{"id":137763,"date":"2025-06-21T17:11:54","date_gmt":"2025-06-21T15:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pam-i-libblockdev-pozvolyayushhie-poluchit-prava-root-v-sisteme"},"modified":"2025-06-21T17:11:54","modified_gmt":"2025-06-21T15:11:54","slug":"uyazvimosti-v-pam-i-libblockdev-pozvolyayushhie-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pam-i-libblockdev-pozvolyayushhie-poluchit-prava-root-v-sisteme","title":{"rendered":"Vulnerabilitetet n\u00eb PAM dhe libblockdev, q\u00eb lejojn\u00eb marrjen e t\u00eb drejtave root n\u00eb sistem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Qualys zbuloi nj\u00eb vulnerabilitet (CVE-2025-6019) n\u00eb bibliotek\u00ebn libblockdev, e cila lejon, p\u00ebrmes manipulimeve me procesin e prapambetjes udisks, t\u00eb marrin t\u00eb drejta root n\u00eb sistem. Funksionaliteti i prototipit t\u00eb exploit-it \u00ebsht\u00eb demonstruar n\u00eb Ubuntu, Debian, Fedora dhe openSUSE Leap 15. <\/p>\n

Procesi udisks aplikohet praktikisht n\u00eb t\u00eb gjitha shp\u00ebrndarjet e Linux dhe ofron nj\u00eb nd\u00ebrfaqe D-Bus p\u00ebr t\u00eb kryer operacione me disqet, t\u00eb tilla si montimi dhe formatimi. P\u00ebr t\u00eb kryer veprime me disqet, udisks th\u00ebrret funksionet e bibliotek\u00ebs libblockdev. Qasja n\u00eb udisks \u00ebsht\u00eb parazgjedhur t\u00eb jet\u00eb e hapur vet\u00ebm p\u00ebr p\u00ebrdoruesit q\u00eb funksionojn\u00eb n\u00eb kontekstin 'allow_active', pra ata q\u00eb kan\u00eb qasje fizike n\u00eb kompjuter dhe jan\u00eb lidhur p\u00ebrmes konsol\u00ebs lokale ose kan\u00eb nisur nj\u00eb seanc\u00eb grafike. P\u00ebrdoruesit q\u00eb lidhen n\u00eb distanc\u00eb, si\u00e7 \u00ebsht\u00eb p\u00ebrmes ssh, nuk bien n\u00eb k\u00ebt\u00eb kontekst dhe nuk mund t\u00eb shfryt\u00ebzojn\u00eb drejtp\u00ebrdrejt dob\u00ebsit\u00eb. <\/p>\n

P\u00ebr t\u00eb anashkaluar k\u00ebt\u00eb kufizim, mund t\u00eb p\u00ebrdorni nj\u00eb mashtrim q\u00eb lejon ngritjen e nivelit t\u00eb autentifikimit n\u00eb 'allow_active' p\u00ebrmes manipulimeve me nisjen e sh\u00ebrbimit t\u00eb p\u00ebrdoruesit me sistemctl, t\u00eb cilin polkitd do ta perceptoj\u00eb si shenj\u00eb t\u00eb nj\u00eb seance lokale. Q\u00ebllimi i metod\u00ebs \u00ebsht\u00eb se polkitd p\u00ebrcakton pranin\u00eb e qasjes fizike dhe i jep nivelin 'allow_active' n\u00eb baza t\u00eb shenjave indirekte, t\u00eb cilat mund t\u00eb nd\u00ebrhyhet. Kufizimi i metod\u00ebs \u00ebsht\u00eb se p\u00ebr t\u00eb mashtruar polkitd, k\u00ebrkohet q\u00eb n\u00eb sistem t\u00eb ket\u00eb nj\u00eb seanc\u00eb aktive t\u00eb p\u00ebrdoruesit lokal me qasje fizike. <\/p>\n

Metoda e dyt\u00eb p\u00ebr t\u00eb fituar t\u00eb drejtat 'allow_active' \u00ebsht\u00eb shfryt\u00ebzimi i dob\u00ebsis\u00eb (CVE-2025-6018) n\u00eb PAM (Modulet e Autentifikimit t\u00eb Pranuesh\u00ebm), t\u00eb cil\u00ebn studiuesit nga Qualys e zbuluan gjat\u00eb analiz\u00ebs s\u00eb dob\u00ebsive n\u00eb libblockdev. Dob\u00ebsia lejon \u00e7do p\u00ebrdorues, duke p\u00ebrfshir\u00eb ata q\u00eb lidhen p\u00ebrmes SSH, t\u00eb kryejn\u00eb operacione n\u00eb kontekstin 'allow_active'. Problemi \u00ebsht\u00eb specifik p\u00ebr konfigurimet e PAM n\u00eb openSUSE Leap 15 dhe SUSE Linux Enterprise 15 dhe shfaqet vet\u00ebm n\u00eb k\u00ebto shp\u00ebrndarje. <\/p>\n

