{"id":103125,"date":"2022-01-29T15:37:09","date_gmt":"2022-01-29T13:37:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx"},"modified":"2022-01-29T15:37:09","modified_gmt":"2022-01-29T13:37:09","slug":"uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-openssl-glibc-util-linux-drajverah-i915-i-vmwgfx","title":{"rendered":"S\u00e5rbarheter i OpenSSL, Glibc, util-linux, drivrutiner f\u00f6r i915 och vmwgfx","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information about a vulnerability (CVE-2021-4160) in the OpenSSL cryptographic library has been revealed, caused by an error in the implementation of the summator in the BN_mod_exp function, leading to the return of incorrect results in squaring operations. The issue manifests only on hardware based on MIPS32 and MIPS64 architectures, and could compromise algorithms using elliptic curves, including those used by default in TLS 1.3. The problem has been fixed in the December updates of OpenSSL 1.1.1m and 3.0.1. <\/p>\n
Det noteras att genomf\u00f6randet av verkliga attacker f\u00f6r att f\u00e5 tillg\u00e5ng till privata nycklar med hj\u00e4lp av det identifierade problemet \u00f6verv\u00e4gs f\u00f6r RSA, DSA och Diffie-Hellman-algoritmen (DH, Diffie-Hellman) som m\u00f6jligt, men osannolikt, eftersom det \u00e4r f\u00f6r komplicerat att genomf\u00f6ra och kr\u00e4ver enorma ber\u00e4kningsresurser. En attack mot TLS utesluts, eftersom delning av en enda DH-privat nyckel bland klienter f\u00f6rbj\u00f6ds 2016 vid \u00e5tg\u00e4rden av s\u00e5rbarheten CVE-2016-0701. <\/p>\n
Additionally, several recently identified vulnerabilities in open projects can be noted: <\/p>\n
\n
Several vulnerabilities (CVE-2022-0330) in the i915 graphics driver related to the lack of TLB reset for the GPU. If IOMMU (address translation) is not used, the vulnerability allows access from user space to random memory pages. This issue can be exploited to corrupt or read data from random memory areas. The problem occurs on all integrated and discrete Intel GPUs. The fix has been implemented by adding a mandatory TLB reset before executing each operation returning the GPU buffer to the system, which will lead to a decrease in performance. The impact on performance depends on the GPU, the operations performed on the GPU, and the system load. The fix is currently available only as a patch.\n
A vulnerability (CVE-2022-22942) in the vmwgfx graphics driver, used for implementing 3D acceleration in VMware environments. The issue allows a non-privileged user to access files opened by other processes in the system. For the attack, access to the \/dev\/dri\/card0 or \/dev\/dri\/rendererD128 device, as well as the ability to perform an ioctl() call with the obtained file descriptor, is required.\n
S\u00e5rbarheter (CVE-2021-3996, CVE-2021-3995) i biblioteket libmount, som ing\u00e5r i paketet util-linux, som g\u00f6r det m\u00f6jligt f\u00f6r obeh\u00f6riga anv\u00e4ndare att avmontera diskar utan beh\u00f6righet. Problemet uppt\u00e4cktes under en granskning av SUID-root-programmen umount och fusermount.\n
S\u00e5rbarheter i standard C-biblioteket Glibc, som p\u00e5verkar funktionerna realpath (CVE-2021-3998) och getcwd (CVE-2021-3999).\n
\n
Problemet i realpath() beror p\u00e5 att felaktiga v\u00e4rden som inneh\u00e5ller okontrollerade rester fr\u00e5n stacken returneras under vissa f\u00f6rh\u00e5llanden. F\u00f6r SUID-root-programmet fusermount kan s\u00e5rbarheten utnyttjas f\u00f6r att f\u00e5 konfidentiell information fr\u00e5n processens minne, till exempel genom att f\u00e5 \u00e5tkomst till pekare.\n
Problemet i getcwd() m\u00f6jligg\u00f6r en buffert\u00f6verskridning med en byte. Problemet orsakas av ett fel som har funnits sedan 1995. F\u00f6r att utl\u00f6sa \u00f6verskridningen r\u00e4cker det med att g\u00f6ra ett anrop till chdir() f\u00f6r katalogen \"\/\" i ett separat namnrymd f\u00f6r monteringspunkter. Det rapporteras inte om s\u00e5rbarheten \u00e4r begr\u00e4nsad till bara en krasch, men tidigare har det funnits fall av fungerande utnyttjanden f\u00f6r liknande s\u00e5rbarheter, trots utvecklarnas skepticism. <\/ul>\n
S\u00e5rbarheten (CVE-2022-23220) i paketet usbview g\u00f6r det m\u00f6jligt f\u00f6r lokala anv\u00e4ndare som loggar in via SSH att k\u00f6ra kod med root-beh\u00f6righet p\u00e5 grund av inst\u00e4llningen (allow_any=yes) i PolKit-reglerna f\u00f6r att k\u00f6ra usbview-verktyget som root utan autentisering. Utnyttjandet g\u00e5r ut p\u00e5 att anv\u00e4nda alternativet \"--gtk-module\" f\u00f6r att ladda sin bibliotek i usbview. Problemet har \u00e5tg\u00e4rdats i version 2.2 av usbview. <\/ul>\n