{"id":103125,"date":"2022-01-29T15:37:09","date_gmt":"2022-01-29T13:37:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx"},"modified":"2022-01-29T15:37:09","modified_gmt":"2022-01-29T13:37:09","slug":"uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","title":{"rendered":"P\u00ebrgjegj\u00ebsit\u00eb n\u00eb OpenSSL, Glibc, util-linux, drejtuesit i915 dhe vmwgfx.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Informacioni mbi nj\u00eb vulnerabilitet (CVE-2021-4160) n\u00eb bibliotek\u00ebn kriptografike OpenSSL \u00ebsht\u00eb zbuluar, i shkaktuar nga nj\u00eb gabim n\u00eb implementimin e funksionit BN_mod_exp, i cili \u00e7on n\u00eb kthimin e nj\u00eb rezultati t\u00eb gabuar n\u00eb operacionin e katrorit. Problemi shfaqet vet\u00ebm n\u00eb pajisje t\u00eb bazuara n\u00eb arkitektur\u00ebn MIPS32 dhe MIPS64 dhe mund t\u00eb \u00e7oj\u00eb n\u00eb kompromitimin e algoritmeve t\u00eb bazuara n\u00eb kurba elliptike, duke p\u00ebrfshir\u00eb ato q\u00eb p\u00ebrdoren si standard n\u00eb TLS 1.3. Problemi \u00ebsht\u00eb zgjidhur n\u00eb azhurnimet e dhjetorit p\u00ebr OpenSSL 1.1.1m dhe 3.0.1. <\/p>\n
Gjithashtu, mund t\u00eb p\u00ebrmenden disa vulnerabilitete t\u00eb zbuluara koh\u00ebt e fundit n\u00eb projektet e hapura: <\/p>\n
\n
Disa dob\u00ebsi (CVE-2022-0330) n\u00eb drejtuesin e grafik\u00ebve i915, t\u00eb lidhura me munges\u00ebn e ri-nisjes s\u00eb TLB p\u00ebr GPU. N\u00eb rastin kur nuk zbatohet IOMMU (translacionet e adresave), kjo dob\u00ebsi lejon qasjen n\u00eb faqe t\u00eb rast\u00ebsishme memorie nga hap\u00ebsira e p\u00ebrdoruesit. Problemi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb d\u00ebmtuar ose lexuar t\u00eb dh\u00ebna nga pjes\u00eb t\u00eb rast\u00ebsishme t\u00eb memories. Problemi shfaqet n\u00eb t\u00eb gjitha GPU-t\u00eb e integruara dhe t\u00eb dedikuara Intel. Rregullimi \u00ebsht\u00eb realizuar p\u00ebrmes shtimit t\u00eb nj\u00eb ri-nisjeje t\u00eb detyrueshme TLB para se t\u00eb ekzekutohet \u00e7do operacion kthimi t\u00eb buffer-it GPU n\u00eb sistem, gj\u00eb q\u00eb do t\u00eb rezultoj\u00eb n\u00eb nj\u00eb ulje t\u00eb performanc\u00ebs. Ndikimi n\u00eb performanc\u00eb varet nga GPU, operacionet e kryera n\u00eb GPU dhe ngarkesa n\u00eb sistem. Rregullimi aktualisht \u00ebsht\u00eb n\u00eb dispozicion vet\u00ebm si nj\u00eb patch.\n
Nj\u00eb dob\u00ebsi (CVE-2022-22942) n\u00eb drejtuesin grafik vmwgfx, i p\u00ebrdorur p\u00ebr t\u00eb realizuar p\u00ebrshpejtim 3D n\u00eb mjediset VMware. Problemi lejon nj\u00eb p\u00ebrdorues pa privilegje t\u00eb aksesoj\u00eb skedar\u00ebt q\u00eb jan\u00eb hapur nga procese t\u00eb tjera n\u00eb sistem. P\u00ebr t\u00eb kryer nj\u00eb sulm, nevojitet akses n\u00eb pajisjen \/dev\/dri\/card0 ose \/dev\/dri\/rendererD128, si dhe mund\u00ebsia p\u00ebr t\u00eb kryer nj\u00eb thirrje ioctl() me descriptorin e skedarit t\u00eb marr\u00eb.\n
Dob\u00ebsi (CVE-2021-3996, CVE-2021-3995) n\u00eb bibliotek\u00ebn libmount, e ofruar n\u00eb paket\u00ebn util-linux, q\u00eb lejon nj\u00eb p\u00ebrdorues pa privilegje t\u00eb \u00e7montoj\u00eb pjes\u00ebt diskore, pa pasur autorizim p\u00ebr k\u00ebt\u00eb. Problemi u identifikua gjat\u00eb auditimit t\u00eb programeve SUID-root umount dhe fusermount.\n
Dob\u00ebsi n\u00eb bibliotek\u00ebn standarde C Glibc, q\u00eb ndikon funksionet realpath (CVE-2021-3998) dhe getcwd (CVE-2021-3999).\n
\n
Problemi n\u00eb realpath() shkaktohet nga kthimi n\u00ebn kushte t\u00eb caktuara t\u00eb nj\u00eb vlere t\u00eb pasakt\u00eb, e cila p\u00ebrmban t\u00eb dh\u00ebna mbetje t\u00eb papastruara nga staku. P\u00ebr programin SUID-root fusermount, dob\u00ebsia mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb marr\u00eb informacion t\u00eb ndjesh\u00ebm nga memoria e procesit, p\u00ebr shembull, p\u00ebr t\u00eb marr\u00eb informacion mbi treguesit.\n