{"id":103483,"date":"2022-03-06T15:36:45","date_gmt":"2022-03-06T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera"},"modified":"2022-03-06T15:36:45","modified_gmt":"2022-03-06T13:36:47","slug":"uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","title":{"rendered":"Vulnerabilitet n\u00eb cgroups v1, q\u00eb lejon daljen nga kontejneri i izoluar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Janar detajet e nj\u00eb vulnerabiliteti (CVE-2022-0492) n\u00eb realizimin e mekanizmit t\u00eb kufizimit t\u00eb burimeve cgroups v1 n\u00eb b\u00ebrtham\u00ebn Linux, i cili mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb dal\u00eb nga kontejner\u00ebt e izoluar. Problemi paraqitet duke filluar nga b\u00ebrthama Linux 2.6.24 dhe \u00ebsht\u00eb zgjidhur n\u00eb l\u00ebshimet e b\u00ebrtham\u00ebs 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 dhe 4.9.301. Mund t\u00eb ndiqni publikimin e p\u00ebrdit\u00ebsimeve t\u00eb paketave n\u00eb distribuimet e m\u00ebposhtme: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n
M\u00eb par\u00eb, nj\u00eb ve\u00e7ori e till\u00eb nuk do t\u00eb perceptohej si vulnerabilitet, por situata ndryshoi me shfaqjen e hap\u00ebsirave t\u00eb emrave p\u00ebr identifikimin e p\u00ebrdoruesve (user namespaces), t\u00eb cilat lejojn\u00eb krijimin e p\u00ebrdoruesve root t\u00eb ve\u00e7ant\u00eb n\u00eb kontejner\u00eb, q\u00eb nuk kan\u00eb lidhje me p\u00ebrdoruesin root t\u00eb mjedisit kryesor. Prandaj, p\u00ebr t\u00eb sulmuar, mjafton q\u00eb n\u00eb kontejnerin me p\u00ebrdoruesin e vet root n\u00eb nj\u00eb hap\u00ebsir\u00eb identifikimi t\u00eb p\u00ebrdoruesve t\u00eb lidhesh skedarin t\u00ebnd release_agent, i cili pas p\u00ebrfundimit t\u00eb procesit do t\u00eb ekzekutohet me privilegje t\u00eb plota t\u00eb mjedisit kryesor. <\/p>\n
P\u00ebr default, cgroupfs montohet n\u00eb kontejner n\u00eb m\u00ebnyr\u00eb t\u00eb lexueshme vet\u00ebm, por nuk ka probleme p\u00ebr ta rimontuar k\u00ebt\u00eb pseudo-fs n\u00eb m\u00ebnyr\u00eb shkrimi n\u00ebse ka t\u00eb drejtat CAP_SYS_ADMIN ose p\u00ebrmes krijimit t\u00eb nj\u00eb kontejneri t\u00eb brendsh\u00ebm me thirrjen sistemore unshare me nj\u00eb hap\u00ebsir\u00eb user namespace t\u00eb ve\u00e7ant\u00eb, n\u00eb t\u00eb cil\u00ebn t\u00eb drejtat CAP_SYS_ADMIN jan\u00eb t\u00eb disponueshme p\u00ebr kontejnerin e krijuar.
<\/center> <\/p>\n
Sulmi mund t\u00eb kryhet n\u00ebse ka t\u00eb drejtat root n\u00eb nj\u00eb kontejner t\u00eb izoluar ose n\u00ebse kontejneri \u00ebsht\u00eb nisur pa flagun no_new_privs, i cili ndalon marrjen e privilegjeve shtes\u00eb. Sistemi duhet t\u00eb ket\u00eb mb\u00ebshtetje p\u00ebr hap\u00ebsirat e emrave t\u00eb p\u00ebrdoruesve (e cila \u00ebsht\u00eb aktivizuar me default n\u00eb Ubuntu dhe Fedora, por nuk \u00ebsht\u00eb aktivizuar n\u00eb Debian dhe RHEL) dhe t\u00eb ket\u00eb qasje n\u00eb cgroup-in rr\u00ebnj\u00eb v1 (p\u00ebr shembull, Docker nis kontejner\u00ebt n\u00eb cgroup-in rr\u00ebnj\u00eb RDMA). Sulmi gjithashtu mund t\u00eb ndodh\u00eb n\u00ebse ka privilegje CAP_SYS_ADMIN, n\u00eb k\u00ebt\u00eb rast mb\u00ebshtetja p\u00ebr hap\u00ebsirat e emrave t\u00eb p\u00ebrdoruesve dhe qasja n\u00eb hierarkin\u00eb rr\u00ebnj\u00eb t\u00eb cgroup v1 nuk k\u00ebrkohet. <\/p>\n
![\"Vulnerabilitet](\"\/wp-content\/uploads\/2022\/03\/710b37582c444cc4be7d6ae4695c8afe.jpg\")
<\/center> <\/p>\n