N\u00eb b\u00ebrthamalla e Linux-it \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet kritik i pest\u00eb (1, 2, 3) n\u00eb dy jav\u00ebt e fundit, i cili lejon nj\u00eb p\u00ebrdorues t\u00eb rris\u00eb privilegjet e tij n\u00eb sistem. Jan\u00eb publikuar dy eksploitate funksionale: sshkeysign_pwn ofron mund\u00ebsin\u00eb q\u00eb nj\u00eb p\u00ebrdorues pa privilegje t\u00eb lexoj\u00eb p\u00ebrmbajtjen e \u00e7el\u00ebsave privat\u00eb SSH t\u00eb hostit \/etc\/ssh\/ssh_host_*_key, nd\u00ebrsa chage_pwn \u2014 t\u00eb lexoj\u00eb p\u00ebrmbajtjen e skedarit \/etc\/shadow me hash-et e fjal\u00ebkalimeve t\u00eb p\u00ebrdoruesve. <\/p>\n
T\u00eb dh\u00ebnat mbi vulnerabilitetin nuk ishin planifikuar p\u00ebr t'u zbuluar, por nj\u00eb nga k\u00ebrkuesit e siguris\u00eb, n\u00eb baz\u00eb t\u00eb patch-it t\u00eb propozuar p\u00ebr kernelin, ishte n\u00eb gjendje t\u00eb p\u00ebrcaktonte natyr\u00ebn e vulnerabilitetit q\u00eb lejon leximin e skedar\u00ebve, q\u00eb jan\u00eb t\u00eb disponuesh\u00ebm vet\u00ebm p\u00ebr p\u00ebrdoruesin root, si p.sh. \/etc\/shadow. N\u00eb ndryshimin e shtuar n\u00eb kernel u korrigjua logjika e p\u00ebrdorimit t\u00eb funksionit get_dumpable() n\u00eb ptrace kur p\u00ebrcaktohej niveli i aksesit n\u00eb funksionin ptrace_may_access(). <\/p>\n
Vulnerabiliteti \u00ebsht\u00eb shkaktuar nga nj\u00eb gjendje garuese, e cila lejon mund\u00ebsin\u00eb e qasjes jo privilegjuar n\u00eb file descriptor pidfd pasi t\u00eb jet\u00eb k\u00ebrkuar nj\u00eb skedar nga procesi i suid root. N\u00eb momentin midis hapjes s\u00eb skedarit dhe heqjes s\u00eb privilegjeve n\u00eb programin suid (p.sh., p\u00ebrmes funksionit setreuid), ndodh nj\u00eb situat\u00eb kur aplikacioni q\u00eb ka nisur programin suid root, p\u00ebrmes descriptorit pidfd, mund t\u00eb qaset n\u00eb nj\u00eb skedar t\u00eb hapur n\u00eb programin suid, edhe n\u00ebse kjo nuk lejohet nga t\u00eb drejtat e aksesit n\u00eb skedar. <\/p>\n
Finestra p\u00ebr shfryt\u00ebzim lind p\u00ebr shkak se funksioni \u00ab__ptrace_may_access()\u00bb kalon kontrollin e mund\u00ebsis\u00eb s\u00eb aksesit n\u00eb skedar, n\u00ebse fusha task->mm \u00ebsht\u00eb caktuar n\u00eb vler\u00ebn NULL pas ekzekutimit t\u00eb exit_mm(), por para thirrjes exit_files(). N\u00eb k\u00ebt\u00eb moment, thirrja sistemore pidfd_getfd mendon se identifikuesi i p\u00ebrdoruesit (uid) t\u00eb procesit thirr\u00ebs korrespondon me identifikuesin, t\u00eb cilit i \u00ebsht\u00eb lejuar aksesin n\u00eb skedar. Vlen t\u00eb p\u00ebrmendet se problemi \u00ebsht\u00eb p\u00ebrmendur m\u00eb par\u00eb edhe n\u00eb vitin 2020, por ka mbetur i pazgjidhur. <\/p>\n
N\u00eb shfryt\u00ebzim, q\u00eb merr p\u00ebrmbajtjen e \/etc\/shadow, sulmi konsiston n\u00eb ekzekutimin ciklik p\u00ebrmes fork+execl t\u00eb aplikacionit \/usr\/bin\/chage me flamurin suid root, i cili lexon p\u00ebrmbajtjen e \/etc\/shadow. Pasi procesi \u00ebsht\u00eb krijuar, b\u00ebhet thirrje n\u00eb sistem p\u00ebr pidfd_open dhe realizohet nj\u00eb cik\u00ebl p\u00ebr t\u00eb p\u00ebrshkuar t\u00eb gjitha pidfd-deskriptor\u00ebt e disponuesh\u00ebm p\u00ebrmes thirrjes n\u00eb sistem pidfd_getfd dhe kontrolli i tyre p\u00ebrmes \/proc\/self\/fd. N\u00eb shfryt\u00ebzim, sshkeysign_pwn, manipulime t\u00eb ngjashme kryhen me programin suid root ssh-keysign. <\/p>\n
Identifikuesi CVE p\u00ebr problemin ende nuk \u00ebsht\u00eb ndar\u00eb, azhurnimi i b\u00ebrtham\u00ebs dhe paketa n\u00eb shp\u00ebrndarje nuk jan\u00eb publikuar. N\u00eb b\u00ebrthamat e l\u00ebshuara disa or\u00eb m\u00eb par\u00eb 7.0.7, 6.18.30 dhe 6.12.88, vulnerabiliteti nuk \u00ebsht\u00eb rregulluar. N\u00eb momentin e shkruar, mund t\u00eb p\u00ebrdoren vet\u00ebm patches. Po diskutohet p\u00ebr mund\u00ebsit\u00eb e rrethkalimit t\u00eb bllokimit t\u00eb vulnerabilitetit, si\u00e7 \u00ebsht\u00eb caktimi i sysctl kernel.yama.ptrace_scope=3 ose heqja e flamurit suid root nga skedar\u00ebt ekzekutues n\u00eb sistem (t\u00eb pakt\u00ebn nga mjetet ssh-keysign dhe chage, t\u00eb cilat p\u00ebrdoren n\u00eb shfryt\u00ebzime).