Information about a vulnerability (CVE-2021-4160) in the OpenSSL cryptographic library has been revealed, caused by an error in the implementation of the summator in the BN_mod_exp function, leading to the return of incorrect results in squaring operations. The issue manifests only on hardware based on MIPS32 and MIPS64 architectures, and could compromise algorithms using elliptic curves, including those used by default in TLS 1.3. The problem has been fixed in the December updates of OpenSSL 1.1.1m and 3.0.1.
It is noted that the implementation of real attacks to retrieve information about private keys using the identified issue is considered for RSA, DSA, and the Diffie-Hellman (DH) algorithm as possible, but unlikely, making it too complicated to carry out and requiring enormous computational resources. Moreover, an attack on TLS is excluded, as in 2016, the sharing of the same DH private key among clients was prohibited when fixing the vulnerability CVE-2016-0701.
Additionally, several recently identified vulnerabilities in open projects can be noted:
- Several vulnerabilities (CVE-2022-0330) in the i915 graphics driver related to the lack of TLB reset for the GPU. If IOMMU (address translation) is not used, the vulnerability allows access from user space to random memory pages. This issue can be exploited to corrupt or read data from random memory areas. The problem occurs on all integrated and discrete Intel GPUs. The fix has been implemented by adding a mandatory TLB reset before executing each operation returning the GPU buffer to the system, which will lead to a decrease in performance. The impact on performance depends on the GPU, the operations performed on the GPU, and the system load. The fix is currently available only as a patch.
- A vulnerability (CVE-2022-22942) in the vmwgfx graphics driver, used for implementing 3D acceleration in VMware environments. The issue allows a non-privileged user to access files opened by other processes in the system. For the attack, access to the /dev/dri/card0 or /dev/dri/rendererD128 device, as well as the ability to perform an ioctl() call with the obtained file descriptor, is required.
- SÄrbarheter (CVE-2021-3996, CVE-2021-3995) i biblioteket libmount, som ingÄr i paketet util-linux, som gör det möjligt för obehöriga anvÀndare att avmontera diskar utan behörighet. Problemet upptÀcktes under en granskning av SUID-root-programmen umount och fusermount.
- SÄrbarheter i standard C-biblioteket Glibc, som pÄverkar funktionerna realpath (CVE-2021-3998) och getcwd (CVE-2021-3999).
- Problemet i realpath() beror pÄ att felaktiga vÀrden som innehÄller okontrollerade rester frÄn stacken returneras under vissa förhÄllanden. För SUID-root-programmet fusermount kan sÄrbarheten utnyttjas för att fÄ konfidentiell information frÄn processens minne, till exempel genom att fÄ Ätkomst till pekare.
- Problemet i getcwd() möjliggör en buffertöverskridning med ett byte. Problemet orsakas av en bugg som funnits sedan 1995. För att Ă„stadkomma buffertöverskridningen rĂ€cker det med att anropa chdir() för katalogen â/â i ett separat namnrymd för monteringspunkter. Det rapporteras inte om sĂ„rbarheten begrĂ€nsas till bara att leda till en krasch av processen, men i det förflutna har liknande sĂ„rbarheter resulterat i fungerande exploateringar, trots utvecklarnas skepsis.
- SĂ„rbarhet (CVE-2022-23220) i paketet usbview, som gör det möjligt för lokala anvĂ€ndare som loggar in via SSH att utföra kod med root-rĂ€ttigheter, pĂ„ grund av nĂ€rvaron av instĂ€llningen (allow_any=yes) i PolKit-reglerna för att köra usbview under anvĂ€ndaren root utan autentisering. Utnyttjandet innebĂ€r att anvĂ€nda alternativet ââgtk-moduleâ för att ladda sitt eget bibliotek i usbview. Problemet har Ă„tgĂ€rdats i version usbview 2.2.
KĂ€lla: opennet.ru
