Kompania Qualys zbuloi dy vulnerabilitete n\u00eb mjetet apport (CVE-2025-5054) dhe systemd-coredump (CVE-2025-4598), t\u00eb cilat p\u00ebrdoren p\u00ebr procesimin e skedar\u00ebve core, t\u00eb gjeneruar pas p\u00ebrfundimit t\u00eb papritur t\u00eb proceseve. Vulnerabilitetet lejojn\u00eb qasje n\u00eb skedar\u00ebt core, t\u00eb ruajtur pas p\u00ebrfundimit t\u00eb papritur t\u00eb aplikacioneve suid ose disa proceseve sistemike, n\u00eb memorien e t\u00eb cilave mund t\u00eb p\u00ebrmbahen kredenciale t\u00eb ruajtura ose \u00e7el\u00ebsa enkriptimi. Utilita apport thirret automatikisht p\u00ebr t\u00eb ruajtur core-dump n\u00eb Ubuntu, nd\u00ebrsa systemd-coredump n\u00eb Red Hat Enterprise Linux 9+, Fedora dhe shum\u00eb shp\u00ebrndarje t\u00eb tjera t\u00eb Linux-it. <\/p>\n
Demonstruar nj\u00eb teknik\u00eb sulmi, gjat\u00eb s\u00eb cil\u00ebs krijoheshin kushte p\u00ebr p\u00ebrfundimin e papritur t\u00eb aplikacionit suid unix_chkpwd dhe p\u00ebr t\u00eb fituar qasje n\u00eb skedarin core me dump-in e gjendjes gjat\u00eb r\u00ebnies. N\u00eb core-dump-in e ruajtur ishin prezent\u00eb hash-at e fjal\u00ebkalimeve t\u00eb p\u00ebrdoruesve t\u00eb sistemit, q\u00eb mbeteshin n\u00eb memorien e procesit t\u00eb p\u00ebrfunduar papritur pas ngarkimit t\u00eb p\u00ebrmbajtjes \/etc\/shadow. Mund\u00ebsia e shfryt\u00ebzimit t\u00eb vulnerabiliteteve u demonstrua n\u00eb Ubuntu 24.04 dhe Fedora 40\/41, por supozohet se edhe shp\u00ebrndarje t\u00eb tjera jan\u00eb t\u00eb ndjeshme ndaj sulmeve t\u00eb ngjashme. <\/p>\n
T\u00eb dy vulnerabilitetet shkaktohen nga nj\u00eb gjendje gar\u00eb q\u00eb lejon z\u00ebvend\u00ebsimin e procesit suid t\u00eb p\u00ebrfunduar papritur me nj\u00eb proces tjet\u00ebr n\u00eb momentin pas fillimit t\u00eb p\u00ebrpunimit nga b\u00ebrthama t\u00eb p\u00ebrfundimit, por p\u00ebrpara verifikimit nga p\u00ebrpunuesi n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit t\u00eb parametrave t\u00eb procesit p\u00ebrmes \/proc\/pid\/files. Thirrja apport dhe systemd-coredump b\u00ebhet n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb: b\u00ebrthama, duke marr\u00eb informacion p\u00ebr p\u00ebrfundimin e procesit, th\u00ebrret p\u00ebrpunuesin e specifikuar n\u00eb skedarin \/proc\/sys\/kernel\/core_pattern, dhe m\u00eb pas i transmeton p\u00ebrmbajtjen e core-dump-it p\u00ebrmes rrjedh\u00ebs hyr\u00ebse. <\/p>\n
Generimi i core-dump-it dhe aktivizimi i p\u00ebrpunuesit nuk ndodhin menj\u00ebher\u00eb dhe ky koh\u00eb \u00ebsht\u00eb e mjaftueshme p\u00ebr t\u00eb z\u00ebvend\u00ebsuar procesin e ndaluar suid me nj\u00eb proces t\u00eb zakonsh\u00ebm t\u00eb p\u00ebrdoruesit. N\u00eb rastin e z\u00ebvend\u00ebsimit, p\u00ebrpunuesi i aktivizuar i core-dump-eve do t\u00eb mendoj\u00eb se d\u00ebshtimi ndodhi jo n\u00eb procesin suid, por n\u00eb nj\u00eb aplikacion t\u00eb zakonsh\u00ebm t\u00eb p\u00ebrdoruesit dhe p\u00ebr rrjedhoj\u00eb do t\u00eb ruaj\u00eb skedarin core me mund\u00ebsin\u00eb e hyrjes p\u00ebr p\u00ebrdoruesit e zakonsh\u00ebm, dhe jo vet\u00ebm p\u00ebr administratorin. <\/p>\n
