N\u00eb paket\u00ebn Cryptsetup, e p\u00ebrdorur p\u00ebr enkriptimin e ndarjeve t\u00eb disqeve n\u00eb Linux, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2021-4122), q\u00eb lejon, p\u00ebrmes modifikimit t\u00eb metadatat, \u00e7aktivizimin e enkriptimit n\u00eb ndarjet n\u00eb formatin LUKS2 (Linux Unified Key Setup). P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb vulnerabilitet, sulmuesi duhet t\u00eb ket\u00eb qasje fizike n\u00eb mediumin e enkriptuar, pra, ky metod\u00eb ka kuptim kryesisht p\u00ebr sulmet ndaj pajisjeve t\u00eb jashtme t\u00eb enkriptuara, si\u00e7 jan\u00eb disqet Flash, t\u00eb cilat sulmuesi ka akses, por nuk e di passwordin p\u00ebr dekripton e t\u00eb dh\u00ebnave. <\/p>\n
Sulmi aplikohet vet\u00ebm p\u00ebr formatin LUKS2 dhe lidhet me manipulimin e t\u00eb dh\u00ebnave meta, t\u00eb cilat kan\u00eb p\u00ebr detyr\u00eb aktivizimin e zgjerimit «online reencryption», \u00e7ka lejon q\u00eb, n\u00eb rast nevoje p\u00ebr t\u00eb nd\u00ebrruar \u00e7el\u00ebsin e aksesit, t\u00eb iniciohet procesi i rimenkimit t\u00eb t\u00eb dh\u00ebnave n\u00eb m\u00ebnyr\u00eb dinamike pa nd\u00ebrprer\u00eb pun\u00ebn me ndarjen. Duke qen\u00eb se procesi i dekodimit dhe kodimit me nj\u00eb \u00e7el\u00ebs t\u00eb ri merr shum\u00eb koh\u00eb, «online reencryption» ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb mos nd\u00ebrprer\u00eb pun\u00ebn me ndarjen dhe p\u00ebr t\u00eb kryer rimenkimin n\u00eb sfond, duke e kaluar gradualisht t\u00eb dh\u00ebnat nga nj\u00eb \u00e7el\u00ebs n\u00eb tjet\u00ebr. Po ashtu ekziston mund\u00ebsia e zgjedhjes s\u00eb nj\u00eb \u00e7el\u00ebsi t\u00eb synuar bosh, \u00e7ka lejon kalimin e ndarjes n\u00eb nj\u00eb form\u00eb t\u00eb dekoduar. <\/p>\n
Sulmuesi mund t\u00eb b\u00ebj\u00eb ndryshime n\u00eb metadata t\u00eb LUKS2 q\u00eb simulojn\u00eb nj\u00eb nd\u00ebrprerje t\u00eb papritur t\u00eb procesit t\u00eb dekriptimit si rezultat i nj\u00eb d\u00ebshtimi dhe t\u00eb arrij\u00eb t\u00eb dekriptoj\u00eb nj\u00eb pjes\u00eb t\u00eb seksionit pas aktivizimit dhe p\u00ebrdorimit t\u00eb diskut t\u00eb modifikuar nga pronari. N\u00eb k\u00ebt\u00eb rast, p\u00ebrdoruesi q\u00eb lidh diskun e modifikuar dhe e zhbllokon at\u00eb me nj\u00eb fjal\u00ebkalim t\u00eb sakt\u00eb, nuk merr asnj\u00eb paralajm\u00ebrim p\u00ebr realizimin e procesit t\u00eb rikuperimit t\u00eb operacionit t\u00eb nd\u00ebrprer\u00eb t\u00eb rinisjes dhe mund t\u00eb m\u00ebsoj\u00eb p\u00ebr ecurin\u00eb e k\u00ebtij operacioni vet\u00ebm p\u00ebrmes komand\u00ebs «luks Dump». Sasia e t\u00eb dh\u00ebnave q\u00eb sulmuesi mund t\u00eb arrij\u00eb t\u00eb dekriptoj\u00eb varen nga madh\u00ebsia e kok\u00ebs LUKS2, por me madh\u00ebsin\u00eb e paracaktuar (16 MiB) ajo mund t\u00eb tejkaloj\u00eb 3 GB. <\/p>\n
