{"id":103885,"date":"2022-04-27T15:36:48","date_gmt":"2022-04-27T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root"},"modified":"2022-04-27T15:36:48","modified_gmt":"2022-04-27T13:36:49","slug":"uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","title":{"rendered":"Vulnerabilitete n\u00eb networkd-dispatcher, q\u00eb lejojn\u00eb marrjen e t\u00eb drejtave root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Studiuesit e siguris\u00eb nga Microsoft kan\u00eb zbuluar dy dob\u00ebsi (CVE-2022-29799, CVE-2022-29800) n\u00eb sh\u00ebrbimin networkd-dispatcher, t\u00eb quajtura me emrin e koduar Nimbuspwn, t\u00eb cilat i lejojn\u00eb nj\u00eb p\u00ebrdoruesi pa privilegje t\u00eb ekzekutoj\u00eb komanda arbitrare me t\u00eb drejta root. Problemi \u00ebsht\u00eb rregulluar n\u00eb versionin networkd-dispatcher 2.2. Ende nuk ka informacione p\u00ebr publikimin e p\u00ebrdit\u00ebsimeve nga shp\u00ebrndarjet (Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux). <\/p>\n

Networkd-dispatcher p\u00ebrdoret n\u00eb shum\u00eb shp\u00ebrndarje Linux, p\u00ebrfshir\u00eb Ubuntu, q\u00eb p\u00ebrdorin procesin n\u00eb sfond systemd-networkd p\u00ebr konfigurimin e parametrave t\u00eb rrjetit, dhe kryen funksione t\u00eb ngjashme me NetworkManager-dispatcher, pra merret me nisjen e skripteve kur ndryshon gjendja e lidhjes s\u00eb rrjetit; p\u00ebr shembull, p\u00ebrdoret p\u00ebr nisjen VPN<\/a> pas vendosjes s\u00eb lidhjes kryesore t\u00eb rrjetit. <\/p>\n

Procesi n\u00eb sfond i lidhur me networkd-dispatcher ekzekutohet me t\u00eb drejta root dhe merr sinjale p\u00ebr ngjarjet p\u00ebrmes bus-it D-Bus. Informacioni p\u00ebr ngjarjet q\u00eb lidhen me ndryshimin e gjendjes s\u00eb lidhjeve t\u00eb rrjetit d\u00ebrgohet nga sh\u00ebrbimi systemd-networkd. Problemi q\u00ebndron n\u00eb faktin se p\u00ebrdoruesit pa privilegje mund t\u00eb krijojn\u00eb nj\u00eb ngjarje p\u00ebr nj\u00eb gjendje q\u00eb nuk ekziston dhe t\u00eb nisin ekzekutimin e skriptit t\u00eb tyre, i cili do t\u00eb ekzekutohet me t\u00eb drejta root. <\/p>\n

Systemd-networkd \u00ebsht\u00eb projektuar p\u00ebr t\u00eb ekzekutuar vet\u00ebm skriptet e p\u00ebrpunuesve t\u00eb sistemit, t\u00eb vendosura n\u00eb katalogun \/etc\/networkd-dispatcher dhe q\u00eb nuk jan\u00eb t\u00eb z\u00ebvend\u00ebsueshme nga p\u00ebrdoruesi, por p\u00ebr shkak t\u00eb nj\u00eb vulnerabiliteti (CVE-2022-29799) n\u00eb kodin e trajtimit t\u00eb rrug\u00ebve t\u00eb skedar\u00ebve, kishte mund\u00ebsi p\u00ebr t\u00eb dal\u00eb jasht\u00eb katalogut themelor dhe p\u00ebr t\u00eb ekzekutuar skripte t\u00eb rastit. N\u00eb ve\u00e7anti, gjat\u00eb formimit t\u00eb rrug\u00ebs s\u00eb skedarit p\u00ebr skriptin, u p\u00ebrdor\u00ebn vlerat OperationalState dhe AdministrativeState t\u00eb d\u00ebrguara p\u00ebrmes D-Bus, n\u00eb t\u00eb cilat nuk u krye pastrimi i simboleve t\u00eb ve\u00e7anta. Nj\u00eb sulmues mund t\u00eb gjeneroj\u00eb nj\u00eb gjendje t\u00eb tij\u00ebn, ku emri i saj p\u00ebrmban simbolet \u00ab..\/\u00bb dhe t\u00eb redirektoj\u00eb k\u00ebrkes\u00ebn e networkd-dispatcher n\u00eb nj\u00eb katalog tjet\u00ebr. <\/p>\n

Vulnerabiliteti i dyt\u00eb (CVE-2022-29800) \u00ebsht\u00eb n\u00eb lidhje me nj\u00eb gjendje garash\u2014mes verifikimit t\u00eb parametrave t\u00eb skriptit (pjes\u00ebmarrja root) dhe ekzekutimit t\u00eb tij kishte nj\u00eb periudh\u00eb t\u00eb vog\u00ebl kohe, e mjaftueshme p\u00ebr t\u00eb z\u00ebvend\u00ebsuar skedarin dhe p\u00ebr t\u00eb anashkaluar verifikimin e p\u00ebrkat\u00ebsis\u00eb s\u00eb skriptit p\u00ebr p\u00ebrdoruesin root. P\u00ebrve\u00e7 k\u00ebsaj, n\u00eb networkd-dispatcher nuk kishte nj\u00eb verifikim t\u00eb lidhjeve simbolike, p\u00ebrfshir\u00eb gjat\u00eb ekzekutimit t\u00eb skripteve p\u00ebrmes thirrjes subprocess.Popen, gj\u00eb q\u00eb e b\u00ebri organizimin e sulmit shum\u00eb m\u00eb t\u00eb leht\u00eb. <\/p>\n

Teknika e shfryt\u00ebzimit: <\/p>\n