N\u00eb modulin pam_env n\u00eb openSUSE dhe SUSE, lexohet automatikisht skedari ~\/.pam_environment. P\u00ebrmes k\u00ebtij skedari, p\u00ebrdoruesi mund t\u00eb vendos\u00eb variablat e mjedisit XDG_SEAT=seat0 dhe XDG_VTNR=1, t\u00eb cilat gjat\u00eb p\u00ebrpunimit do t\u00eb perceptohen si shenj\u00eb e pranis\u00eb fizike t\u00eb p\u00ebrdoruesit, edhe pse hyrja \u00ebsht\u00eb realizuar n\u00ebp\u00ebrmjet SSH. Moduli pam_env thirret gjithashtu gjat\u00eb lidhjes p\u00ebrmes ssh n\u00eb Debian 12 dhe Ubuntu 24.04 (n\u00eb Debian 13 dhe Ubuntu 24.10+ \u00ebsht\u00eb e \u00e7aktivizuar), por vendosja e variablave t\u00eb mjedisit n\u00eb k\u00ebto shp\u00ebrndarje nuk mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb rritur nivelin e aksesit n\u00eb 'allow_active', pasi pam_env thirret n\u00eb faz\u00ebn p\u00ebrfundimtare pas ngarkimit t\u00eb modulit pam_systemd dhe variablat e vendosur t\u00eb mjedisit nuk mund t\u00eb ndikojn\u00eb n\u00eb parametrat e seanc\u00ebs. <\/p>\n

Sa i p\u00ebrket dob\u00ebsis\u00eb n\u00eb libblockdev, sulmuesi mund t\u00eb montoj\u00eb nj\u00eb imazh t\u00eb sistemit t\u00eb skedar\u00ebve t\u00eb rast\u00ebsish\u00ebm n\u00eb m\u00ebnyr\u00ebn loop, duke vendosur n\u00eb k\u00ebt\u00eb imazh nj\u00eb skedar ekzekutiv me flamurin SUID root ose nj\u00eb pajisje speciale (\/dev\/mem) p\u00ebr akses t\u00eb ul\u00ebt n\u00eb disqe ose memorie. P\u00ebr t\u00eb bllokuar sulme t\u00eb till\u00eb, imazhet e FS montohen nga sistemi me flamujt nosuid dhe nodev, por dob\u00ebsia n\u00eb libblockdev lejon montimin e imazheve pa flamujt nosuid dhe nodev. Thelbi i dob\u00ebsis\u00eb \u00ebsht\u00eb se udisks i lejon p\u00ebrdoruesit me nivelin e aksesit 'allow_active' t\u00eb ndryshojn\u00eb madh\u00ebsin\u00eb e sistemeve t\u00eb tyre t\u00eb skedar\u00ebve dhe libblockdev, gjat\u00eb k\u00ebtij procesi, p\u00ebrkoh\u00ebsisht monton FS pa vendosur flamujt nosuid dhe nodev. <\/p>\n

Pra, sulmi reduktohet n\u00eb krijimin e nj\u00eb pajisjeje loop mbi baz\u00ebn e imazhit FS XFS, n\u00eb t\u00eb cilin ndodhet nj\u00eb skedar suid root, iniciimi i operacionit t\u00eb ndryshimit t\u00eb madh\u00ebsis\u00eb s\u00eb pajisjes loop dhe ndjekja e momentit t\u00eb montimit t\u00eb saj n\u00eb katalogun \/tmp\/blockdev*: victim> killall -KILL gvfs-udisks2-volume-monitor victim> udisksctl loop-setup --file .\/xfs.image --no-user-interaction Skedari i mapuar .\/xfs.image si \/dev\/loop0. victim> nd\u00ebrsa e v\u00ebrtet\u00eb; b\u00ebj \/tmp\/blockdev*\/bash -c 'sleep 10; ls -l \/tmp\/blockdev*\/bash' && break; p\u00ebrfundoi 2>\/dev\/null & victim> gdbus call --system --dest org.freedesktop.UDisks2 --object-path \/org\/freedesktop\/UDisks2\/block_devices\/loop0 --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}' Gabim: GDBus.Error:org.freedesktop.UDisks2.Error.Failed: Gabim gjat\u00eb rregullimit t\u00eb sistemit t\u00eb skedar\u00ebve n\u00eb \/dev\/loop0: D\u00ebshtoi t\u00eb \u00e7montonte '\/dev\/loop0' pas rregullimit t\u00eb tij: objekti \u00ebsht\u00eb i z\u00ebn\u00eb -r-sr-xr-x. 1 root root 1406608 Qershor 18 09:42 \/tmp\/blockdev.RSM429\/bash victim> \/tmp\/blockdev*\/bash -p victim# id uid=65534(nobody) gid=65534(nobody) euid=0(root) grupe=65534(nobody) <\/p>\n

