{"id":100548,"date":"2021-06-20T10:22:54","date_gmt":"2021-06-20T08:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm"},"modified":"2021-06-20T10:22:54","modified_gmt":"2021-06-20T08:22:55","slug":"uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-yadre-linux-zatragivayushhaya-setevoj-protokol-can-bcm","title":{"rendered":"Dob\u00ebsi n\u00eb kernelin Linux q\u00eb prek protokollin e rrjetit CAN BCM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb kernelin Linux \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2021-3609) q\u00eb i lejon nj\u00eb p\u00ebrdoruesi lokal t\u00eb rris\u00eb privilegjet e tij n\u00eb sistem. Problemi shkaktohet nga nj\u00eb race condition n\u00eb implementimin e protokollit CAN BCM dhe shfaqet n\u00eb versionet e kernelit Linux nga 2.6.25 deri te 5.13-rc6. N\u00eb distribucionet, problemi ende mbetet i pazgjidhur (RHEL, Fedora, Debian, Ubuntu, SUSE, Arch). <\/p>\n
Studiuesi q\u00eb zbuloi dob\u00ebsin\u00eb arriti t\u00eb p\u00ebrgatis\u00eb nj\u00eb exploit p\u00ebr marrjen e t\u00eb drejtave root n\u00eb sisteme me kernel Linux 5.4 e m\u00eb t\u00eb reja; mes t\u00eb tjerash, u demonstrua mund\u00ebsia e nj\u00eb sulmi t\u00eb suksessh\u00ebm n\u00eb Ubuntu 20.04.02 LTS. Nuk p\u00ebrjashtohet mund\u00ebsia e p\u00ebrshtatjes s\u00eb exploit-it edhe p\u00ebr kernel\u00eb m\u00eb t\u00eb vjet\u00ebr (n\u00eb kernelin 5.4 kodi CAN BCM (net\/can\/bcm.c) u kalua nga hrtimer_tasklet n\u00eb HRTIMER_MODE_SOFT). <\/p>\n
Protokolli CAN BCM lejon regjistrimin e nj\u00eb p\u00ebrpunuesi t\u00eb personalizuar p\u00ebr mesazhet q\u00eb vijn\u00eb p\u00ebrmes bus-it CAN (controller area network) dhe lidhjen e tij me nj\u00eb socket t\u00eb caktuar t\u00eb rrjetit. Kur mb\u00ebrrin nj\u00eb mesazh hyr\u00ebs, thirret funksioni bcm_rx_handler(). Sulmuesi mund t\u00eb shfryt\u00ebzoj\u00eb race condition dhe t\u00eb arrij\u00eb mbylljen e socket-it t\u00eb rrjetit nj\u00ebkoh\u00ebsisht me ekzekutimin e bcm_rx_handler(). Gjat\u00eb mbylljes s\u00eb socket-it thirret funksioni bcm_release(), n\u00eb t\u00eb cilin lirohet memoria e caktuar p\u00ebr strukturat bcm_op dhe bcm_sock, t\u00eb cilat vazhdojn\u00eb t\u00eb p\u00ebrdoren nga p\u00ebrpunuesi bcm_rx_handler() q\u00eb ende po ekzekutohet. Kjo krijon nj\u00eb situat\u00eb q\u00eb \u00e7on n\u00eb akses te nj\u00eb bllok memorieje i liruar tashm\u00eb (use-after-free). <\/p>\n
Sulmi reduktohet n\u00eb hapjen e dy socket-eve CAN BCM dhe lidhjen e tyre me nd\u00ebrfaqen vcan. N\u00eb socket-in e par\u00eb kryhet thirrja sendmsg() me flamurin RX_SETUP p\u00ebr konfigurimin e p\u00ebrpunuesit t\u00eb mesazheve hyr\u00ebse CAN, nd\u00ebrsa n\u00eb socket-in e dyt\u00eb kryhet thirrja sendmsg() p\u00ebr d\u00ebrgimin e nj\u00eb mesazhi te socket-i i par\u00eb. Pasi mesazhi mb\u00ebrrin, aktivizohet thirrja bcm_rx_handler(), dhe sulmuesi zgjedh momentin e duhur p\u00ebr t\u00eb mbyllur socket-in e par\u00eb, gj\u00eb q\u00eb sjell nisjen e bcm_release() dhe lirimin e strukturave bcm_op dhe bcm_sock, edhe pse ekzekutimi i bcm_rx_handler() ende nuk ka p\u00ebrfunduar. <\/p>\n
Dollap\u00ebrmes manipulimeve me p\u00ebrmbajtjen bcm_sock, sulmuesi mund t\u00eb ridrejtoj\u00eb treguesin n\u00eb funksionin sk->sk_data_ready(sk), t\u00eb orientoj\u00eb ekzekutimin dhe, duke p\u00ebrdorur teknika t\u00eb programimit t\u00eb orientuar nga kthimi (ROP - Return-Oriented Programming), t\u00eb organizoj\u00eb ri-shkrimin e parametrave modprobe_path dhe t\u00eb arrij\u00eb realizimin e kodit t\u00eb tij me t\u00eb drejtat root. Duke p\u00ebrdorur teknik\u00ebn ROP, sulmuesi nuk p\u00ebrpiqet t\u00eb vendos\u00eb kodin e tij n\u00eb memorie, por operon me cop\u00ebza t\u00eb instrukcioneve t\u00eb makin\u00ebs q\u00eb ekzistojn\u00eb tashm\u00eb n\u00eb bibliotekat e ngarkuara, t\u00eb cilat p\u00ebrfundojn\u00eb me nj\u00eb instrukcion p\u00ebr kthimin e kontrollit (zakonisht, k\u00ebto jan\u00eb fundet e funksioneve t\u00eb bibliotekave). Puna e eksploitatit p\u00ebrmblidhet n\u00eb nd\u00ebrtimin e nj\u00eb zinxhiri thirrjesh t\u00eb cop\u00ebzave t\u00eb ngjashme (\"gadgets\") p\u00ebr t\u00eb marr\u00eb funksionalitetin e nevojsh\u00ebm.
<\/center> <\/p>\n
P\u00ebr sulmin k\u00ebrkohet qasje p\u00ebr krijimin e soket\u00ebve CAN dhe nj\u00eb nd\u00ebrfaqe rrjeti vcan e konfiguruar. T\u00eb drejtat e nevojshme p\u00ebr kryerjen e sulmit mund t\u00eb merren nga nj\u00eb p\u00ebrdorues i paprivilegjuar n\u00eb kontejner\u00ebt e krijuar n\u00eb sisteme me mb\u00ebshtetje t\u00eb aktivizuar p\u00ebr user namespaces. P\u00ebr shembull, user namespaces \u00ebsht\u00eb i aktivizuar si parazgjedhje n\u00eb Ubuntu dhe Fedora, por nuk \u00ebsht\u00eb aktiv n\u00eb Debian dhe RHEL. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Dob\u00ebsi](\"\/wp-content\/uploads\/2021\/06\/60534f0194a819c8401abf2ec53b3a9a.png\")
<\/center> <\/p>\n