{"id":105785,"date":"2022-12-02T15:36:49","date_gmt":"2022-12-02T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap"},"modified":"2022-12-02T15:36:49","modified_gmt":"2022-12-02T13:36:49","slug":"root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","title":{"rendered":"Vulnerabilitet Root n\u00eb mjetin e menaxhimit t\u00eb paketave Snap","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Complania Qualys ka zbuluar nj\u00eb vulnerabilitet t\u00eb rreziksh\u00ebm t\u00eb tret\u00eb k\u00ebt\u00eb vit (CVE-2022-3328) n\u00eb utilitarin snap-confine, i cili ofrohet me flamur SUID root dhe thirret nga procesi snapd p\u00ebr t\u00eb krijuar nj\u00eb ambient ekzekutiv p\u00ebr aplikacionet q\u00eb shp\u00ebrndahen n\u00eb paketa t\u00eb pavarura n\u00eb formatin snap. Ky vulnerabilitet lejon nj\u00eb p\u00ebrdorues lokal, i paprivilegjuar, t\u00eb arrij\u00eb ekzekutimin e kodit me t\u00eb drejta root n\u00eb konfigurimin standard t\u00eb Ubuntu. Problemi \u00ebsht\u00eb zgjidhur n\u00eb versionin snapd 2.57.6. P\u00ebrdit\u00ebsimet e paketave jan\u00eb l\u00ebshuar p\u00ebr t\u00eb gjitha deg\u00ebt e mb\u00ebshtetura t\u00eb Ubuntu. <\/p>\n

E interessant \u00ebsht\u00eb se vulnerabiliteti n\u00eb fjal\u00eb u p\u00ebrfshi gjat\u00eb procesit t\u00eb rregullimit t\u00eb nj\u00eb vulnerabiliteti t\u00eb ngjash\u00ebm n\u00eb snap-confine t\u00eb zbuluar n\u00eb shkurt. Hulumtuesit arrit\u00ebn t\u00eb p\u00ebrgatisin nj\u00eb eksploatues funksional, i cili ofron akses root n\u00eb Ubuntu Server 22.04, n\u00eb t\u00eb cilin, p\u00ebrve\u00e7 vulnerabilitetit n\u00eb snap-confine, jan\u00eb angazhuar gjithashtu dy vulnerabilitete n\u00eb procesin multipathd (CVE-2022-41974, CVE-2022-41973), t\u00eb lidhura me kalimin e kontrollit t\u00eb autorizimit gjat\u00eb d\u00ebrgimit t\u00eb komandave me privilegje dhe funksionimin e pasigurt me lidhje simbolike. <\/p>\n

Vulnerabiliteti n\u00eb snap-confine shkaktohet nga nj\u00eb gjendje garash n\u00eb funksionin must_mkdir_and_open_with_perms(), i shtuar p\u00ebr t\u00eb mbrojtur nga manipulimi i dosjes \/tmp\/snap.$SNAP_NAME n\u00eb nj\u00eb lidhje simbolike n\u00eb momentin pas kontrollit t\u00eb pron\u00ebsis\u00eb, por para thirrjes s\u00eb sistemit t\u00eb thirrjes mount p\u00ebr montimin bind t\u00eb dosjeve p\u00ebr paket\u00ebn n\u00eb formatin snap. Mbrojtja e shtuar p\u00ebrfshinte rinonimin e dosjes \/tmp\/snap.$SNAP_NAME n\u00eb nj\u00eb dosje tjet\u00ebr n\u00eb \/tmp me nj\u00eb em\u00ebr t\u00eb rast\u00ebsish\u00ebm, n\u00ebse ekziston dhe nuk i takon p\u00ebrdoruesit root. <\/p>\n

Gjat\u00eb operacionit t\u00eb riem\u00ebrtimit t\u00eb katalogut \/tmp\/snap.$SNAP_NAME, hulumtuesit shfryt\u00ebzuan faktin se snap-confine gjithashtu krijon katalogun \/tmp\/snap.rootfs_XXXXXX p\u00ebr rr\u00ebnj\u00ebn e p\u00ebrmbajtjes s\u00eb paket\u00ebs snap. Pjesa \u00abXXXXXX\u00bb n\u00eb emrin zgjidhet rast\u00ebsisht n\u00ebp\u00ebrmjet mkdtemp(), por paketa me emrin \u00abrootfs_XXXXXX\u00bb mund t\u00eb kaloj\u00eb verifikimin n\u00eb funksionin sc_instance_name_validate (dmth, ideja \u00ebsht\u00eb q\u00eb emri $SNAP_NAME t\u00eb marr\u00eb vler\u00ebn \u00abrootfs_XXXXXX\u00bb dhe at\u00ebher\u00eb operacioni i riem\u00ebrtimit do t\u00eb \u00e7oj\u00eb n\u00eb tejkalimin e katalogut \/tmp\/snap.rootfs_XXXXXX me rr\u00ebnj\u00ebn snap). <\/p>\n

