Ukuba sengozini okukuvumela ukuthi uphume endaweni eyodwa ye-QEMU

Kwembulwa imininingwane ebalulekile yokuba sengozini (I-CVE-2019-14378) kusibambi se-SLIRP esizenzakalelayo esisetshenziswa ku-QEMU ukuze kusungulwe isiteshi sokuxhumana phakathi kwe-adaptha yenethiwekhi ebonakalayo ohlelweni lwesihambeli kanye ne-backend yenethiwekhi ohlangothini lwe-QEMU. Udaba luphinde luthinte izinhlelo ze-virtualization ezisekelwe ku-KVM (in Imodi yomsebenzisi) kanye ne-Virtualbox, esebenzisa i-backend ye-slirp evela ku-QEMU, kanye nezinhlelo zokusebenza ezisebenzisa isitaki senethiwekhi yendawo yomsebenzisi libSLIRP (I-emulator ye-TCP/IP).

Ukuba sengozini kuvumela ikhodi ukuthi isetshenziswe ohlangothini lwesistimu yokusingatha ngamalungelo enqubo yesibambi se-QEMU lapho iphakethe lenethiwekhi elikhulu kakhulu eliklanywe ngokukhethekile lithunyelwa lisuka kusistimu yesivakashi, edinga ukuhlukaniswa. Ngenxa yephutha kumsebenzi we-ip_reass(), obizwa lapho uhlanganisa kabusha amaphakethe angenayo, isiqeshana sokuqala singase singangeni kubhafa eyabelwe futhi umsila waso uzobhalwa ezindaweni zememori eduze kwebhafa.

Okokuhlola kakade iyatholakala isibonelo esisebenzayo sokuxhaphaza, esihlinzeka ngokudlula i-ASLR nokusebenzisa ikhodi ngokubhala phezu kwememori yamalungu afanayo_loop_tlg, okuhlanganisa i-QEMTimerList enezibambi ezibizwa ngesibali sikhathi.
Ukuba sengozini sekuvele kulungisiwe Fedora ΠΈ SUSE/openSUSE, kodwa ihlala ingalungiswanga Debian, I-Arch Linux ΠΈ I-FreeBSD. I Ubuntu ΠΈ RHEL Inkinga ayibonakali ngenxa yokungasebenzisi i-slirp. Ukuba sengozini kuhlala kungalungisiwe ekukhishweni kwakamuva i-libslirp 4.0 (ukulungisa okwamanje kutholakala njenge isichibi).

Source: opennet.ru

Engeza amazwana