Nj\u00eb vulnerabilitet kritik i pest\u00eb (1, 2, 3) u zbulua n\u00eb kernelin Linux gjat\u00eb dy jav\u00ebve t\u00eb fundit, i cili lejon nj\u00eb p\u00ebrdorues t\u00eb rris\u00eb privilegjet e tij n\u00eb sistem. Jan\u00eb publikuar dy eksploit\u00eb t\u00eb funksionuar: sshkeysign_pwn lejon nj\u00eb p\u00ebrdorues pa privilegje t\u00eb lexoj\u00eb p\u00ebrmbajtjen e \u00e7el\u00ebsave t\u00eb mbyllur SSH t\u00eb hostit n\u00eb \/etc\/ssh\/ssh_host_*_key, nd\u00ebrsa chage_pwn \u2014 t\u00eb lexoj\u00eb p\u00ebrmbajtjen e skedarit \/etc\/shadow me hash-et e fjal\u00ebkalimeve t\u00eb p\u00ebrdoruesve. <\/p>\n
Informacionet mbi k\u00ebt\u00eb dob\u00ebsi nuk ishin parashikuar p\u00ebr t'u zbuluar, por nj\u00eb nga hulumtuesit e siguris\u00eb, duke u bazuar n\u00eb patchin e propozuar p\u00ebr b\u00ebrtham\u00ebn, arriti t\u00eb identifikoj\u00eb thelbin e dob\u00ebsis\u00eb q\u00eb lejon leximin e skedar\u00ebve q\u00eb jan\u00eb t\u00eb aksesuesh\u00ebm vet\u00ebm p\u00ebr p\u00ebrdoruesin root, p\u00ebr shembull, \/etc\/shadow. N\u00eb ndryshimin e shtuar n\u00eb b\u00ebrtham\u00eb, logjika e p\u00ebrdorimit t\u00eb funksionit get_dumpable() n\u00eb ptrace u korrigjua gjat\u00eb p\u00ebrcaktimit t\u00eb nivelit t\u00eb aksesit n\u00eb funksionin ptrace_may_access(). <\/p>\n
Dob\u00ebsia e drejtp\u00ebrdrejt\u00eb shkaktohet nga nj\u00eb gjendje garancie, e cila \u00e7on n\u00eb mund\u00ebsin\u00eb e aksesit pa privilegje n\u00eb nj\u00eb deskriptori skedari pidfd pas qasjes n\u00eb nj\u00eb skedar nga procesi suid root. N\u00eb momentin midis hapjes s\u00eb skedarit dhe ofrimit t\u00eb privilegjeve n\u00eb programin suid (p\u00ebr shembull, p\u00ebrmes funksionit setreuid), ndodh nj\u00eb situat\u00eb e till\u00eb, ku aplikacioni q\u00eb ekzekuton programin suid root, p\u00ebrmes deskriptori pidfd mund t\u00eb qaset n\u00eb skedarin e hapur n\u00eb programin suid, edhe n\u00ebse kjo nuk lejohet nga t\u00eb drejtat e aksesit n\u00eb skedar. <\/p>\n
Nj\u00eb dritare p\u00ebr eksploitimin lind pasi funksioni \"__ptrace_may_access()\" kalon testin e aksesit n\u00eb skedar, n\u00ebse fush\u00eb task->mm \u00ebsht\u00eb vendosur n\u00eb vler\u00ebn NULL pas ekzekutimit t\u00eb exit_mm(), por para thirrjes s\u00eb exit_files(). Momentalisht, thirrja sistemore pidfd_getfd mendon se identifikuesi i p\u00ebrdoruesit (uid) t\u00eb procesit q\u00eb th\u00ebrris, p\u00ebrputhet me identifikuesin, t\u00eb cilit i \u00ebsht\u00eb lejuar akses n\u00eb skedar. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb problemi u v\u00ebrejt p\u00ebr her\u00eb t\u00eb par\u00eb edhe n\u00eb vitin 2020, por mbeti i pa zgjidhur. <\/p>\n
N\u00eb eksploitin q\u00eb merr p\u00ebrmbajtjen e \/etc\/shadow, sulmi p\u00ebrqendrohet n\u00eb ekzekutimin ciklik p\u00ebrmes fork+execl t\u00eb aplikacionit \/usr\/bin\/chage me flamurin suid root, q\u00eb lexon p\u00ebrmbajtjen e \/etc\/shadow. Pasi procesi \u00ebsht\u00eb shp\u00ebrndar\u00eb, ekzekutohet thirrja sistemore pidfd_open dhe b\u00ebhet nj\u00eb cik\u00ebl i p\u00ebrhersh\u00ebm i p\u00ebrshkimeve t\u00eb deskriptor\u00ebve t\u00eb disponuesh\u00ebm pidfd p\u00ebrmes thirrjes sistemore pidfd_getfd dhe kontrollit t\u00eb tyre p\u00ebrmes \/proc\/self\/fd. N\u00eb eksploitin sshkeysign_pwn, manipulime t\u00eb ngjashme b\u00ebhen me programin suid root ssh-keysign. <\/p>\n
Identifikuesi CVE p\u00ebr problemin ende nuk \u00ebsht\u00eb caktuar, p\u00ebrdit\u00ebsimi i b\u00ebrtham\u00ebs dhe paketave n\u00eb shp\u00ebrndarjet nuk \u00ebsht\u00eb publikuar. N\u00eb b\u00ebrthamat e l\u00ebshuara disa or\u00eb m\u00eb par\u00eb, 7.0.7, 6.18.30 dhe 6.12.88, vulnerabiliteti nuk \u00ebsht\u00eb rregulluar. N\u00eb momentin e shkruanjes s\u00eb lajmit, mund t\u00eb p\u00ebrdoret vet\u00ebm patches. Po diskutohet p\u00ebr mund\u00ebsit\u00eb e punaround-it p\u00ebr t\u00eb bllokuar vulnerabilitetin, si\u00e7 \u00ebsht\u00eb vendosja e sysctl kernel.yama.ptrace_scope=3 ose heqja e flamurit suid root nga skedar\u00ebt ekzekutiv\u00eb n\u00eb sistem (t\u00eb pakt\u00ebn nga utilitaret ssh-keysign dhe chage, t\u00eb cilat p\u00ebrdoren n\u00eb eksploitim).