{"id":103807,"date":"2022-04-17T21:36:41","date_gmt":"2022-04-17T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland"},"modified":"2022-04-17T21:36:41","modified_gmt":"2022-04-17T19:36:41","slug":"uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland","title":{"rendered":"Vulnerabilitetet n\u00eb swhkd, menaxherin e \u00e7el\u00ebsave t\u00eb nxeht\u00eb p\u00ebr Wayland","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb swhkd (Simple Wayland HotKey Daemon) jan\u00eb zbuluar nj\u00eb seri vulnerabilitetesh q\u00eb shkaktohen nga menaxhimi i pap\u00ebrshtatsh\u00ebm i skedareve t\u00eb p\u00ebrkohsh\u00ebm, parametrave t\u00eb linj\u00ebs s\u00eb komand\u00ebs dhe unix-socket-eve. Programi \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn Rust dhe p\u00ebrpunon shtypjet e tasteve t\u00eb nxehta n\u00eb mjediset e bazuara n\u00eb protokollin Wayland (t\u00eb ngjash\u00ebm n\u00eb nivelin e skedave t\u00eb konfigurimit me procesin sxhkd, i p\u00ebrdorur n\u00eb mjediset e bazuara n\u00eb X11). <\/p>\n
Paketa p\u00ebrmban nj\u00eb proces t\u00eb paprivilegjuar swhks, i cili ekzekuton veprimet p\u00ebr taste t\u00eb nxehta, dhe nj\u00eb proces n\u00eb sfond swhkd, q\u00eb ekzekutohet me t\u00eb drejta root dhe nd\u00ebrvepron me pajisjet e hyrjes n\u00eb nivelin API uinput. P\u00ebr t\u00eb organizuar nd\u00ebrveprimin midis swhks dhe swhkd p\u00ebrdoret nj\u00eb Unix-socket. Me ndihm\u00ebn e rregullave Polkit, \u00e7do p\u00ebrdorues lokal i jepet mund\u00ebsia t\u00eb nis\u00eb procesin \/usr\/bin\/swhkd me t\u00eb drejta root dhe ti kaloj\u00eb atij parametra t\u00eb rast\u00ebsish\u00ebm. <\/p>\n
Vulnerabilitetet e identifikuara: <\/p>\n
\n
CVE-2022-27815 — ruajti PID i procesit n\u00eb nj\u00eb skedar me nj\u00eb em\u00ebr t\u00eb parashikuesh\u00ebm dhe n\u00eb nj\u00eb direktorium q\u00eb \u00ebsht\u00eb e qasshme p\u00ebr shkrim nga p\u00ebrdorues t\u00eb tjer\u00eb (\/tmp\/swhkd.pid). \u00c7do p\u00ebrdorues mund t\u00eb krijoj\u00eb nj\u00eb skedar \/tmp\/swhkd.pid dhe t\u00eb vendos\u00eb n\u00eb t\u00eb pid e nj\u00eb procesi ekzistues, q\u00eb do t\u00eb \u00e7onte n\u00eb pamund\u00ebsin\u00eb e nisjes s\u00eb swhkd. N\u00eb munges\u00eb t\u00eb mbrojtjes nga krijimi i lidhjeve simbolike n\u00eb \/tmp, kjo vulnerabilitet mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb krijuar ose ri-shkruar skedar\u00eb n\u00eb \u00e7do direktorium sistemik (PID shkruhet n\u00eb skedar) ose p\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrmbajtjen e \u00e7do skedari n\u00eb sistem (swhkd nxjerr n\u00eb stdout t\u00eb gjitha p\u00ebrmbajtjet e skedarit PID). \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se n\u00eb korrigjimin e l\u00ebshuar, skedari PID \u00ebsht\u00eb zhvendosur jo n\u00eb direktoriumin \/run, por n\u00eb direktoriumin \/etc (\/etc\/swhkd\/runtime\/swhkd_{uid}.pid), ku gjithashtu nuk i p\u00ebrket.\n
