{"id":103489,"date":"2022-03-07T21:36:38","date_gmt":"2022-03-07T19:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya"},"modified":"2022-03-07T21:36:38","modified_gmt":"2022-03-07T19:36:38","slug":"uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-pozvolyayushhaya-iskazit-fajly-dostupnye-tolko-dlya-chteniya","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb b\u00ebrtham\u00ebn Linux, e cila lejon ndryshimin e skedave q\u00eb jan\u00eb t\u00eb disponueshme vet\u00ebm p\u00ebr lexim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb kernelin Linux \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2022-0847) q\u00eb lejon rishkrimin e p\u00ebrmbajtjes s\u00eb caches t\u00eb faqeve p\u00ebr \u00e7do skedar, p\u00ebrfshir\u00eb ato q\u00eb jan\u00eb n\u00eb m\u00ebnyr\u00eb vet\u00ebm p\u00ebr lexim dhe t\u00eb hapura me flamurin O_RDONLY ose q\u00eb ndodhen n\u00eb sisteme skedari t\u00eb montuara n\u00eb m\u00ebnyr\u00eb vet\u00ebm p\u00ebr lexim. Nga ana praktike, vulnerabiliteti mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb injektuar kod n\u00eb procese t\u00eb rast\u00ebsishme ose p\u00ebr t\u00eb deformuar t\u00eb dh\u00ebnat n\u00eb skedar\u00ebt e hapur. P\u00ebr shembull, mund t\u00eb ndryshoni p\u00ebrmbajtjen e skedarit authorized_keys p\u00ebr procesin sshd. Nj\u00eb prototip i eksploitit \u00ebsht\u00eb n\u00eb dispozicion p\u00ebr testim. <\/p>\n
Problemi \u00ebsht\u00eb em\u00ebruar Dirty Pipe, n\u00eb analogji me vulnerabilitetin kritik t\u00eb zbuluar n\u00eb 2016, Dirty COW. Vler\u00ebsohet se p\u00ebr sa i p\u00ebrket rrezikshm\u00ebris\u00eb, Dirty Pipe \u00ebsht\u00eb n\u00eb t\u00eb nj\u00ebjtin nivel me Dirty COW, por \u00ebsht\u00eb shum\u00eb m\u00eb i leht\u00eb p\u00ebr t'u shfryt\u00ebzuar. Vulnerabiliteti u zbulua gjat\u00eb hetimeve mbi ankesa p\u00ebr d\u00ebmtime periodike t\u00eb skedar\u00ebve q\u00eb shkarkoheshin n\u00eb rrjet n\u00eb sistemin q\u00eb ngarkonte arkiva t\u00eb kompresuara nga log-serveri (37 d\u00ebmtime n\u00eb 3 muaj n\u00eb nj\u00eb sistem me ngarkes\u00eb t\u00eb lart\u00eb), gjat\u00eb p\u00ebrgatitjes s\u00eb t\u00eb cilave u p\u00ebrdor operacioni splice() dhe kanalet e paem\u00ebruara. <\/p>\n
Vulnerabiliteti shfaqet q\u00eb me kernelin Linux 5.8, i l\u00ebshuar n\u00eb gusht 2020, dmth. \u00ebsht\u00eb i pranish\u00ebm n\u00eb Debian 11, por nuk e prek kernelin baz\u00eb n\u00eb Ubuntu 20.04 LTS. Kerneli RHEL 8.x dhe openSUSE\/SUSE 15 n\u00eb fillim jan\u00eb bazuar n\u00eb deg\u00eb m\u00eb t\u00eb vjetra, por nuk p\u00ebrjashtohet q\u00eb ndryshimi q\u00eb shkaktoi problemin t\u00eb ket\u00eb qen\u00eb i rikthyer n\u00eb to (t\u00eb dh\u00ebna t\u00eb sakta nuk ka ende). Mund t\u00eb ndiqni publikimin e azhurnimeve t\u00eb pakove n\u00eb distribucione n\u00eb k\u00ebto faqe: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. Zgjidhja p\u00ebr vulnerabilitetin \u00ebsht\u00eb propozuar n\u00eb l\u00ebshimet 5.16.11, 5.15.25 dhe 5.10.102. Zgjidhja gjithashtu \u00ebsht\u00eb e p\u00ebrfshir\u00eb n\u00eb kernelin q\u00eb p\u00ebrdoret n\u00eb platform\u00ebn Android. <\/p>\n
