N\u00eb paket\u00ebn Cryptsetup, e cila p\u00ebrdoret p\u00ebr enkriptimin e ndarjeve t\u00eb diskut n\u00eb Linux, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2021-4122) q\u00eb lejon, p\u00ebrmes modifikimit t\u00eb metadatave, \u00e7aktivizimin e enkriptimit n\u00eb ndarjet n\u00eb formatin LUKS2 (Linux Unified Key Setup). P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb vulnerabilitet, sulmuesi duhet t\u00eb ket\u00eb qasje fizike n\u00eb mediumin e enkriptuar, pra, kjo metod\u00eb ka kuptim kryesisht p\u00ebr sulmin ndaj mediumeve t\u00eb jashtme t\u00eb enkriptuara, si\u00e7 jan\u00eb disqet Flash, p\u00ebr t\u00eb cilat sulmuesi ka qasje, por nuk e di fjal\u00ebkalimin p\u00ebr dekriptimin e t\u00eb dh\u00ebnave. <\/p>\n
Sulmi aplikohet vet\u00ebm p\u00ebr formatin LUKS2 dhe lidhet me manipulimin e metadatuanve q\u00eb jan\u00eb p\u00ebrgjegj\u00ebs p\u00ebr aktivizimin e zgjerimit «online reencryption», i cili lejon q\u00eb, n\u00eb rast t\u00eb nevoj\u00ebs p\u00ebr t\u00eb ndryshuar \u00e7el\u00ebsin e qasjes, t\u00eb fillohet procesi i ri-enkriptimit t\u00eb t\u00eb dh\u00ebnave n\u00eb sfond pa ndaluar pun\u00ebn me ndarjen. Duke qen\u00eb se procesi i dekriptimit dhe enkriptimit me nj\u00eb \u00e7el\u00ebs t\u00eb ri merr shum\u00eb koh\u00eb, «online reencryption» ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb mos nd\u00ebrprer\u00eb pun\u00ebn me ndarjen dhe p\u00ebr t\u00eb kryer ri-enkriptimin n\u00eb sfond, duke e kaluar gradualisht t\u00eb dh\u00ebnat nga nj\u00eb \u00e7el\u00ebs n\u00eb nj\u00eb tjet\u00ebr. Po ashtu, ekziston mund\u00ebsia e zgjedhjes s\u00eb nj\u00eb \u00e7el\u00ebsi t\u00eb zbraz\u00ebt, duke e mund\u00ebsuar k\u00ebshtu kalimin e ndarjes n\u00eb nj\u00eb form\u00eb t\u00eb dekriptuar. <\/p>\n
Sulmuesi mund t\u00eb b\u00ebj\u00eb ndryshime n\u00eb metadat LUKS2 q\u00eb simulojn\u00eb nj\u00eb nd\u00ebrprerje t\u00eb papritur t\u00eb operacionit t\u00eb dekriptimit si rezultat i nj\u00eb d\u00ebshtimi dhe t\u00eb arrij\u00eb t\u00eb dekriptoj\u00eb nj\u00eb pjes\u00eb t\u00eb ndarjes pas aktivizimit dhe p\u00ebrdorimit t\u00eb ruajt\u00ebsit t\u00eb modifikuar nga pronari. N\u00eb k\u00ebt\u00eb rast, p\u00ebrdoruesi q\u00eb ka lidhur ruajt\u00ebsin e modifikuar dhe e ka \u00e7liruar at\u00eb me fjal\u00ebkalimin e duhur, nuk merr asnj\u00eb paralajm\u00ebrim p\u00ebr kryerjen e procesit t\u00eb rikuperimit t\u00eb operacionit t\u00eb nd\u00ebrprer\u00eb t\u00eb ri-enkriptimit dhe mund t\u00eb m\u00ebsoj\u00eb p\u00ebr ecurin\u00eb e k\u00ebtij operacioni vet\u00ebm p\u00ebrmes komand\u00ebs «luks Dump». Sasia e t\u00eb dh\u00ebnave q\u00eb sulmuesi mund t\u00eb dekriptoj\u00eb varet nga madh\u00ebsia e titullit LUKS2, por me madh\u00ebsi me t\u00eb zakonshme (16 MiB) mund t\u00eb tejkaloj\u00eb 3 GB. <\/p>\n