CVE-2022-27814 — duke manipuluar parametrin e linj\u00ebs s\u00eb komand\u00ebs «-c», q\u00eb p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrcaktuar skedarin e konfigurimit, mund t\u00eb p\u00ebrcaktohet ekzistenca n\u00eb sistem e \u00e7do skedari. P\u00ebr shembull, p\u00ebr t\u00eb kontrolluar \/root\/.somefile mund t\u00eb ekzekutohet «pkexec \/usr\/bin\/swhkd -d -c \/root\/.somefile» dhe n\u00ebse skedari nuk ekziston, do t\u00eb shfaqet nj\u00eb gabim «\/root\/.somefile doesn’t exist». Si n\u00eb rastin e vulnerabilitetit t\u00eb par\u00eb, korrigjimi i problemit \u00ebsht\u00eb i paqart\u00eb — eliminimi i problemit p\u00ebrfshin q\u00eb tani p\u00ebr t\u00eb lexuar skedarin e konfigurimit t\u00eb ekzekutohet nj\u00eb utilitar i jasht\u00ebm «cat» (‘Command::new(«\/bin\/cat»).arg(path).output()’).\n
CVE-2022-27819 — problemi gjithashtu lidhet me p\u00ebrdorimin e opsionit «-c», p\u00ebrmes t\u00eb cilit skedari i konfigurimit ngarkohet plot\u00ebsisht dhe analizohen pa kontrollimin e madh\u00ebsis\u00eb dhe llojit t\u00eb skedarit. P\u00ebr shembull, p\u00ebr t\u00eb shkaktuar nj\u00eb ndalim n\u00eb sh\u00ebrbim p\u00ebrmes shfryt\u00ebzimit t\u00eb memories s\u00eb lir\u00eb dhe krijimit t\u00eb hyrjes\/faqes parazite, mund t\u00eb p\u00ebrcaktohet nj\u00eb pajisje blloku («pkexec \/usr\/bin\/swhkd -d -c \/dev\/sda») ose nj\u00eb pajisje simbolike q\u00eb jep nj\u00eb rrjedh\u00eb t\u00eb pafund t\u00eb t\u00eb dh\u00ebnave. Problemi \u00ebsht\u00eb zgjidhur duke hequr privilegjet para hapjes s\u00eb skedarit, por korrigjimi ishte i paplot\u00eb, pasi identifikatori i p\u00ebrdoruesit (UID) mund t\u00eb hiqet, por identifikatori i grupit (GID) mbetet i nj\u00ebjt\u00eb.\n
CVE-2022-27818 — p\u00ebr krijimin e nj\u00eb soketi Unix, p\u00ebrdoret skedari \/tmp\/swhkd.sock, i krijuar n\u00eb nj\u00eb direktorium publik q\u00eb \u00ebsht\u00eb e qassh\u00ebm p\u00ebr shkrim, q\u00eb \u00e7on n\u00eb probleme t\u00eb ngjashme me vulnerabilitetin e par\u00eb (\u00e7do p\u00ebrdorues mund t\u00eb krijoj\u00eb \/tmp\/swhkd.sock dhe t\u00eb gjeneroj\u00eb ose kap\u00eb ngjarjet e shtypjes s\u00eb butonave).\n
CVE-2022-27817 — ngjarjet e hyrjes pranohen nga t\u00eb gjitha pajisjet dhe n\u00eb t\u00eb gjitha seancat, pra nj\u00eb p\u00ebrdorues nga nj\u00eb seanc\u00eb tjet\u00ebr Wayland ose nga konsola mund t\u00eb kap\u00eb ngjarjet kur p\u00ebrdoren kombinime t\u00eb nxehta nga p\u00ebrdoruesit e tjer\u00eb.\n
CVE-2022-27816 — procesi swhks, ashtu si swhkd, p\u00ebrdor skedarin PID \/tmp\/swhks.pid n\u00eb nj\u00eb direktorium publik q\u00eb \u00ebsht\u00eb e qassh\u00ebm p\u00ebr shkrim \/tmp. Problemi \u00ebsht\u00eb i ngjash\u00ebm me vulnerabilitetin e par\u00eb, por nuk \u00ebsht\u00eb aq i rreziksh\u00ebm, pasi swhks ekzekutohet n\u00ebn nj\u00eb p\u00ebrdorues pa privilegje. <\/ul>\n