{"id":120749,"date":"2024-11-28T21:45:59","date_gmt":"2024-11-28T19:45:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root"},"modified":"2024-11-28T21:45:59","modified_gmt":"2024-11-28T19:45:59","slug":"uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb tuned, e cila lejon ekzekutimin e kodit me t\u00eb drejtat root.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb procesin e prapambetur t\u00eb zhvilluar nga Red Hat, tuned, i cili kryen optimizimin automatik t\u00eb cil\u00ebsimeve t\u00eb pajisjeve dhe b\u00ebrtham\u00ebs n\u00eb var\u00ebsi t\u00eb ngarkes\u00ebs aktuale, \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2024-52336) q\u00eb lejon nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb ekzekutoj\u00eb \u00e7do komand\u00eb me t\u00eb drejtat e root. <\/p>\n
Problemi \u00ebsht\u00eb i pranish\u00ebm n\u00eb implementimin e metod\u00ebs DBus \u00abcom.redhat.tuned.instance_create\u00bb, e cila p\u00ebrdoret p\u00ebr t\u00eb krijuar instanca plugins, n\u00eb t\u00eb cil\u00ebn mund t\u00eb kalohen parametrat \u00abscript_pre\u00bb dhe \u00abscript_post\u00bb p\u00ebr t\u00eb specifikuar skriptet q\u00eb do t\u00eb ekzekutohen para ose pas krijimit t\u00eb instanc\u00ebs s\u00eb plugin-it. Problemi \u00ebsht\u00eb se cil\u00ebsimet e Polkit lejojn\u00eb \u00e7do p\u00ebrdorues lokal t\u00eb regjistruar pa autentifikim t\u00eb d\u00ebrgoj\u00eb nj\u00eb k\u00ebrkes\u00eb DBus n\u00eb k\u00ebt\u00eb metod\u00eb, nd\u00ebrkoh\u00eb q\u00eb procesi i tuned ekzekutohet me privilegje root dhe ekzekuton gjithashtu skriptet e sh\u00ebnuara n\u00eb parametrat \u00abscript_pre\u00bb dhe \u00abscript_post\u00bb me privilegje root. P\u00ebr shembull, p\u00ebr t\u00eb ekzekutuar skriptin \/path\/to\/myscript.sh me privilegje root, mjafton q\u00eb p\u00ebrdoruesi t\u00eb ekzekutoj\u00eb komand\u00ebn: gdbus call -y -d com.redhat.tuned -o \/Tuned \\ -m com.redhat.tuned.control.instance_create cpu myinstance \u2018{\u00abscript_pre\u00bb: \u00ab\/path\/to\/myscript.sh\u00bb, \u00abdevices\u00bb: \u00ab*\u00bb}\u2019 <\/p>\n
N\u00eb metod\u00ebn DBus \"com.redhat.tuned.instance_create\" gjithashtu ka nj\u00eb vulnerabilitet m\u00eb pak t\u00eb rreziksh\u00ebm (CVE-2024-52337), i shkaktuar nga mungesa e pastrimit t\u00eb vler\u00ebs me emrin e instanc\u00ebs s\u00eb pluginit gjat\u00eb regjistrimit n\u00eb log. Nj\u00eb sulmues mund t\u00eb shtoj\u00eb emra q\u00eb p\u00ebrmbajn\u00eb vij\u00eb t\u00eb re dhe simbole escape p\u00ebr emulatorin e terminalit, t\u00eb cilat mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb ndryshuar struktur\u00ebn e logut dhe p\u00ebr t\u00eb kryer veprime gjat\u00eb shfaqjes s\u00eb daljes s\u00eb komand\u00ebs \"tuned-adm get_instances\" n\u00eb terminal. EVIL=`echo -e 'this is\\nevil\\033[?1047h'` gdbus call -y -d com.redhat.tuned -o \/Tuned -m com.redhat.tuned.control.instance_create cpu '$EVIL' '{\"devices\": \"*\"}' <\/p>\n
Vulnerabilitetet shfaqen duke filluar nga versione tuned 2.23, t\u00eb formuar n\u00eb fillim t\u00eb qershorit 2024, dhe jan\u00eb rregulluar n\u00eb l\u00ebshimin tuned 2.24.1. Nga distribucione t\u00eb m\u00ebdha, problemet jan\u00eb rregulluar n\u00eb RHEL 9, Fedora 40, Arch Linux dhe Gentoo. N\u00eb deg\u00ebt stabile t\u00eb Ubuntu, Debian dhe SUSE\/openSUSE, vulnerabilitetet nuk shfaqen, pasi ato ofrojn\u00eb versione t\u00eb vjetra t\u00eb tuned (<2.23), t\u00eb paprekura nga vulnerabilitetet. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"