{"id":100767,"date":"2021-07-15T16:22:45","date_gmt":"2021-07-15T14:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-yadra-linux-netfilter"},"modified":"2021-07-15T16:22:45","modified_gmt":"2021-07-15T14:22:45","slug":"uyazvimost-v-podsisteme-yadra-linux-netfilter","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-yadra-linux-netfilter","title":{"rendered":"Dob\u00ebsia n\u00eb sistemin e b\u00ebrtham\u00ebs Linux Netfilter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb Netfilter, sistemin e b\u00ebrtham\u00ebs Linux t\u00eb p\u00ebrdorur p\u00ebr filtrimin dhe modifikimin e paketave rrjet, \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2021-22555) q\u00eb lejon nj\u00eb p\u00ebrdorues lokal t\u00eb fitoj\u00eb privilegje root n\u00eb sistem, madje edhe duke qen\u00eb n\u00eb nj\u00eb konteiner t\u00eb izoluar. P\u00ebr testim \u00ebsht\u00eb p\u00ebrgatitur nj\u00eb prototip funksional i nj\u00eb eksploiti q\u00eb kalon mekanizmat e mbrojtjes KASLR, SMAP dhe SMEP. K\u00ebrkuesi q\u00eb zbuloi dob\u00ebsin\u00eb mori nj\u00eb shp\u00ebrblim prej 20 mij\u00eb dollar\u00ebsh nga Google p\u00ebr zbules\u00ebn e m\u00ebnyr\u00ebs s\u00eb kalimit t\u00eb izolimit t\u00eb konteiner\u00ebve Kubernetes n\u00eb klasterin kCTF. <\/p>\n
Problemi \u00ebsht\u00eb evidentuar q\u00eb nga b\u00ebrthama 2.6.19, e l\u00ebshuar 15 vjet m\u00eb par\u00eb, dhe shkaktohet nga nj\u00eb gabim n\u00eb trajtuesit IPT_SO_SET_REPLACE dhe IP6T_SO_SET_REPLACE, i cili \u00e7on n\u00eb mbiprodhim t\u00eb memories kur d\u00ebrgohen parametra t\u00eb ve\u00e7anta p\u00ebrmes thirrjes setsockopt n\u00eb modalitetin compat. N\u00eb kushte normale, thirrja compat_setsockopt() mund t\u00eb ekzekutohet vet\u00ebm nga p\u00ebrdoruesi root, por autorizimet e nevojshme p\u00ebr t\u00eb kryer sulmin gjithashtu mund t\u00eb merren nga nj\u00eb p\u00ebrdorues i pap\u00ebrgjegjsh\u00ebm n\u00eb sistemet me mb\u00ebshtetje p\u00ebr emrat e hap\u00ebsirave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespaces). <\/p>\n
P\u00ebrdoruesi mund t\u00eb krijoj\u00eb nj\u00eb kontejner me nj\u00eb p\u00ebrdorues t\u00eb ve\u00e7ant\u00eb root dhe t\u00eb shfryt\u00ebzoj\u00eb k\u00ebshtu nj\u00eb cenueshm\u00ebri. P\u00ebr shembull, \u00abuser namespaces\u00bb \u00ebsht\u00eb aktivizuar si parazgjedhje n\u00eb Ubuntu dhe Fedora, por nuk \u00ebsht\u00eb aktivizuar n\u00eb Debian dhe RHEL. Patch-i p\u00ebr korrigjimin e cenueshm\u00ebris\u00eb u pranua n\u00eb b\u00ebrtham\u00ebn Linux m\u00eb 13 prill. P\u00ebrdit\u00ebsimet e pakove jan\u00eb tashm\u00eb p\u00ebrgatitur nga projektet Debian, Arch Linux dhe Fedora. N\u00eb Ubuntu, RHEL dhe SUSE, p\u00ebrdit\u00ebsimet jan\u00eb n\u00eb faz\u00ebn e p\u00ebrgatitjes. <\/p>\n
Problemi ndodh n\u00eb funksionin xt_compat_target_from_user() p\u00ebr shkak t\u00eb llogaritjes jokorrekte t\u00eb madh\u00ebsis\u00eb s\u00eb memories gjat\u00eb ruajtjes s\u00eb strukturave t\u00eb b\u00ebrtham\u00ebs pas konvertimit nga p\u00ebrfaq\u00ebsimi 32-bit n\u00eb 64-bit. Gabimi lejon t\u00eb shkruhen kat\u00ebr byte t\u00eb zero n\u00eb \u00e7do pozicion jasht\u00eb buffers t\u00eb ve\u00e7uar, t\u00eb kufizuar nga offseti 0x4C. Kjo mund\u00ebsi doli t\u00eb ishte e mjaftueshme p\u00ebr t\u00eb krijuar nj\u00eb eksploit q\u00eb mund\u00ebsonte marrjen e t\u00eb drejtave root \u2014 duke pastruar treguesin m_list->next n\u00eb struktur\u00ebn msg_msg, u krijuan kushte p\u00ebr t'u drejtuar n\u00eb t\u00eb dh\u00ebnat pas \u00e7lirimit t\u00eb memories (use-after-free), e cila m\u00eb von\u00eb u p\u00ebrdor p\u00ebr t\u00eb marr\u00eb informacione rreth adresave dhe p\u00ebr t\u00eb ndryshuar struktura t\u00eb tjera p\u00ebrmes manipulimit me thirrjen sistemore msgsnd(). \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"