{"id":104360,"date":"2022-06-12T09:36:50","date_gmt":"2022-06-12T07:36:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-firejail-pozvolyayushhaya-poluchit-root-dostup-v-sisteme"},"modified":"2022-06-12T09:36:50","modified_gmt":"2022-06-12T07:36:50","slug":"uyazvimost-v-firejail-pozvolyayushhaya-poluchit-root-dostup-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-firejail-pozvolyayushhaya-poluchit-root-dostup-v-sisteme","title":{"rendered":"Vulnerabilitet n\u00eb firejail, i cili lejon qasje n\u00eb root n\u00eb sistem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb utilitarin p\u00ebr ekzekutimin e izoluar t\u00eb aplikacioneve Firejail \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2022-31214) q\u00eb lejon nj\u00eb p\u00ebrdorues lokal t\u00eb fitoj\u00eb t\u00eb drejta root n\u00eb sistemin kryesor. Nj\u00eb eksploit funksional \u00ebsht\u00eb n\u00eb dispozicion publik, i verifikuar n\u00eb versionet aktuale t\u00eb openSUSE, Debian, Arch, Gentoo dhe Fedora me utilitarin firejail t\u00eb instaluar. Problemi \u00ebsht\u00eb zgjidhur n\u00eb versionin firejail 0.9.70. Si nj\u00eb zgjidhje p\u00ebr mbrojtje, mund t\u00eb vendosen parametrat \"join no\" dhe \"force-nonewprivs yes\" n\u00eb konfigurimin (\/etc\/firejail\/firejail.config). <\/p>\n
Firejail p\u00ebrdor mekanizmin e hap\u00ebsirave t\u00eb emrave (namespaces), AppArmor dhe filtrimin e thirrjeve sistemore (seccomp-bpf) n\u00eb Linux p\u00ebr izolim, por p\u00ebr konfigurimin e ekzekutimit t\u00eb izoluar k\u00ebrkon privilegje t\u00eb rritura, t\u00eb cilat i merr p\u00ebrmes lidhjes me utilitarin e flamurit suid root ose p\u00ebrmes p\u00ebrdorimit t\u00eb sudo. Dob\u00ebsia \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb logjik\u00ebn e pun\u00ebs s\u00eb opsionit \"--join=\", i destinuar p\u00ebr t'u bashkuar me nj\u00eb ambient t\u00eb izoluar tashm\u00eb t\u00eb pun\u00ebs (analog me komand\u00ebn login p\u00ebr ambientin sandbox) me p\u00ebrcaktimin e ambientit sipas identifikuesit t\u00eb procesit q\u00eb po punon brenda tij. N\u00eb faz\u00ebn para se t\u00eb hiqen privilegjet, firejail p\u00ebrcakton privilegjet e procesit t\u00eb specifikuar dhe i aplikon ato te procesi i ri q\u00eb lidhet me ambientin p\u00ebrmes opsionit \"--join\". <\/p>\n
Para se t\u00eb bashkohet, b\u00ebhet nj\u00eb kontroll p\u00ebr t\u00eb par\u00eb n\u00ebse procesi i specifikuar \u00ebsht\u00eb n\u00eb ambientin firejail. Ky kontroll vler\u00ebson pranin\u00eb e skedarit \/run\/firejail\/mnt\/join. P\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsin\u00eb, sulmuesi mund t\u00eb simuloj\u00eb nj\u00eb ambient t\u00eb pavendosur firejail, duke p\u00ebrdorur hap\u00ebsir\u00ebn e pikave t\u00eb montimit (mount namespace), dhe pastaj t\u00eb lidhet me t\u00eb p\u00ebrmes opsionit \"--join\". N\u00ebse n\u00eb konfigurim nuk \u00ebsht\u00eb aktivizuar m\u00ebnyra e ndalimit t\u00eb marrjes s\u00eb privilegjive t\u00eb tjera n\u00eb proceset e reja (prctl NO_NEW_PRIVS), firejail do ta lidh\u00eb p\u00ebrdoruesin me ambientin e simuluar dhe do t\u00eb p\u00ebrpiqet t\u00eb aplikoj\u00eb konfigurimet e hap\u00ebsir\u00ebs s\u00eb emrave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespace) t\u00eb procesit init (PID 1). <\/p>\n
Si rezultat, procesi i lidhur p\u00ebrmes \"firejail --join\" do t\u00eb gjendet n\u00eb hap\u00ebsir\u00ebn fillestare t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve me privilegje t\u00eb pandryshuara, por n\u00eb nj\u00eb hap\u00ebsir\u00eb tjet\u00ebr montimi, t\u00ebr\u00ebsisht e kontrolluar nga sulmuesi. Sulmuesi gjithashtu mund t\u00eb ekzekutoj\u00eb programe setuid-root n\u00eb hap\u00ebsir\u00ebn e tij t\u00eb montimit, q\u00eb lejon, p\u00ebr shembull, ndryshimin e konfigurimeve n\u00eb \/etc\/sudoers ose parametrat PAM n\u00eb hierarkin\u00eb e tij t\u00eb skedar\u00ebve dhe t\u00eb fitoj\u00eb mund\u00ebsin\u00eb e ekzekutimit t\u00eb komandave me privilegje root p\u00ebrmes utilitar\u00ebve sudo ose su. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"