{"id":103807,"date":"2022-04-17T21:36:41","date_gmt":"2022-04-17T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland"},"modified":"2022-04-17T21:36:41","modified_gmt":"2022-04-17T19:36:41","slug":"uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland","title":{"rendered":"Vulnerabilitetet n\u00eb swhkd, menaxher i \u00e7el\u00ebsve t\u00eb nxeht\u00eb p\u00ebr Wayland","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb swhkd (Simple Wayland HotKey Daemon) jan\u00eb zbuluar nj\u00eb seri vulnerabilitetesh t\u00eb shkaktuara nga trajtimi i pap\u00ebrshtatsh\u00ebm i skedar\u00ebve t\u00eb p\u00ebrkohsh\u00ebm, parametrave t\u00eb linj\u00ebs s\u00eb komand\u00ebs dhe unix-socket-\u00ebve. Programi \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn Rust dhe p\u00ebrpunon shtypjet e tasteve n\u00eb ambientet e bazuara n\u00eb protokollin Wayland (i p\u00ebrputhsh\u00ebm n\u00eb nivelin e skedar\u00ebve t\u00eb konfigurimit me procesin sxhkd, i p\u00ebrdorur n\u00eb ambientet e bazuara n\u00eb X11). <\/p>\n
Paketa p\u00ebrfshin nj\u00eb proces jo t\u00eb privilegjuar swhks, i cili kryen veprimet p\u00ebr taste t\u00eb nxehta, dhe nj\u00eb proces sfondor swhkd, i cili ekzekutohet me t\u00eb drejta root dhe ndikon me pajisjet e hyrjes n\u00eb nivelin e API-s\u00eb uinput. P\u00ebr t\u00eb organizuar nd\u00ebrveprimin mes swhks dhe swhkd p\u00ebrdoret nj\u00eb Unix-socket. Me an\u00eb t\u00eb rregullave Polkit, \u00e7do p\u00ebrdorues lokal ka mund\u00ebsin\u00eb t\u00eb nisin procesin \/usr\/bin\/swhkd me t\u00eb drejta root dhe t'i kaloj\u00eb atij parametra t\u00eb rast\u00ebsish\u00ebm. <\/p>\n
Vulnerabilitetet e identifikuara: <\/p>\n
\n
CVE-2022-27815 \u2014 ruajtja e PID t\u00eb procesit n\u00eb nj\u00eb skedare me em\u00ebr t\u00eb parashikuesh\u00ebm dhe n\u00eb nj\u00eb direktorium q\u00eb \u00ebsht\u00eb i aksesuesh\u00ebm p\u00ebr shkrim nga p\u00ebrdorues t\u00eb tjer\u00eb (\/tmp\/swhkd.pid). \u00c7do p\u00ebrdorues mund t\u00eb krijoj\u00eb skedarin \/tmp\/swhkd.pid dhe t\u00eb vendos\u00eb n\u00eb t\u00eb pid t\u00eb nj\u00eb procesi ekzistues, \u00e7ka do t\u00eb \u00e7onte n\u00eb pamund\u00ebsin\u00eb e nisjes s\u00eb swhkd. N\u00eb munges\u00eb t\u00eb mbrojtjes ndaj krijimit t\u00eb lidhjeve simbolike n\u00eb \/tmp, kjo dob\u00ebsi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb krijuar ose rishkruar skedar\u00eb n\u00eb \u00e7do direktorium sistemik (pid ruhet n\u00eb skedar) ose p\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrmbajtjen e \u00e7do skedari n\u00eb sistem (swhkd ndihmon n\u00eb daljen n\u00eb stdout t\u00eb gjith\u00eb p\u00ebrmbajtjen e skedarit PID). \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se n\u00eb riparimin e l\u00ebshuar, skedari PID \u00ebsht\u00eb zhvendosur jo n\u00eb direktoriumin \/run, por n\u00eb direktoriumin \/etc (\/etc\/swhkd\/runtime\/swhkd_{uid}.pid), ku gjithashtu nuk ia vlen t\u00eb jet\u00eb.\n
