Munguva pfupi yapfuura nhau dzakaburitswa pamambure ekuwanikwa kwe kusagadzikana kutsva muLinux iyo yakanyorwa se "Kunyanya Kusimba" kunobata kernels dzese kubva vhezheni 5.8, pamwe chete nezvakatorwa, kusanganisira Android.
Inozivikanwa se Tsvina Pipe inobvumira kuti data inyorwe mumafaira ekuverenga chete uye inogona kutungamira mukukwidziridzwa kweropafadzo. nekupinza kodhi mu "midzi" maitiro.
Kunyangwe yakatove yakadhindwa mukati meiyo mainline Linux kernel, iyo bug inogona kugadzirwa muchimiro cheropafadzo yekuwedzera kushandiswa pamidziyo yese inoshandisa Linux kernel vhezheni 5.8 kana gare gare.
Izvi zvinoreva zvakare kuti boka rezvichangobva kuburitswa Android smartphones, senge Samsung Galaxy S22 uye Google Pixel 6, zvakare vari panjodzi, kudzamara mudziyo wega wega wagashira yakakodzera kernel chigamba kubva kune yakatarisana OEM.
Nezve Dirty Pipe
Kusagadzikana kwaive yakaratidzwa nemuongorori wezvekuchengetedza Max Kellerman uye yakanyorwa se (CVE-2022-0847), zvakatora mwedzi mishoma kuwana humbowo-hwe-pfungwa kushandiswa.
Kusagadzikana kunobvumira mushandisi asina rusarura kupinza uye kunyora pamusoro data mumafaira ekuverenga-chete, kusanganisira maitiro eSUID anomhanya semidzi. Iyo colloquial zita remadunhurirwa rinoita sekutamba pane yakashata tsikidzi Mombe Yakasviba uye Linux mechanism inodaidzwa kuti pipelining yekupindirana meseji inopfuura, sezvo iyo yekupedzisira ichishandiswa panguva yekushandiswa kwemaitiro.
Izvo zvose zvakatanga gore rakapfuura netikiti yekutsigira ine chokuita nemafaira akaora. Mutengi akachema chema kuti marogi ekudhaunirodwa haakwanise kuvhurwa. Uye zvechokwadi, pakanga paine huwori faira regi pane imwe yemaseva elogi; inogona kunge isina kudzvanywa, asi gzip yakashuma kukanganisa kweCRC. Handina kukwanisa kutsanangura kuti sei hwaive nehuwori, asi ndakafungidzira kuti kupatsanurwa kwehusiku kwakanga kwaparara ndokuburitsa faira rine huori. Ini nemaoko ndakagadzirisa CRC yefaira, ndikavhara tikiti uye nekukurumidza kukanganwa nezve dambudziko.
Mushure memwedzi yekuongorora, muongorori akazowana kuti akashatiswa mafaera evatengi aive mhedzisiro yebug muLinux kernel. Akawana nzira yekushandisa Dirty Pipe kuti abvumire chero munhu ane account, kusanganisira asina rombo rakanaka "hapana" maakaundi, kuwedzera kiyi yeSSH kumudzi wemushandisi account.
Kuti akonzere kusagadzikana, Kellerman akagovera humbowo hwepfungwa, anorwisa anofanira kunge akaverenga mvumo. Zvakare, kupuruzira hakufanirwe kunge kuri pamuganho wepeji, kunyora hakugone kuyambuka muganho wepeji, uye iyo faira haigone kudzokororwa.
Kuti ushandise njodzi iyi, unofanirwa: kugadzira pombi, kuzadza pombi nedata risingaite (nekuseta PIPE_BUF_FLAG_CAN_MERGE mureza pane zvese zvinopinda muring), bvisa pombi (kusiya mureza wakaiswa pane ese epipe_buffer chimiro muchimiro. yepiipi_inode_info mhete), batanidza iyo data kubva kune yakananga faira (yakavhurwa neO_RDONLY) mupombi nguva isati yasvika iyo yakananga kumisa, uye nyora zvekupokana data kune pombi.
Tsvina Pipe inobatawo chero vhezheni yeAroid yakavakirwa pane imwe yedziviriro shanduro dzeLinux kernel. Nekuda kwekuti Android yakakamukana, mamodhi emudziyo akabatwa haagone kuteverwa zvakafanana.
Maererano naKellerman, Google yakabatanidza kugadzirisa kwayo bug neiyo Android kernel mwedzi wapera, mushure mekunge yagadziriswa nekuburitswa kweLinux kernel shanduro 5.16.11, 5.15.25 uye 5.10.102.
Tataura izvozvo, isu tichafanira kumirira zvishoma maOEM asati atanga kuburitsa Android zvigadziriso zvine gadziriso. Google's Pixel 6, semuenzaniso, ichiri panjodzi, asi vashandisi vepamberi vanogona kudzikisira chikanganiso nekuisa tsika yakadhindwa aftermarket kernel seimwe sarudzo.
Vagadziri veLinux kernel vakaburitsa zvigadziriso (5.16.11, 5.15.25, 5.10.102) muna Kukadzi 23, nepo Google yakabata Android kernel musi wa24 Kukadzi. Kellermann nedzimwe nyanzvi dzakafananidza kusagadzikana ne CVE-2016-5195 "Mhou Yakasviba" uye vakati zviri nyore kushandisa.
Chekupedzisira, kana iwe uchifarira kuziva zvakawanda nezvazvo, unogona kutarisa ruzivo Mune inotevera chinongedzo.