Vulnerabiliteti shkaktohet nga mungesa e inicializimit t\u00eb vler\u00ebs \u2018buf->flags\u2019 n\u00eb kodin e funksioneve copy_page_to_iter_pipe() dhe push_pipe(), megjith\u00ebse memoria gjat\u00eb alokimit t\u00eb struktur\u00ebs nuk pastrohet dhe gjat\u00eb manipulimeve t\u00eb caktuara me kanalet e paem\u00ebruara, n\u00eb \u2018buf->flags\u2019 mund t\u00eb p\u00ebrfundoj\u00eb nj\u00eb vler\u00eb nga nj\u00eb operacion tjet\u00ebr. Duke p\u00ebrdorur k\u00ebt\u00eb ve\u00e7ori, nj\u00eb p\u00ebrdorues lokal i pavlefsh\u00ebm mund t\u00eb arrij\u00eb t\u00eb ket\u00eb n\u00eb flamurin vler\u00ebn PIPE_BUF_FLAG_CAN_MERGE, e cila lejon rishkrimin e t\u00eb dh\u00ebnave n\u00eb cache t\u00eb faqeve p\u00ebrmes nj\u00eb shkrimi t\u00eb thjesht\u00eb t\u00eb t\u00eb dh\u00ebnave t\u00eb reja n\u00eb nj\u00eb kanal t\u00eb paem\u00ebruar t\u00eb p\u00ebrgatitur posa\u00e7\u00ebrisht. <\/p>\n
P\u00ebr t\u00eb sulmuar, skedari target duhet t\u00eb jet\u00eb i disponuesh\u00ebm p\u00ebr lexim, duke pasur parasysh se gjat\u00eb shkrimit n\u00eb pipe nuk kontrollohen t\u00eb drejtat e aksesit, z\u00ebvend\u00ebsimi n\u00eb cache t\u00eb faqeve mund t\u00eb kryhet edhe p\u00ebr skedar\u00eb q\u00eb ndodhen n\u00eb ndarje t\u00eb montuara vet\u00ebm p\u00ebr lexim (p\u00ebr shembull, p\u00ebr skedar\u00eb c CD-ROM). Pas z\u00ebvend\u00ebsimit t\u00eb informacionit n\u00eb cache t\u00eb faqeve, procesi gjat\u00eb leximit t\u00eb t\u00eb dh\u00ebnave nga skedari do t\u00eb marr\u00eb jo t\u00eb dh\u00ebnat reale, por t\u00eb dh\u00ebna t\u00eb manipuluara. <\/p>\n
Ekspluatimi p\u00ebrfshin krijimin e nj\u00eb kanali t\u00eb paem\u00ebruar dhe mbushjen e tij me t\u00eb dh\u00ebna t\u00eb rast\u00ebsishme p\u00ebr t\u00eb arritur t\u00eb vendoset flamuri PIPE_BUF_FLAG_CAN_MERGE n\u00eb t\u00eb gjitha strukturat e lidhura me t\u00eb. M\u00eb pas t\u00eb dh\u00ebnat lexohen nga kanali, por flamuri mbetet i aktivizuar n\u00eb t\u00eb gjitha instancat e struktur\u00ebs pipe_buffer n\u00eb strukturat e lidhura pipe_inode_info. Pas k\u00ebsaj, thirret operacioni splice() p\u00ebr t\u00eb lexuar t\u00eb dh\u00ebna nga skedari target n\u00eb kanal t\u00eb paem\u00ebruar, duke filluar nga offseti i k\u00ebrkuar. Kur t\u00eb dh\u00ebnat shkruhen n\u00eb k\u00ebt\u00eb kanal t\u00eb paem\u00ebruar, p\u00ebr shkak t\u00eb flamurit PIPE_BUF_FLAG_CAN_MERGE, t\u00eb dh\u00ebnat n\u00eb cache do t\u00eb rishkruhen, n\u00eb vend q\u00eb t\u00eb krijohet nj\u00eb instanc\u00eb e re e struktur\u00ebs pipe_buffer. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"