Problemi \u00ebsht\u00eb shkaktuar nga fakti se, megjith\u00ebse ri-enkriptimi k\u00ebrkon llogaritje dhe verifikim t\u00eb hash-eve t\u00eb \u00e7el\u00ebsave t\u00eb rinj dhe t\u00eb vjet\u00ebr, p\u00ebr t\u00eb filluar dekriptimin, hash-i nuk \u00ebsht\u00eb i nevojsh\u00ebm n\u00ebse gjendja e re n\u00ebnkupton munges\u00ebn e nj\u00eb \u00e7el\u00ebsi p\u00ebr enkriptim (plaintext). P\u00ebr m\u00eb tep\u00ebr, metadata LUKS2, n\u00eb t\u00eb cil\u00ebn p\u00ebrcaktohet algoritmi i enkriptimit, nuk \u00ebsht\u00eb e mbrojtur nga modifikimi n\u00eb rast se bie n\u00eb duar t\u00eb keqdash\u00ebsve. P\u00ebr t\u00eb bllokuar k\u00ebt\u00eb vulnerabilitet, zhvilluesit kan\u00eb shtuar nj\u00eb mbrojtje t\u00eb re p\u00ebr metadata n\u00eb LUKS2, p\u00ebr t\u00eb cilat tani kontrollohet nj\u00eb hash shtes\u00eb, e cila llogaritet mbi baz\u00ebn e \u00e7el\u00ebsave t\u00eb njohur dhe p\u00ebrmbajtjes s\u00eb metadata, dometh\u00ebn\u00eb, tani sulmuesi nuk mund ta ndryshoj\u00eb pa u kuptuar metadata pa e ditur fjal\u00ebkalimin p\u00ebr dekriptimin. <\/p>\n
Skenari tipik i sulmit k\u00ebrkon q\u00eb keqdash\u00ebsi t\u00eb ket\u00eb mund\u00ebsin\u00eb t\u00eb p\u00ebrfitoj\u00eb disa her\u00eb nga disku. N\u00eb fillim, sulmuesi, i cili nuk e di fjal\u00ebkalimin e aksesit, b\u00ebn ndryshime n\u00eb zon\u00ebn e meta-datat q\u00eb inicojn\u00eb dekriptimin e nj\u00eb pjese t\u00eb t\u00eb dh\u00ebnave gjat\u00eb aktivizimit t\u00eb diskut n\u00eb vazhdim. M\u00eb pas, disku kthehet n\u00eb vendin e tij dhe sulmuesi pret derisa p\u00ebrdoruesi ta lidh\u00eb at\u00eb duke futur fjal\u00ebkalimin. Gjat\u00eb aktivizimit t\u00eb pajisjes nga p\u00ebrdoruesi, nis nj\u00eb proces i pas\u00ebm ri-enkriptimi, n\u00eb t\u00eb cilin nj\u00eb pjes\u00eb e t\u00eb dh\u00ebnave t\u00eb koduara z\u00ebvend\u00ebsohet me t\u00eb dh\u00ebna t\u00eb dekriptuara. N\u00eb vazhdim, n\u00ebse sulmuesi arrin ta ket\u00eb n\u00eb duar pajisjen p\u00ebr her\u00eb t\u00eb dyt\u00eb, nj\u00eb pjes\u00eb e t\u00eb dh\u00ebnave n\u00eb disk do t\u00eb jet\u00eb n\u00eb format t\u00eb dekriptuar. <\/p>\n