Deri e saj ka nj\u00eb dobi n\u00eb libblockdev q\u00eb \u00ebsht\u00eb rregulluar vet\u00ebm n\u00eb form\u00ebn e patch-eve. Gjendjen e versionit t\u00eb ri t\u00eb paket\u00ebs ose p\u00ebrgatitjen e nj\u00eb rregullimi n\u00eb distribuim mund ta kontrolloni n\u00eb faqet e m\u00ebposhtme (n\u00ebse faqja nuk \u00ebsht\u00eb e disponueshme, at\u00ebher\u00eb zhvilluesit e distribucionit ende nuk kan\u00eb filluar t\u00eb shqyrtojn\u00eb problemin): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo dhe Arch (1, 2). Si nj\u00eb m\u00ebnyr\u00eb alternative p\u00ebr t\u00eb bllokuar dob\u00ebsin\u00eb mund t\u00eb ndryshoni rregullin e qasjes ndaj operacionit \"org.freedesktop.udisks2.modify-device\" n\u00eb polkit, duke ndryshuar n\u00eb skedarin \/usr\/share\/polkit-1\/actions\/org.freedesktop.UDisks2.policy vler\u00ebn e parametrin \"allow_active\" nga \"yes\" n\u00eb \"auth_admin\". <\/p>\n

Nj\u00eb vulnerabilitet i zbuluar disa or\u00eb m\u00eb par\u00eb (CVE-2025-6020) n\u00eb paket\u00ebn linux-pam lejon nj\u00eb p\u00ebrdorues lokal t\u00eb fitoj\u00eb t\u00eb drejtat root. Moduli pam_namespace nuk verifikonte si\u00e7 duhet rrug\u00ebt e skedareve t\u00eb kontrolluara nga p\u00ebrdoruesi, gj\u00eb q\u00eb mund\u00ebsonte p\u00ebrmes manipulimeve me lidhjet simbolike dhe arritjen e nj\u00eb gjendjeje garuese t\u00eb arrihen rishkrimi i skedar\u00ebve me privilegje n\u00eb sistem. Vulnerabiliteti \u00ebsht\u00eb eliminuar n\u00eb versionin linux-pam 1.7.1. Mund t\u00eb kontrolloni statusin e versionit t\u00eb ri t\u00eb paket\u00ebs ose p\u00ebrgatitjen e nj\u00eb rregullimi n\u00eb distribucionet e m\u00ebposhtme: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo dhe Arch (1, 2).
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-6019) \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libblockdev, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u0444\u043e\u043d\u043e\u0432\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c udisks \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0420\u0430\u0431\u043e\u0442\u0430 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 Ubuntu, Debian, Fedora \u0438 openSUSE Leap 15. \u041f\u0440\u043e\u0446\u0435\u0441\u0441 udisks \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043e \u0432\u0441\u0435\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 D-Bus \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044f\u043c\u0438, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435. \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-137763","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitetet n\u00eb PAM dhe libblockdev, t\u00eb cilat lejojn\u00eb t\u00eb fitohet t\u00eb drejtat root n\u00eb sistem | ProHoster","description":"Kompania Qualys zbuloi nj\u00eb vulnerabilitet (CVE-2025-6019) n\u00eb bibliotek\u00ebn libblockdev, i cili lejon, p\u00ebrmes manipulimeve me procesin n\u00eb sfond udisks, t\u00eb fitoj\u00eb t\u00eb drejtat root n\u00eb sistem.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pam-i-libblockdev-pozvolyayushhie-poluchit-prava-root-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PAM \u0438 libblockdev, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-6019) \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libblockdev, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u0444\u043e\u043d\u043e\u0432\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c udisks \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pam-i-libblockdev-pozvolyayushhie-poluchit-prava-root-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-21T15:11:54+00:00","article:modified_time":"2025-06-21T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"137763","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:22:01","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:22:01","updated":"2026-01-23 13:22:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/137763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=137763"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/137763\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=137763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=137763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=137763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}