P\u00ebr t\u00eb arritur p\u00ebrdorimin e nj\u00ebkohsh\u00ebm t\u00eb \/tmp\/snap.rootfs_XXXXXX dhe riem\u00ebrimin e \/tmp\/snap.$SNAP_NAME, u nis\u00ebn dy ekzemplar\u00eb t\u00eb snap-confine. Pasi ekzemplari i par\u00eb krijonte \/tmp\/snap.rootfs_XXXXXX, procesi u bllokua dhe u nis ekzemplari i dyt\u00eb me emrin e paket\u00ebs rootfs_XXXXXX, \u00e7ka b\u00ebri q\u00eb katalogu p\u00ebrkoh\u00ebsisht \/tmp\/snap.$SNAP_NAME i ekzemplar\u00ebve t\u00eb dyt\u00eb t\u00eb b\u00ebhej katalogu rr\u00ebnj\u00ebsor \/tmp\/snap.rootfs_XXXXXX i t\u00eb parit. Menj\u00ebher\u00eb pas p\u00ebrfundimit t\u00eb riem\u00ebrimit, ekzemplari i dyt\u00eb p\u00ebrfundoi n\u00eb m\u00ebnyr\u00eb t\u00eb papritur, dhe \/tmp\/snap.rootfs_XXXXXX u z\u00ebvend\u00ebsua me manipulimin e gjendjes dhe gar\u00ebs, si\u00e7 ndodhi me shfryt\u00ebzimin e cenueshm\u00ebris\u00eb s\u00eb shkurtit. Pas z\u00ebvend\u00ebsimit, nga ekzemplari i par\u00eb u hoq bllokimi i ekzekutimit dhe sulmuesit mor\u00ebn kontroll t\u00eb plot\u00eb mbi katalogun rr\u00ebnj\u00eb t\u00eb snap. <\/p>\n

N\u00eb faz\u00ebn e fundit u krijua nj\u00eb lidhje simbolike \/tmp\/snap.rootfs_XXXXXX\/tmp, e cila u p\u00ebrdor nga funksioni sc_bootstrap_mount_namespace() p\u00ebr t\u00eb b\u00ebr\u00eb montimin bind t\u00eb katalogut real t\u00eb shkruajtsh\u00ebm \/tmp n\u00eb \u00e7do katalog FS, pasi thirrja mount() merr parasysh lidhjet simbolike para montimit. Montimi i till\u00eb bllokohet nga kufizimet e AppArmor, por p\u00ebr t\u00eb anashkaluar k\u00ebt\u00eb bllokad\u00eb, n\u00eb shfryt\u00ebzim u angazhuan dy cenueshm\u00ebri mb\u00ebshtet\u00ebse n\u00eb multipathd.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0442\u0440\u0435\u0442\u044c\u044e \u0432 \u044d\u0442\u043e\u043c\u0443 \u0433\u043e\u0434\u0443 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-3328) \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 snap-confine, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c SUID root \u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c snapd \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 snap. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 Ubuntu \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105785","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cenueshm\u00ebria e root n\u00eb mjetin e menaxhimit t\u00eb paketave Snap | ProHoster","description":"Kompania Qualys identifikoi nj\u00eb cenueshm\u00ebri t\u00eb tret\u00eb p\u00ebr k\u00ebt\u00eb vit (CVE-2022-3328) n\u00eb utilitarin snap-confine, i cili ofrohet me flamurin SUID root dhe thirret nga procesi snapd p\u00ebr t\u00eb formuar ambientin e ekzekutuesh\u00ebm p\u00ebr.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Root-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 Snap | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0442\u0440\u0435\u0442\u044c\u044e \u0432 \u044d\u0442\u043e\u043c\u0443 \u0433\u043e\u0434\u0443 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-3328) \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 snap-confine, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c SUID root \u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c snapd \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-02T13:36:49+00:00","article:modified_time":"2022-12-02T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/105785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=105785"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/105785\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=105785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=105785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=105785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}