{"id":110388,"date":"2023-10-02T10:28:03","date_gmt":"2023-10-02T08:28:03","guid":{"rendered":"https:\/\/prohoster.info\/?p=110388"},"modified":"2023-10-02T10:28:03","modified_gmt":"2023-10-02T08:28:03","slug":"uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","title":{"rendered":"S\u00e5rbarheter i Linux-k\u00e4rnan, Glibc, GStreamer, Ghostscript, BIND och CUPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Flera nyligen identifierade s\u00e5rbarheter: <\/p>\n
\n
CVE-2023-39191 \u2014 en s\u00e5rbarhet i eBPF-subsystemet som g\u00f6r det m\u00f6jligt f\u00f6r en lokal anv\u00e4ndare att h\u00f6ja sina privilegier och k\u00f6ra kod p\u00e5 k\u00e4rnniv\u00e5 i Linux. S\u00e5rbarheten orsakas av otillr\u00e4cklig verifiering av eBPF-program som tillhandah\u00e5lls av anv\u00e4ndaren f\u00f6r exekvering. F\u00f6r att genomf\u00f6ra en attack m\u00e5ste anv\u00e4ndaren ha m\u00f6jlighet att ladda upp sitt eget BPF-program (om parametern kernel.unprivileged_bpf_disabled \u00e4r inst\u00e4lld p\u00e5 0, exempelvis i Ubuntu 20.04). Information om s\u00e5rbarheten meddelades k\u00e4rnutvecklarna redan i december f\u00f6rra \u00e5ret, och en korrigering implementerades i januari utan offentlighet.\n
CVE-2023-42753 \u2014 ett fel vid hantering av arrayindex i ipset-implementeringen i netfilterk\u00e4rnens subsystem, som kan anv\u00e4ndas f\u00f6r att inkrementera\/dekrementera pekare och skapa f\u00f6rh\u00e5llanden f\u00f6r att skriva eller l\u00e4sa i minnesomr\u00e5den utanf\u00f6r den tilldelade bufferten. En prototyp f\u00f6r att testa s\u00e5rbarheten har tagits fram, vilket kan resultera i en krasch (mer farliga utnyttjandescenarier kan inte uteslutas). En korrigering har inkluderats i versionerna av k\u00e4rnan 5.4.257, 6.5.3, 6.4.16, 6.1.53, 5.10.195, 5.15.132.\n
CVE-2023-39192, CVE-2023-39193, CVE-2023-39193 \u2014 flera s\u00e5rbarheter i Linux-k\u00e4rnan som leder till l\u00e4ckage av k\u00e4rnminneinneh\u00e5ll p\u00e5 grund av m\u00f6jligheten att l\u00e4sa fr\u00e5n omr\u00e5den utanf\u00f6r den tilldelade bufferten i funktionerna match_flags och u32_match_it i Netfilter-subsystemet, samt i koden f\u00f6r tillst\u00e5ndsfiltret. S\u00e5rbarheterna \u00e5tg\u00e4rdades i augusti (1, 2) och juni.\n
CVE-2023-42755 \u2014 en s\u00e5rbarhet som till\u00e5ter en oprivilegierad lokal anv\u00e4ndare att orsaka en krasch i k\u00e4rnan p\u00e5 grund av ett fel vid hantering av pekare i trafikklassificeraren rsvp. Problemet upptr\u00e4der i LTS-k\u00e4rnor 6.1, 5.15, 5.10, 5.4, 4.19 och 4.14. En prototyp f\u00f6r exploatering har f\u00f6rberetts. Korrigeringen har \u00e4nnu inte godtagits i k\u00e4rnan och finns tillg\u00e4nglig som en patch.\n
CVE-2023-42756 \u2014 ett t\u00e4vlingsvillkor i NetFilter-k\u00e4rnans subsystem som kan anv\u00e4ndas av en lokal anv\u00e4ndare f\u00f6r att orsaka ett Panic-tillst\u00e5nd. En prototyp f\u00f6r exploatering \u00e4r tillg\u00e4nglig, som fungerar minst i k\u00e4rnorna 6.5.rc7, 6.1 och 5.10. Korrigeringen har \u00e4nnu inte godtagits i k\u00e4rnan och finns tillg\u00e4nglig som en patch.\n
CVE-2023-4527 \u2014 stack overflow in the Glibc library, occurring in the getaddrinfo function when processing a DNS response larger than 2048 bytes. The vulnerability may lead to data leakage from the stack or a crash. The vulnerability manifests only in Glibc versions newer than 2.36 when using the \"no-aaaa\" option in \/etc\/resolv.conf.\n
CVE-2023-40474, CVE-2023-40475 \u2014 vulnerabilities in the multimedia framework GStreamer, caused by integer overflow in the handlers for MXF formatted video files. The vulnerabilities may allow the attacker to execute code when processing specially crafted MXF files in applications using GStreamer. The issue has been fixed in the gst-plugins-bad 1.22.6 package.\n
CVE-2023-40476 \u2014 buffer overflow in the video handler for H.265 in GStreamer, allowing remote code execution when processing specially crafted videos. The vulnerability has been fixed in the gst-plugins-bad 1.22.6 package.\n
Analysis \u2014 breakdown of an exploit leveraging the CVE-2023-36664 vulnerability in the Ghostscript package to execute code when opening specially crafted PostScript documents. The issue is caused by improper handling of filenames starting with the \"|\" character or the %pipe% prefix. The vulnerability has been fixed in the Ghostscript 10.01.2 release.\n
CVE-2023-3341, CVE-2023-4236 \u2014 vulnerabilities in the BIND 9 DNS server, leading to a crash of the named process when handling specially formatted control messages (sufficient access to the TCP port controlling named is required \u2014 by default, only open for loopback interface, knowledge of the RNDC key is not required) or creating a certain high load in DNS-over-TLS mode. The vulnerabilities have been fixed in the BIND 9.16.44, 9.18.19, and 9.19.17 releases.\n