Ukuba sengozini ku-Linux kernel engabangela ukuphahlazeka ngokuthumela iphakethe le-UDP

Ku-Linux kernel ikhonjiwe ubungozi (I-CVE-2019-11683), okukuvumela ukuthi ubangele ukude ukunqatshelwa kwesevisi ngokuthumela amaphakethe e-UDP aklanywe ngokukhethekile (iphakethe lokufa). Inkinga ibangelwa iphutha kusibambi se-udp_gro_receive_segment (net/ipv4/udp_offload.c) ngokusetshenziswa kobuchwepheshe be-GRO (Generic Receive Offload) futhi kungaholela ekonakaleni kokuqukethwe kwezindawo zememori ye-kernel lapho kucutshungulwa amaphakethe e-UDP anoziro padding. (umthwalo ongenalutho).

Inkinga ithinta i-kernel kuphela 5.0njengoba ukusekelwa kwe-GRO kwamasokhethi e-UDP kwaba kwenziwe ngoNovemba ngonyaka odlule futhi wakwazi ukungena ekukhululweni kwakamuva okuzinzile kwe-kernel. Ubuchwepheshe be-GRO bukuvumela ukuthi usheshise ukucutshungulwa kwenani elikhulu lamaphakethe angenayo ngokuhlanganisa amaphakethe amaningi abe amabhulokhi amakhulu angadingi ukucutshungulwa okuhlukene kwephakethe ngalinye.
Ku-TCP, inkinga ayenzeki, njengoba le phrothokholi ayisekeli ukuhlanganisa iphakethe ngaphandle kokulayisha.

Ukuba sengozini kuze kube manje kulungisiwe kuphela efomini isichibi, isibuyekezo sokulungisa asikakashicilelwa (isibuyekezo sayizolo 5.0.11 silungise akufakiwe). Kusukela kumakhithi okusabalalisa, i-kernel 5.0 ikwazile ukufakwa kuyo I-Fedora 30, Ubuntu 19.04, I-Arch Linux, I-Gentoo nokunye ukusatshalaliswa okuqhubekayo okubuyekeziwe. Debian, Ubuntu 18.10 nangaphambilini, I-RHEL/CentOS и SUSE/openSUSE inkinga ayithinti.

Inkinga itholwe ngenxa yalokho ukusetshenziswa kwe Isistimu yokuhlola i-fuzzing ezenzakalelayo edalwe i-Google syzbot kanye ne-analyzer KASAN (KernelAddressSanitizer), okuhloswe ngayo ukuhlonza amaphutha lapho usebenza ngenkumbulo namaqiniso okufinyelela inkumbulo okungalungile, njengokufinyelela izindawo zenkumbulo ezikhululekile nokubeka amakhodi ezindaweni zememori ezingahloselwe ukukhohlisa okunjalo.

Source: opennet.ru

Engeza amazwana