{"id":99421,"date":"2021-03-13T22:22:39","date_gmt":"2021-03-13T20:22:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii"},"modified":"2021-03-13T22:22:39","modified_gmt":"2021-03-13T20:22:40","slug":"uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-podsisteme-iscsi-yadra-linux-pozvolyayushhaya-podnyat-svoi-privilegii","title":{"rendered":"Cenueshm\u00ebri n\u00eb n\u00ebn-sistemin iSCSI t\u00eb kernelit Linux q\u00eb lejon rritjen e privilegjeve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb kodin e n\u00ebn-sistemit iSCSI t\u00eb kernelit Linux \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri (CVE-2021-27365) q\u00eb i lejon nj\u00eb p\u00ebrdoruesi lokal pa privilegje t\u00eb ekzekutoj\u00eb kod n\u00eb nivelin e kernelit dhe t\u00eb marr\u00eb privilegje root n\u00eb sistem. P\u00ebr testim \u00ebsht\u00eb i disponuesh\u00ebm nj\u00eb prototip funksional i exploit-it. Cenueshm\u00ebria \u00ebsht\u00eb korrigjuar n\u00eb p\u00ebrdit\u00ebsimet e kernelit Linux 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260 dhe 4.4.260. P\u00ebrdit\u00ebsimet e paketave t\u00eb kernelit jan\u00eb t\u00eb disponueshme n\u00eb shp\u00ebrndarjet Debian, Ubuntu, SUSE\/openSUSE, Arch Linux dhe Fedora. P\u00ebr RHEL, korrigjimet ende nuk jan\u00eb publikuar. <\/p>\n
Problemi shkaktohet nga nj\u00eb gabim n\u00eb funksionin iscsi_host_get_param() t\u00eb modulit libiscsi, i futur q\u00eb n\u00eb vitin 2006 gjat\u00eb zhvillimit t\u00eb n\u00ebn-sistemit iSCSI. P\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kontrolleve t\u00eb duhura t\u00eb madh\u00ebsis\u00eb, disa atribute tekstuale t\u00eb iSCSI, si hostname ose username, mund t\u00eb tejkalojn\u00eb vler\u00ebn PAGE_SIZE (4 KB). Cenueshm\u00ebria mund t\u00eb shfryt\u00ebzohet p\u00ebrmes d\u00ebrgimit nga nj\u00eb p\u00ebrdorues pa privilegje t\u00eb mesazheve Netlink q\u00eb vendosin atributet iSCSI n\u00eb vlera m\u00eb t\u00eb m\u00ebdha se PAGE_SIZE. Gjat\u00eb leximit t\u00eb k\u00ebtyre atributeve p\u00ebrmes sysfs ose seqfs, thirret kodi q\u00eb i kalon atributet te funksioni sprintf p\u00ebr t\u2019i kopjuar n\u00eb nj\u00eb buffer, madh\u00ebsia e t\u00eb cilit \u00ebsht\u00eb e barabart\u00eb me PAGE_SIZE. <\/p>\n
Shfryt\u00ebzimi i cenueshm\u00ebris\u00eb n\u00eb shp\u00ebrndarje varet nga mb\u00ebshtetja p\u00ebr ngarkimin automatik t\u00eb modulit t\u00eb kernelit scsi_transport_iscsi gjat\u00eb p\u00ebrpjekjes p\u00ebr t\u00eb krijuar nj\u00eb socket NETLINK_ISCSI. N\u00eb shp\u00ebrndarjet ku ky modul ngarkohet automatikisht, sulmi mund t\u00eb kryhet pavar\u00ebsisht n\u00ebse funksionaliteti i iSCSI p\u00ebrdoret apo jo. Megjithat\u00eb, p\u00ebr zbatimin e suksessh\u00ebm t\u00eb exploit-it k\u00ebrkohet gjithashtu regjistrimi i t\u00eb pakt\u00ebn nj\u00eb transporti iSCSI. Nga ana tjet\u00ebr, p\u00ebr regjistrimin e transportit mund t\u00eb p\u00ebrdoret moduli i kernelit ib_iser, i cili ngarkohet automatikisht kur nj\u00eb p\u00ebrdorues pa privilegje p\u00ebrpiqet t\u00eb krijoj\u00eb nj\u00eb socket NETLINK_RDMA. <\/p>\n
Ngarkimi automatik i moduleve t\u00eb nevojshme p\u00ebr shfryt\u00ebzimin e exploit-it mb\u00ebshtetet n\u00eb CentOS 8, RHEL 8 dhe Fedora kur n\u00eb sistem \u00ebsht\u00eb i instaluar paketa rdma-core, e cila \u00ebsht\u00eb var\u00ebsi p\u00ebr disa paketa t\u00eb njohura dhe instalohet si parazgjedhje n\u00eb konfigurimet p\u00ebr stacione pune, sisteme serverike me GUI dhe mjedise virtualizimi p\u00ebr host. Nd\u00ebrkoh\u00eb, rdma-core nuk instalohet kur p\u00ebrdoret nd\u00ebrtimi serverik q\u00eb punon vet\u00ebm n\u00eb modalitet konsol\u00eb, si edhe gjat\u00eb instalimit nga imazhi minimal. P\u00ebr shembull, paketa p\u00ebrfshihet n\u00eb shp\u00ebrndarjen baz\u00eb t\u00eb Fedora 31 Workstation, por nuk p\u00ebrfshihet n\u00eb Fedora 31 Server. Debian dhe Ubuntu jan\u00eb m\u00eb pak t\u00eb prekshme nga ky problem, sepse paketa rdma-core ngarkon modulet e kernelit t\u00eb nevojshme p\u00ebr sulmin vet\u00ebm n\u00ebse \u00ebsht\u00eb i pranish\u00ebm pajisja RDMA.
<\/center> <\/p>\n
Si ka nj\u00eb m\u00ebnyr\u00eb alternative mbrojtjeje, mund t\u00eb ndaloni ngarkimin automatik t\u00eb modulit libiscsi: echo \u00abinstall libiscsi \/bin\/true\u00bb >> \/etc\/modprobe.d\/disable-libiscsi.conf <\/p>\n
P\u00ebrve\u00e7 k\u00ebsaj, n\u00eb n\u00ebn-sistemin iSCSI jan\u00eb eliminuar dy dob\u00ebsi m\u00eb pak t\u00eb rrezikshme, t\u00eb cilat mund t\u00eb \u00e7ojn\u00eb n\u00eb rrjedhje t\u00eb t\u00eb dh\u00ebnave nga b\u00ebrthama: CVE-2021-27363 (rrjedhje informacioni mbi descriptorin e transportit iSCSI p\u00ebrmes sysfs) dhe CVE-2021-27364 (leximi nga nj\u00eb zon\u00eb jasht\u00eb kufijve t\u00eb buffer-it). Dob\u00ebsit\u00eb e p\u00ebrmendura mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb nd\u00ebrvepruar p\u00ebrmes nj\u00eb socket-i netlink me n\u00ebn-sistemin iSCSI pa pasur privilegjet e nevojshme. P\u00ebr shembull, nj\u00eb p\u00ebrdorues pa privilegje mund t\u00eb lidh\u00eb me iSCSI dhe t\u00eb d\u00ebrgoj\u00eb komand\u00ebn \u00abend a session\u00bb p\u00ebr t\u00eb nd\u00ebrprer\u00eb seancen. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Cenueshm\u00ebri](\"\/wp-content\/uploads\/2021\/03\/3976683ce11a1f5745c19369237c975c.png\")
<\/center> <\/p>\n