{"id":103374,"date":"2022-02-18T03:37:22","date_gmt":"2022-02-18T01:37:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap"},"modified":"2022-02-18T03:37:22","modified_gmt":"2022-02-18T01:37:22","slug":"lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap","title":{"rendered":"Vulnerabilitetet lokale root n\u00eb mjetin e menaxhimit t\u00eb skedar\u00ebve Snap","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Qualys zbuloi dy dob\u00ebsit\u00eb (CVE-2021-44731, CVE-2021-44730) n\u00eb utilitarin snap-confine, i cili ofrohet me flamurin SUID root dhe thirret nga procesi snapd p\u00ebr t\u00eb formuar ambientin ekzekutiv p\u00ebr aplikacionet e ofruara n\u00eb paketat e vet\u00eb-mjaftueshme n\u00eb formatin snap. Dob\u00ebsit\u00eb lejojn\u00eb nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kod me t\u00eb drejtat root n\u00eb sistem. Problemet jan\u00eb adresuar n\u00eb p\u00ebrdit\u00ebsimin e sot\u00ebm t\u00eb paketave snapd p\u00ebr Ubuntu 21.10, 20.04 dhe 18.04. <\/p>\n
Dob\u00ebsia e par\u00eb (CVE-2021-44730) lejon nj\u00eb sulm p\u00ebrmes manipulimit t\u00eb lidhjeve t\u00eb forta, por k\u00ebrkon q\u00eb mbrojtja sistemore e lidhjeve t\u00eb forta t\u00eb jet\u00eb e \u00e7aktivizuar (duke vendosur sysctl fs.protected_hardlinks n\u00eb 0). Problemi shkaktohet nga kontrolli i pasakt\u00eb i vendndodhjes s\u00eb skedareve ekzekutiv\u00eb t\u00eb utilitar\u00ebve snap-update-ns dhe snap-discard-ns, t\u00eb cilat ekzekutohen me t\u00eb drejtat root. Rruga p\u00ebr k\u00ebto skedare llogaritej n\u00eb funksionin sc_open_snapd_tool() n\u00eb baz\u00eb t\u00eb rrug\u00ebs s\u00eb vet nga \/proc\/self\/exe, q\u00eb lejon krijimin e nj\u00eb lidhjeje t\u00eb fort\u00eb me snap-confine n\u00eb katalogun tuaj dhe vendosjen n\u00eb k\u00ebt\u00eb katalog t\u00eb varianteve tuaja t\u00eb utilitar\u00ebve snap-update-ns dhe snap-discard-ns. Pas ekzekutimit p\u00ebrmes lidhjes s\u00eb fort\u00eb, snap-confine me t\u00eb drejtat root do t\u00eb ekzekutoj\u00eb nga katalogu aktual skedaret snap-update-ns dhe snap-discard-ns t\u00eb vendosur nga sulmuesi. <\/p>\n
Vulnerabiliteti i dyt\u00eb shkaktohet nga nj\u00eb gjendje garash dhe mund t\u00eb shfryt\u00ebzohet n\u00eb konfigurimin e Ubuntu Desktop sipas parazgjedhjes. P\u00ebr q\u00ebllimin e suksesit t\u00eb shfryt\u00ebzimit n\u00eb Ubuntu Server, k\u00ebrkohet q\u00eb gjat\u00eb instalimit t\u00eb zgjidhet nj\u00eb nga paketat n\u00eb seksionin \u00abFeatured Server Snaps\u00bb. Gjendja e garave shfaqet n\u00eb funksionin setup_private_mount(), i cili thirret gjat\u00eb p\u00ebrgatitjes s\u00eb hap\u00ebsir\u00ebs emrit t\u00eb pikave t\u00eb montimit p\u00ebr paket\u00ebn snap. Ky funksion krijon nj\u00eb katalog temporar \u00ab\/tmp\/snap.$SNAP_NAME\/tmp\u00bb ose p\u00ebrdor nj\u00eb t\u00eb ekzistuesh\u00ebm p\u00ebr montimin n\u00eb t\u00eb t\u00eb katalog\u00ebve p\u00ebr paket\u00ebn n\u00eb formatin snap. <\/p>\n
Duke qen\u00eb se emri i katalogut temporar \u00ebsht\u00eb parashikuesh\u00ebm, nj\u00eb sulmues mund t\u00eb z\u00ebvend\u00ebsoj\u00eb p\u00ebrmbajtjen e tij me nj\u00eb lidhje simbolike n\u00eb momentin pas kontrollit t\u00eb pron\u00ebsis\u00eb, por para thirrjes s\u00eb thirrjes sistemore mount. P\u00ebr shembull, mund t\u00eb krijohet n\u00eb katalogun \/tmp\/snap.lxd nj\u00eb lidhje simbolike \u00ab\/tmp\/snap.lxd\/tmp\u00bb, q\u00eb tregon n\u00eb nj\u00eb katalog t\u00eb rast\u00ebsish\u00ebm, dhe thirrja mount() do t\u00eb ndjek\u00eb lidhjen simbolike dhe do t\u00eb montoj\u00eb katalogun n\u00eb hap\u00ebsir\u00ebn em\u00ebrore t\u00eb snap. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, mund t\u00eb montohet p\u00ebrmbajtja e tij n\u00eb \/var\/lib dhe p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb \/var\/lib\/snapd\/mount\/snap.snap-store.user-fstab t\u00eb mund\u00ebsohet montimi i katalogut t\u00eb tij \/etc n\u00eb hap\u00ebsir\u00ebn em\u00ebrore t\u00eb paket\u00ebs snap p\u00ebr t\u00eb organizuar ngarkimin e bibliotek\u00ebs s\u00eb tij me t\u00eb drejta root p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb \/etc\/ld.so.preload. <\/p>\n
\u00cbsht\u00eb v\u00ebn\u00eb re se krijimi i nj\u00eb eksploiti \u00ebsht\u00eb nj\u00eb detyr\u00eb jo triviale, pasi utilita snap-confine \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn Go duke p\u00ebrdorur teknika t\u00eb programimit t\u00eb sigurt\u00eb, ka mbrojtje t\u00eb bazuar n\u00eb profilet AppArmor, filtron thirrjet e sistemit n\u00eb baz\u00eb t\u00eb mekanizmit seccomp dhe aplikon hap\u00ebsira emrave p\u00ebr izolim gjat\u00eb montimit. Megjithat\u00eb, k\u00ebrkuesit arrit\u00ebn t\u00eb p\u00ebrgatisin nj\u00eb eksploit funksional p\u00ebr t\u00eb fituar t\u00eb drejtat root n\u00eb sistem. Kodi i eksploitit do t\u00eb publikohet pas disa jav\u00ebsh, pasi p\u00ebrdoruesit t\u00eb instalojn\u00eb p\u00ebrdit\u00ebsimet e ofruara. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"