CVE-2022-27814 \u2014 duke manipuluar parametrin e komand\u00ebs '-c', q\u00eb p\u00ebrdoret p\u00ebr t\u00eb specifikuar skedarin e konfigurimit, mund t\u00eb p\u00ebrcaktohet ekzistenca n\u00eb sistem e \u00e7do skedari. P\u00ebr shembull, p\u00ebr t\u00eb kontrolluar \/root\/.somefile mund t\u00eb ekzekutohet 'pkexec \/usr\/bin\/swhkd -d -c \/root\/.somefile', dhe n\u00ebse skedari nuk ekziston, do t\u00eb shfaqet nj\u00eb gabim ' \/root\/.somefile doesn\u2019t exist'. Ashtu si me dob\u00ebsin\u00eb e par\u00eb, riparimi i problemit shkakton konfuzion \u2014 zgjidhja e problemit \u00ebsht\u00eb se tani p\u00ebr leximin e skedarit t\u00eb konfigurimit ekzekutohet nj\u00eb utilitare e jashtme 'cat' ('Command::new('\/bin\/cat').arg(path).output()').\n
CVE-2022-27819 \u2014 problemi gjithashtu lidhet me p\u00ebrdorimin e opsionit '-c', p\u00ebrmes t\u00eb cilit skedari i konfigurimit ngarkohet dhe analizohet n\u00eb m\u00ebnyr\u00eb t\u00eb plot\u00eb pa kontrollin e madh\u00ebsis\u00eb dhe tipit t\u00eb skedarit. P\u00ebr shembull, p\u00ebr t\u00eb shkaktuar nj\u00eb sh\u00ebrbim t\u00eb pamundur p\u00ebr shkak t\u00eb shterimit t\u00eb memories s\u00eb lir\u00eb dhe krijimit t\u00eb hyrjes \/ daljes parazituese, mund t\u00eb specifikohet nj\u00eb pajisje blloku (pkexec \/usr\/bin\/swhkd -d -c \/dev\/sda) apo nj\u00eb pajisje simbolike q\u00eb d\u00ebrgon nj\u00eb rrjedh\u00eb t\u00eb pafund t\u00eb t\u00eb dh\u00ebnave. Problemi \u00ebsht\u00eb zgjidhur me kthimin e privilegjeve p\u00ebrpara hapjes s\u00eb skedarit, por riparimi doli t\u00eb ishte jo i plot\u00eb, pasi vet\u00ebm identifikuesi i p\u00ebrdoruesit (UID) p\u00ebrkthehet, por identifikuesi i grupit (GID) mbetet i nj\u00ebjt\u00eb.\n
CVE-2022-27818 \u2014 p\u00ebr krijimin e nj\u00eb Unix-socket p\u00ebrdoret skedari \/tmp\/swhkd.sock, i krijuar n\u00eb nj\u00eb direktorium publik p\u00ebr shkrim, \u00e7ka sjell probleme t\u00eb ngjashme me dob\u00ebsin\u00eb e par\u00eb (\u00e7do p\u00ebrdorues mund t\u00eb krijoj\u00eb \/tmp\/swhkd.sock dhe t\u00eb gjeneroj\u00eb ose kap\u00eb ngjarje t\u00eb shtypjes s\u00eb \u00e7el\u00ebsave).\n
CVE-2022-27817 \u2014 ngjarjet e hyrjes pranohen nga t\u00eb gjitha pajisjet dhe n\u00eb t\u00eb gjitha seancat, pra, nj\u00eb p\u00ebrdorues nga nj\u00eb seanc\u00eb tjet\u00ebr Wayland ose nga konsola mund t\u00eb kap\u00eb ngjarjet kur disa p\u00ebrdorues shtypin \u00e7el\u00ebsat e nxeht\u00eb.\n
CVE-2022-27816 \u2014 procesi swhks, ashtu si swhkd, p\u00ebrdor skedarin PID \/tmp\/swhks.pid n\u00eb nj\u00eb katalog publik p\u00ebr shkrim \/tmp. Problemi \u00ebsht\u00eb i ngjash\u00ebm me t\u00eb parin, por nuk \u00ebsht\u00eb aq i rreziksh\u00ebm, pasi swhks ekzekutohet n\u00ebn nj\u00eb p\u00ebrdorues t\u00eb pa privilegjuar. <\/ul>\n