{"id":105336,"date":"2022-10-19T15:37:24","date_gmt":"2022-10-19T13:37:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme"},"modified":"2022-10-19T15:37:24","modified_gmt":"2022-10-19T13:37:24","slug":"uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme","title":{"rendered":"Dob\u00ebsia n\u00eb n\u00ebn-sistemin io_uring t\u00eb kernelit Linux, e cila lejon rritjen e privilegjeve n\u00eb sistem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb implementimin e nd\u00ebrfaqes s\u00eb hyrjes\/ashtu si daljes asinkrone io_uring, e cila \u00ebsht\u00eb pjes\u00eb e b\u00ebrtham\u00ebs Linux q\u00eb nga versioni 5.1, \u00ebsht\u00eb zbuluar nj\u00eb k\u00ebrc\u00ebnim (CVE-2022-2602), i cili lejon nj\u00eb p\u00ebrdorues t\u00eb pa privilegjuar t\u00eb fitoj\u00eb t\u00eb drejtat root n\u00eb sistem. Prania e problemit \u00ebsht\u00eb konfirmuar n\u00eb deg\u00ebn 5.4 dhe b\u00ebrthamat q\u00eb fillojn\u00eb nga dega 5.15. <\/p>\n
K\u00ebrc\u00ebnimi shkaktohet nga aksesimi i nj\u00eb blloku t\u00eb l\u00ebn\u00eb lir\u00eb (use-after-free) n\u00eb n\u00ebnstruktur\u00ebn io_uring, i cili ndodh p\u00ebr shkak t\u00eb nj\u00eb gjendjeje garancie gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkes\u00ebs io_uring mbi nj\u00eb skedar t\u00eb caktuar gjat\u00eb ekzekutimit t\u00eb mbledhjes s\u00eb plehrave p\u00ebr soketet Unix, n\u00ebse mbledh\u00ebsi i plehrave liron t\u00eb gjitha deshifrantet e regjistruara dhe deshifranti me t\u00eb cilin punon io_uring. P\u00ebr t\u00eb krijuar kushte artificiale t\u00eb shfaqjes s\u00eb k\u00ebtij k\u00ebrc\u00ebnimi, mund t\u00eb vonohet k\u00ebrkesa duke p\u00ebrdorur userfaultfd deri n\u00eb momentin kur ndodh lirimi i kujtes\u00ebs nga mbledh\u00ebsi i plehrave. <\/p>\n
K\u00ebrkuesit q\u00eb zbuluan problemin shpall\u00ebn krijimin e nj\u00eb eksploiti funksional, t\u00eb cilin ata kan\u00eb nd\u00ebrmend ta publikojn\u00eb m\u00eb 25 tetor, p\u00ebr t\u2019u dh\u00ebn\u00eb p\u00ebrdoruesve koh\u00eb p\u00ebr t\u00eb instaluar p\u00ebrmir\u00ebsimet. Nj\u00eb korrigjim \u00ebsht\u00eb p\u00ebr momentin i disponuesh\u00ebm si nj\u00eb patch. P\u00ebrmir\u00ebsimet p\u00ebr shp\u00ebrndarjet ende nuk jan\u00eb l\u00ebshuar, por mund t\u00eb ndiqni paraqitjen e tyre n\u00eb faqet: Debian, Ubuntu, Gentoo, RHEL, Fedora, SUSE\/openSUSE, Arch. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"