{"id":107498,"date":"2023-03-24T12:48:20","date_gmt":"2023-03-24T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=107498"},"modified":"2023-03-24T20:21:30","modified_gmt":"2023-03-24T18:21:30","slug":"uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-overlayfs-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"S\u00e5rbarhet i OverlayFS som m\u00f6jligg\u00f6r privilegieh\u00f6jning","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
I k\u00e4rnan i Linux, i implementationen av filsystemet OverlayFS, har en s\u00e5rbarhet identifierats (CVE-2023-0386) som kan anv\u00e4ndas f\u00f6r att f\u00e5 root-\u00e5tkomst p\u00e5 system d\u00e4r FUSE-subsystemet \u00e4r installerat och d\u00e4r icke-privilegierade anv\u00e4ndare f\u00e5r montera OverlayFS-partitioner (fr\u00e5n och med k\u00e4rnan Linux 5.11 med aktivering av icke-privilegierade anv\u00e4ndarnamnrymder). Problemet har \u00e5tg\u00e4rdats i k\u00e4rnversion 6.2. Publiceringen av paketuppdateringar i distributioner kan f\u00f6ljas p\u00e5 sidorna: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
Attack is carried out by copying files with setgid\/setuid flags from a partition mounted with nosuid mode to an OverlayFS partition that has a layer associated with a partition allowing the execution of suid files. The vulnerability is similar to the CVE-2021-3847 issue identified in 2021 but has lower exploitation requirements \u2014 the old issue required manipulation of xattrs, which are limited when using user namespaces, while the new problem utilizes setgid\/setuid bits that are not specifically processed in user namespaces. <\/p>\n
Angreppets algoritm: <\/p>\n
\n
Using the FUSE subsystem, a filesystem is mounted containing an executable owned by the root user with setuid\/setgid flags, accessible to all users for writing. When mounting, FUSE sets the mode to \"nosuid\".\n
Anv\u00e4ndarnamnrymder och monteringspunkter avbryts (unshare).\n
An OverlayFS is mounted, specifying a previously created FUSE filesystem as the lower layer and an upper layer based on a directory that allows writing. The upper layer's directory must be located in a filesystem that is not mounted with the \"nosuid\" flag.\n
F\u00f6r suid-filen i FUSE-partitionen \u00e4ndrar verktyget touch tidpunkten f\u00f6r modifiering, vilket leder till att den kopieras till det \u00f6vre lagret av OverlayFS.\n
Vid kopieringen tar k\u00e4rnan inte bort setgid\/setuid-flaggorna, vilket leder till att filen visar sig i en partition som till\u00e5ter hantering av setgid\/setuid.\n
F\u00f6r att f\u00e5 root-r\u00e4ttigheter r\u00e4cker det med att k\u00f6ra filen med setgid\/setuid-flaggor fr\u00e5n katalogen ansluten till det \u00f6vre lagret av OverlayFS. <\/ul>\n
Det kan ocks\u00e5 noteras att forskare fr\u00e5n Google Project Zero har avsl\u00f6jat information om tre s\u00e5rbarheter som \u00e5tg\u00e4rdades i huvudversionen av Linux-k\u00e4rnan 5.15, men som inte har \u00f6verf\u00f6rts till paketen med k\u00e4rnan fr\u00e5n RHEL 8.x\/9.x och CentOS Stream 9. <\/p>\n
\n
CVE-2023-1252 \u2014 access to already freed memory in the ovl_aio_req structure when multiple operations are performed simultaneously in OverlayFS deployed on top of an Ext4 filesystem. This vulnerability potentially allows for privilege escalation within the system.\n
CVE-2023-0590 \u2014 access to already freed memory in the qdisc_graft() function. It is assumed that exploitation is limited to crashes.\n
CVE-2023-1249 \u2014 access to already freed memory in the coredump writing code, occurring due to a missed mmap_lock call in file_files_note. It is assumed that exploitation is limited to crashes. <\/ul>\n