00eb implementimin e tamponit rrethues dhe lidhet me at\u00eb q\u00eb funksioni bpf_ringbuf_reserve nuk kontrollonte mund\u00ebsin\u00eb q\u00eb madh\u00ebsia e hap\u00ebsir\u00ebs s\u00eb ndar\u00eb t\u00eb mund t\u00eb ishte m\u00eb e vog\u00ebl se madh\u00ebsia aktuale e tamponit ringbuf. Problemi shfaqet q\u00eb nga l\u00ebshimi 5.8-rc1. <\/ul>\n
Statusi i riparimit t\u00eb vulnerabiliteteve n\u00eb shp\u00ebrndarjet mund t\u00eb ndiqet n\u00eb k\u00ebto faqe: Ubuntu, Debian, RHEL, Fedora, SUSE, Arch). Riparimet jan\u00eb gjithashtu t\u00eb disponueshme n\u00eb form\u00ebn e patches (CVE-2021-3489, CVE-2021-3490). Mund\u00ebsia e shfryt\u00ebzimit t\u00eb problemit varet nga disponueshm\u00ebria p\u00ebr p\u00ebrdoruesin e thirrjes sistemore eBPF. P\u00ebr shembull, n\u00eb konfigurimin e parazgjedhur n\u00eb RHEL, p\u00ebr t\u00eb shfryt\u00ebzuar vulnerabilitetin k\u00ebrkohet q\u00eb p\u00ebrdoruesi t\u00eb ket\u00eb t\u00eb drejtat CAP_SYS_ADMIN. <\/p>\n
Ve\u00e7mas mund t\u00eb p\u00ebrmendet nj\u00eb tjet\u00ebr dob\u00ebsi n\u00eb b\u00ebrtham\u00ebn Linux \u2014 CVE-2021-32606, e cila lejon nj\u00eb p\u00ebrdorues lokal t\u00eb rris\u00eb privilegjet e tij n\u00eb nivelin root. Problemi shfaqet q\u00eb nga b\u00ebrthama Linux 5.11 dhe shkaktohet nga nj\u00eb gjendje garash n\u00eb implementimin e protokollit CAN ISOTP, i cili lejon ndryshimin e parametrave t\u00eb lidhjes me soket p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb vendosjes s\u00eb bllokimeve t\u00eb duhura n\u00eb funksionin isotp_setsockopt() gjat\u00eb p\u00ebrpunimit t\u00eb flamurit CAN_ISOTP_SF_BROADCAST. <\/p>\n
Pas mbylljes s\u00eb soketit ISOTP, lidhja me soketin e marr\u00ebsit vazhdon t\u00eb jet\u00eb aktive, e cila mund t\u00eb vazhdoj\u00eb t\u00eb p\u00ebrdor\u00eb strukturat e lidhura me soketin pas \u00e7lirimit t\u00eb kujtes\u00ebs p\u00ebrkat\u00ebse (use-after-free p\u00ebr shkak t\u00eb thirrjes n\u00eb isotp_rcv() ndaj nj\u00eb strukture isotp_sock t\u00eb \u00e7liruar tashm\u00eb). P\u00ebrmes manipulimit t\u00eb t\u00eb dh\u00ebnave \u00ebsht\u00eb e mundur t\u00eb arrihet ndryshimi i pointer-it n\u00eb funksionin sk_error_report() dhe t\u00eb ekzekutohet kodi i vet n\u00eb nivelin b\u00ebrthamor. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"