Problemi \u00ebsht\u00eb se, megjith\u00ebse ri-shifrimi k\u00ebrkon llogaritjen dhe verifikimin e hash-eve t\u00eb \u00e7el\u00ebsave t\u00eb rinj dhe t\u00eb vjet\u00ebr, p\u00ebr t\u00eb filluar dekripimin, hash-i nuk \u00ebsht\u00eb i nevojsh\u00ebm n\u00ebse gjendja e re n\u00ebnkupton mospranimin e nj\u00eb \u00e7el\u00ebsi p\u00ebr shifrimin (plaintext). P\u00ebr m\u00eb tep\u00ebr, metadat\u00ebt LUKS2, ku p\u00ebrcaktohet algoritmi i shifrimit, nuk jan\u00eb t\u00eb mbrojtura nga modifikimi n\u00eb rast se bien n\u00eb duar t\u00eb keqb\u00ebr\u00ebsve. P\u00ebr t\u00eb bllokuar k\u00ebt\u00eb dob\u00ebsi, zhvilluesit kan\u00eb shtuar nj\u00eb mbrojtje t\u00eb shtuar p\u00ebr metadat\u00ebt LUKS2, p\u00ebr t\u00eb cilat tani kontrollohet nj\u00eb hash i shtuar, i llogaritur mbi baz\u00ebn e \u00e7el\u00ebsave t\u00eb njohur dhe p\u00ebrmbajtjes s\u00eb metadatave, q\u00eb do t\u00eb thot\u00eb se tani sulmuesi nuk mund ta ndryshoj\u00eb n\u00eb heshtje metadat\u00ebn pa ditur fjal\u00ebkalimin p\u00ebr dekriptim. <\/p>\n
Nj\u00eb skenar standard sulmi k\u00ebrkon q\u00eb sulmuesi t\u00eb ket\u00eb mund\u00ebsi t\u00eb marr\u00eb disa her\u00eb pajisjen n\u00eb duar. Fillimisht, sulmuesi, q\u00eb nuk e di fjal\u00ebkalimin e aksesit, b\u00ebn ndryshime n\u00eb fush\u00ebn e metadata-ve, duke iniciuar dekriptimin e nj\u00eb pjese t\u00eb t\u00eb dh\u00ebnave gjat\u00eb aktivizimit t\u00eb ardhsh\u00ebm t\u00eb pajisjes. M\u00eb pas, pajisja kthehet n\u00eb vendin e saj dhe sulmuesi pret derisa p\u00ebrdoruesi ta lidh\u00eb at\u00eb duke futur fjal\u00ebkalimin. Gjat\u00eb aktivizimit t\u00eb pajisjes nga ana e p\u00ebrdoruesit, aktivizohet nj\u00eb proces n\u00eb sfond p\u00ebr ri-kriptimin, gjat\u00eb t\u00eb cilit nj\u00eb pjes\u00eb e t\u00eb dh\u00ebnave t\u00eb koduara z\u00ebvend\u00ebsohet me t\u00eb dh\u00ebna t\u00eb dekriptuara. M\u00eb pas, n\u00ebse sulmuesi arrin t\u00eb marr\u00eb pajisjen s\u00ebrish, nj\u00eb pjes\u00eb e t\u00eb dh\u00ebnave n\u00eb pajisje do t\u00eb jet\u00eb n\u00eb form\u00ebn e dekriptuar. <\/p>\n
Problemi \u00ebsht\u00eb identifikuar nga mbajt\u00ebsi i projektit cryptsetup dhe \u00ebsht\u00eb eliminuar n\u00eb p\u00ebrdit\u00ebsimet cryptsetup 2.4.3 dhe 2.3.7. Shtetet e formimit t\u00eb p\u00ebrdit\u00ebsimeve q\u00eb eliminojn\u00eb problemin mund t\u00eb gjenden n\u00eb k\u00ebto faqe: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. Rrezikshm\u00ebria shfaqet vet\u00ebm q\u00eb nga l\u00ebshimi i cryptsetup 2.2.0, ku u fut mb\u00ebshtetje p\u00ebr operacionin \u00abonline reencryption\u00bb. Si nj\u00eb an\u00ebsore mbrojtjeje, mund t\u00eb p\u00ebrdoret aktivizimi me opsionin \u00ab--disable-luks2-reencryption\u00bb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"