{"id":105785,"date":"2022-12-02T15:36:49","date_gmt":"2022-12-02T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap"},"modified":"2022-12-02T15:36:49","modified_gmt":"2022-12-02T13:36:49","slug":"root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","title":{"rendered":"Vulneraht m\u00eb t\u00eb larta n\u00eb mjetin e menaxhimit t\u00eb pakove Snap","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Qualys identifikoi nj\u00eb t\u00eb tret\u00eb t\u00eb rreziksh\u00ebm k\u00ebt\u00eb vit (CVE-2022-3328) n\u00eb utilitarin snap-confine, i cili ofrohet me flag SUID root dhe thirret nga procesi snapd p\u00ebr t\u00eb krijuar nj\u00eb ambient ekzekutiv p\u00ebr aplikacionet, t\u00eb shp\u00ebrndara n\u00eb paketat autonome n\u00eb formatin snap. Vulnerabiliteti i lejon nj\u00eb p\u00ebrdoruesi lokal t\u00eb paautorizuar t\u00eb arrij\u00eb ekzekutimin e kodit me privilegje root n\u00eb konfigurimin e parazgjedhur t\u00eb Ubuntu. Problemi \u00ebsht\u00eb zgjidhur n\u00eb l\u00ebshimin snapd 2.57.6. P\u00ebrdit\u00ebsimet e paketave jan\u00eb l\u00ebshuar p\u00ebr t\u00eb gjith\u00eb deg\u00ebt e mb\u00ebshtetura t\u00eb Ubuntu. <\/p>\n
\u00cbsht\u00eb interesante se vulnerabiliteti n\u00eb fjal\u00eb u sh\u00ebnua gjat\u00eb procesit t\u00eb rregullimit t\u00eb nj\u00eb vulnerabiliteti t\u00eb ngjash\u00ebm n\u00eb snap-confine q\u00eb ndodhi n\u00eb shkurt. Hulumtuesit arrin\u00eb t\u00eb p\u00ebrgatitin nj\u00eb exploit funksional q\u00eb ofron qasje root n\u00eb Ubuntu Server 22.04, ku p\u00ebrve\u00e7 vulnerabilitetit n\u00eb snap-confine, jan\u00eb angazhuar gjithashtu dy vulnerabilitete n\u00eb procesin multipathd (CVE-2022-41974, CVE-2022-41973), t\u00eb lidhura me kalimin e kontrollit t\u00eb autorizimeve gjat\u00eb transferimit t\u00eb komandave me privilegje dhe pun\u00ebn e pasigurt me lidhjet simbolike. <\/p>\n
Vulnerabiliteti n\u00eb snap-confine shkaktohet nga nj\u00eb gjendje garuese n\u00eb funksionin must_mkdir_and_open_with_perms(), e cila \u00ebsht\u00eb shtuar p\u00ebr t\u00eb mbrojtur nga z\u00ebvend\u00ebsimi i drejtoris\u00eb \"\/tmp\/snap.$SNAP_NAME\" me nj\u00eb lidhje simbolike pas kontrollit t\u00eb pron\u00ebsis\u00eb, por para thirrjes s\u00eb sistemit t\u00eb thirrjes mount p\u00ebr t\u00eb bindur drejtorit\u00eb p\u00ebr paket\u00ebn n\u00eb formatin snap. Mbrojtja e shtuar q\u00ebndronte n\u00eb rinovimin e drejtoris\u00eb \"\/tmp\/snap.$SNAP_NAME\" n\u00eb nj\u00eb tjet\u00ebr direktor n\u00eb \"\/tmp\" me nj\u00eb em\u00ebr t\u00eb rast\u00ebsish\u00ebm, n\u00ebse ajo ekziston dhe nuk i p\u00ebrket p\u00ebrdoruesit root. <\/p>\n
Gjat\u00eb operacionit t\u00eb rinominimit t\u00eb katalogut \/tmp\/snap.$SNAP_NAME, hulumtuesit shfryt\u00ebzuan q\u00eb snap-confine gjithashtu krijon katalogun \/tmp\/snap.rootfs_XXXXXX p\u00ebr rr\u00ebnj\u00ebn e p\u00ebrmbajtjes s\u00eb paket\u00ebs snap. Pjesa \u00abXXXXXX\u00bb n\u00eb em\u00ebr zgjidhet rast\u00ebsisht me ndihm\u00ebn e mkdtemp(), por paketa me emrin \u00abrootfs_XXXXXX\u00bb mund t\u00eb kaloj\u00eb verifikimin n\u00eb funksionin sc_instance_name_validate (dmth, ideja \u00ebsht\u00eb q\u00eb emri $SNAP_NAME t\u00eb marr\u00eb vler\u00ebn \u00abrootfs_XXXXXX\u00bb dhe at\u00ebher\u00eb operacioni i rinominimit do t\u00eb \u00e7oj\u00eb n\u00eb mbivendosjen e katalogut \/tmp\/snap.rootfs_XXXXXX me rr\u00ebnj\u00ebn snap). <\/p>\n
P\u00ebr t\u00eb arritur p\u00ebrdorimin e nj\u00ebkohsh\u00ebm t\u00eb \"\/tmp\/snap.rootfs_XXXXXX\" dhe rinovimin e \"\/tmp\/snap.$SNAP_NAME\" ishin nisur dy ekzemplar\u00eb t\u00eb snap-confine. Sa her\u00eb q\u00eb ekzemplari i par\u00eb krijonte \"\/tmp\/snap.rootfs_XXXXXX\", procesi blokonte dhe ekzekutohej ekzemplari i dyt\u00eb me emrin e paket\u00ebs rootfs_XXXXXX, e cila rezultonte n\u00eb at\u00eb q\u00eb direktoria temporale \"\/tmp\/snap.$SNAP_NAME\" e ekzemplarit t\u00eb dyt\u00eb b\u00ebhej rr\u00ebnja e drejtoris\u00eb \"\/tmp\/snap.rootfs_XXXXXX\" t\u00eb ekzemplarit t\u00eb par\u00eb. Menj\u00ebher\u00eb pas p\u00ebrfundimit t\u00eb rinovimit, ekzemplari i dyt\u00eb mbyllej papritur dhe \"\/tmp\/snap.rootfs_XXXXXX\" ishte z\u00ebvend\u00ebsuar duke manipuluar gjendjen e gar\u00ebs, si\u00e7 ndodhte me shfryt\u00ebzimin e vulnerabilitetit t\u00eb shkurtit. Pas z\u00ebvend\u00ebsimit, nga ekzemplari i par\u00eb ishte hequr bllokimi i ekzekutimit dhe sulmuesit merrnin kontroll t\u00eb plot\u00eb mbi drejtorin\u00eb rr\u00ebnj\u00eb t\u00eb snap. <\/p>\n
N\u00eb faz\u00ebn p\u00ebrfundimtare krijohej nj\u00eb lidhje simbolike \"\/tmp\/snap.rootfs_XXXXXX\/tmp\", e cila p\u00ebrdorej nga funksioni sc_bootstrap_mount_namespace() p\u00ebr t\u00eb bindur drejtorin\u00eb e v\u00ebrtet\u00eb t\u00eb shkruarshme \"\/tmp\" n\u00eb \u00e7do drejtor FS, pasi thirrja mount() ndjek lidhjet simbolike para montimit. Montimi i till\u00eb bllokohet nga kufizimet AppArmor, por p\u00ebr t\u00eb anashkaluar k\u00ebt\u00eb bllokim, n\u00eb exploit ishin angazhuar dy vulnerabilitete ndihm\u00ebse n\u00eb multipathd. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"