Sulmi n\u00eb apport p\u00ebrb\u00ebhet nga hapet e m\u00ebposhtme: <\/p>\n
P\u00ebr t\u00eb marr\u00eb identifikuesin e nevojsh\u00ebm p\u00ebr procesin e ri, i cili p\u00ebrputhet me identifikuesin e procesit suid, para d\u00ebrgimit t\u00eb sinjalit SIGSEGV, procesi suid ndalohet me sinjalin SIGSTOP dhe gjat\u00eb ndalimit proceset e reja nis\u00ebn ciklikisht derisa t\u00eb merret nj\u00eb PID me nj\u00eb num\u00ebr t\u00eb m\u00ebparsh\u00ebm, af\u00ebr procesit suid q\u00eb z\u00ebvend\u00ebsohet. Pas zhvendosjes s\u00eb num\u00ebrimit t\u00eb PID, procesit suid i d\u00ebrgohen sinjalet SIGSEGV dhe SIGCONT, pas s\u00eb cil\u00ebs d\u00ebrgohet SIGKILL dhe proceset e reja nisen ciklikisht p\u00ebr t\u00eb arritur PID-n\u00eb e nj\u00ebjt\u00eb si ajo e procesit suid. <\/p>\n
Sa i an\u00eb nj\u00ebra, sulmi ndaj systemd-coredump \u00ebsht\u00eb m\u00eb i leht\u00eb, pasi nuk ka nevoj\u00eb t\u00eb z\u00ebvend\u00ebsohet procesi suid me nj\u00eb proces n\u00eb nj\u00eb hap\u00ebsir\u00eb t\u00eb ve\u00e7ant\u00eb p\u00ebrdoruesi, mjafton t\u00eb arrihet p\u00ebrputhja e AT_UID dhe AT_EUID. Nga ana tjet\u00ebr, systemd-coredump \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C dhe ekzekutohet mjaft shpejt, gj\u00eb q\u00eb i jep m\u00eb pak koh\u00eb p\u00ebr z\u00ebvend\u00ebsim, n\u00eb krahasim me apport, i cili \u00ebsht\u00eb shkruar n\u00eb Python dhe n\u00eb procesin e inicializimit ngarkon skedar\u00eb t\u00eb ndrysh\u00ebm pyc. Nj\u00eb problem i till\u00eb zgjidhet me ngadal\u00ebsimin artificial t\u00eb systemd-coredump \u2014 kur thirret skedari suid, d\u00ebrgohet nj\u00eb num\u00ebr shum\u00eb i madh argumentesh n\u00eb komand\u00eb, q\u00eb krijon nj\u00eb vones\u00eb t\u00eb nevojshme, e cila ndodh gjat\u00eb analizimit t\u00eb \/proc\/pid\/cmdline. <\/p>\n
Gjat\u00eb analiz\u00ebs s\u00eb dob\u00ebsive, studiuesit gjithashtu zbuluan se systemd-coredump n\u00eb konfigurimin e thirrjes nuk specifikon n\u00eb \/proc\/sys\/kernel\/core_pattern flakun \u2018%d\u2019, q\u00eb i lejon sulmuesit t\u00eb k\u00ebrkojn\u00eb mbylljen emergjente t\u00eb proceseve n\u00eb sfond, t\u00eb cilat ekzekutohen me t\u00eb drejta root dhe q\u00eb zhvillojn\u00eb procese t\u00eb tjera duke ndryshuar identifikuesin e p\u00ebrdoruesit n\u00eb nj\u00eb p\u00ebrdorues t\u00eb pa privilegjuar n\u00ebn t\u00eb cilin kryhet sulmi. Nj\u00eb mund\u00ebsi e till\u00eb lejon kryerjen e nj\u00eb sulmi jo vet\u00ebm ndaj aplikacioneve setuid, por gjithashtu ndaj proceseve si sshd-session (OpenSSH), sd-pam (systemd) dhe cron, p\u00ebr t\u00eb marr\u00eb t\u00eb dh\u00ebna konfidenciale t\u00eb mbetura n\u00eb memorien e tyre, si\u00e7 jan\u00eb \u00e7el\u00ebsat privat\u00eb, hash-et e fjal\u00ebkalimeve nga \/etc\/shadow, etiketat kanarin\u00eb nga staku dhe t\u00eb dh\u00ebnat p\u00ebr kalimin e randomizimit t\u00eb hap\u00ebsir\u00ebs adresuese (ASLR). <\/p>\n