{"id":107498,"date":"2023-03-24T12:48:20","date_gmt":"2023-03-24T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=107498"},"modified":"2023-03-24T20:21:30","modified_gmt":"2023-03-24T18:21:30","slug":"uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"Cenueshm\u00ebri n\u00eb OverlayFS q\u00eb lejon p\u00ebrshkall\u00ebzimin e privilegjeve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb kernelin Linux, n\u00eb implementimin e sistemit t\u00eb skedar\u00ebve OverlayFS, \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri (CVE-2023-0386) q\u00eb mund t\u00eb shfryt\u00ebzohet p\u00ebr t\u00eb marr\u00eb qasje root n\u00eb sistemet ku \u00ebsht\u00eb instaluar n\u00ebn-sistemi FUSE dhe ku p\u00ebrdoruesve pa privilegje u lejohet montimi i ndarjeve OverlayFS (duke filluar nga kerneli Linux 5.11 me aktivizimin e user namespace pa privilegje). Problemi \u00ebsht\u00eb zgjidhur n\u00eb deg\u00ebn e kernelit 6.2. Publikimi i p\u00ebrdit\u00ebsimeve t\u00eb paketave n\u00eb shp\u00ebrndarje mund t\u00eb ndiqet n\u00eb faqet: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
Sulmi b\u00ebhet p\u00ebrmes kopjimit t\u00eb skedareve me flagset setgid\/setuid nga nj\u00eb parti e montuar n\u00eb m\u00ebnyr\u00eb nosuid, n\u00eb nj\u00eb parti OverlayFS, e cila ka nj\u00eb shtres\u00eb t\u00eb lidhur me nj\u00eb parti q\u00eb lejon ekzekutimin e skedareve suid. Vulnerabiliteti \u00ebsht\u00eb i ngjash\u00ebm me problemin CVE-2021-3847, i identifikuar n\u00eb vitin 2021, por dallon p\u00ebr k\u00ebrkesat m\u00eb t\u00eb ul\u00ebta p\u00ebr shp\u00ebrthim - n\u00eb problemin e vjet\u00ebr k\u00ebrkoheshin manipulime me xattrs, t\u00eb cilat jan\u00eb t\u00eb kufizuara kur p\u00ebrdoren hap\u00ebsirat e identifikuesit t\u00eb p\u00ebrdoruesit (user namespace), nd\u00ebrsa n\u00eb problemin e ri p\u00ebrdoren bitet setgid\/setuid, t\u00eb cilat nuk trajtohen posa\u00e7\u00ebrisht n\u00eb user namespace. <\/p>\n
Algoritmi i kryerjes s\u00eb sulmit: <\/p>\n
\n
Me an\u00eb t\u00eb n\u00ebnstruktur\u00ebs FUSE, montohet nj\u00eb FS, n\u00eb t\u00eb cil\u00ebn ka nj\u00eb skedar ekzekutiv p\u00ebr p\u00ebrdoruesin root me flagset setuid\/setgid, t\u00eb cilat jan\u00eb t\u00eb aksesueshme p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit n\u00eb shkrim. Gjat\u00eb montimit, FUSE vendos modin \"nosuid\".\n
\u00c7aktivizohen (unshare) hap\u00ebsirat e emrave t\u00eb p\u00ebrdoruesve dhe t\u00eb pikave t\u00eb montimit (user\/mount namespace).\n
Montohet OverlayFS me referenc\u00eb n\u00eb FS-n\u00eb e krijuar m\u00eb par\u00eb n\u00eb FUSE si nj\u00eb shtres\u00eb t\u00eb poshtme dhe nj\u00eb shtres\u00eb t\u00eb sip\u00ebrme mbi nj\u00eb katalog q\u00eb lejon mund\u00ebsin\u00eb e shkrimit. Katalogu i shtres\u00ebs s\u00eb sip\u00ebrme duhet t\u00eb vendoset n\u00eb FS, gjat\u00eb montimit t\u00eb s\u00eb cil\u00ebs nuk p\u00ebrdoret flagu \"nosuid\".\n
P\u00ebr skedarin suid n\u00eb ndarjen FUSE, me mjetin touch ndryshohet koha e modifikimit, gj\u00eb q\u00eb \u00e7on n\u00eb kopjimin e tij n\u00eb shtres\u00ebn e sip\u00ebrme t\u00eb OverlayFS.\n
Gjat\u00eb kopjimit, kerneli nuk i heq flamujt setgid\/setuid, \u00e7ka b\u00ebn q\u00eb skedari t\u00eb shfaqet n\u00eb nj\u00eb ndarje q\u00eb lejon p\u00ebrpunimin e setgid\/setuid.\n
P\u00ebr t\u00eb marr\u00eb t\u00eb drejta root, mjafton t\u00eb ekzekutohet skedari me flamujt setgid\/setuid nga drejtoria e lidhur me shtres\u00ebn e sip\u00ebrme t\u00eb OverlayFS. <\/ul>\n
Gjithashtu vlen t\u00eb p\u00ebrmendet zbulimi nga studiuesit e ekipit Google Project Zero i informacioneve p\u00ebr tre cenueshm\u00ebri, t\u00eb cilat u korrigjuan n\u00eb deg\u00ebn kryesore t\u00eb kernelit Linux 5.15, por nuk u transferuan n\u00eb paketat me kernel nga RHEL 8.x\/9.x dhe CentOS Stream 9. <\/p>\n