Kompania Qualys ka zbuluar nj\u00eb dob\u00ebsi t\u00eb rrezikshme (CVE-2023-4911) n\u00eb ngarkuesin ld.so, i cili shp\u00ebrndahet si pjes\u00eb e bibliotek\u00ebs sistemore C Glibc (GNU libc). Dob\u00ebsia i lejon nj\u00eb p\u00ebrdoruesi lokal t\u00eb rris\u00eb privilegjet n\u00eb sistem duke p\u00ebrcaktuar t\u00eb dh\u00ebna t\u00eb formatuara posa\u00e7\u00ebrisht n\u00eb variabl\u00ebn e mjedisit GLIBC_TUNABLES p\u00ebrpara nisjes s\u00eb nj\u00eb skedari t\u00eb ekzekutuesh\u00ebm me flamurin suid root, p\u00ebr shembull, \/usr\/bin\/su. <\/p>\n
Mund\u00ebsia e shfryt\u00ebzimit t\u00eb suksessh\u00ebm t\u00eb k\u00ebsaj dob\u00ebsie \u00ebsht\u00eb demonstruar n\u00eb Fedora 37 dhe 38, Ubuntu 22.04 dhe 23.04, Debian 12 dhe 13. Supozohet se dob\u00ebsia shfaqet edhe n\u00eb \u00e7do shp\u00ebrndarje tjet\u00ebr q\u00eb p\u00ebrdor Glibc. Shp\u00ebrndarjet e bazuara n\u00eb bibliotek\u00ebn sistemore C Musl, si Alpine Linux, nuk preken nga ky problem. Dob\u00ebsia \u00ebsht\u00eb korrigjuar n\u00eb patch-in e shtuar m\u00eb 2 tetor. Ecuria e publikimit t\u00eb p\u00ebrdit\u00ebsimeve t\u00eb paketave n\u00eb shp\u00ebrndarje mund t\u00eb ndiqet n\u00eb faqet e Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, Gentoo, ALT Linux. <\/p>\n
Vulnerabiliteti \u00ebsht\u00eb shkaktuar nga nj\u00eb ndryshim i b\u00ebr\u00eb n\u00eb prill 2021 dhe \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb versionin glibc 2.34. P\u00ebr shkak t\u00eb nj\u00eb gabimi n\u00eb kodin e analiz\u00ebs s\u00eb vargjeve t\u00eb caktuara n\u00eb variablin e mjedisit GLIBC_TUNABLES, nj\u00eb kombinim i pap\u00ebrshtatsh\u00ebm parametrash n\u00eb k\u00ebt\u00eb variab\u00ebl \u00e7on n\u00eb shkrynjen e vler\u00ebs s\u00eb analizuar jasht\u00eb kufijve t\u00eb memorie t\u00eb alokuar. Problemi shfaqet kur n\u00eb vend t\u00eb sekuencave standarde \u201ename=val\u201c, parametrat jan\u00eb caktuar n\u00eb form\u00ebn e dy caktimeve \u201ename=name=val\u201c. N\u00eb k\u00ebt\u00eb rast, caktimi p\u00ebrpunoj\u00eb dy her\u00eb, s\u00eb pari si \u201ename=name=val\u201c, dhe m\u00eb pas si \u201ename=val\u201c. P\u00ebr shkak t\u00eb k\u00ebtij p\u00ebrpunimi t\u00eb dyfisht\u00eb, formohet treguesi \u201ename=name=val:name=val\u201c, i cili ka nj\u00eb madh\u00ebsi q\u00eb tejkalon madh\u00ebsin\u00eb e buferave tunestr. <\/p>\n
K\u00ebrkuesit kan\u00eb p\u00ebrgatitur nj\u00eb eksploit t\u00eb q\u00ebndruesh\u00ebm, i cili lejon marrjen e privilegjeve root duke u aplikuar praktikisht me \u00e7do program q\u00eb ka flamurin suid root. P\u00ebrjashtim b\u00ebjn\u00eb utiliteti sudo (nd\u00ebrron vler\u00ebn ELF RUNPATH), utilitetet chage dhe passwd n\u00eb Fedora (mbrohen me rregulla t\u00eb ve\u00e7anta SELinux) dhe utiliteti snap-confine n\u00eb Ubuntu (mbrohet me rregulla t\u00eb ve\u00e7anta AppArmor). Metoda e propozuar e shfryt\u00ebzimit gjithashtu nuk funksionon n\u00eb RHEL 8 dhe RHEL 9, megjith\u00ebse k\u00ebto deg\u00eb jan\u00eb t\u00eb ekspozuara ndaj dob\u00ebsis\u00eb (p\u00ebr sulmin k\u00ebrkohet krijimi i nj\u00eb eksploit tjet\u00ebr). Kodi i eksploitit do t\u00eb publikohet m\u00eb von\u00eb, pas eliminimit t\u00eb p\u00ebrgjithsh\u00ebm t\u00eb dob\u00ebsis\u00eb. P\u00ebr t\u00eb kontrolluar n\u00ebse sistemi juaj \u00ebsht\u00eb i ekspozuar ndaj k\u00ebsaj dob\u00ebsie, mund t\u00eb p\u00ebrdorni komand\u00ebn e m\u00ebposhtme, e cila n\u00eb rast se ka nj\u00eb problem do t\u00eb p\u00ebrfundoj\u00eb me d\u00ebshtim: env -i \"GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A\" \"Z=`printf '192x' 1`\" \/usr\/bin\/su --help <\/p>\n
Ve\u00e7mas theksohet edhe korrigjimi i dy dob\u00ebsive t\u00eb tjera n\u00eb Glibc: <\/p>\n