almalinux

Proof of Concept Background: Cos’è libblkid? libblkid è la libreria di probing per partizioni e filesystem al cuore dello stack storage di Linux. È il componente che risponde alla domanda “cosa c’è su questo block device?” — e viene invocata ovunque: inserimento USB → udev → udisks2 → libblkid → “ha una partizione ext4” ↓ automount / mkfs / fsck Ogni volta che Linux processa un nuovo disco — dall’inserimento di una chiavetta USB all’analisi di un’immagine disco di una VM — libblkid legge le tabelle delle partizioni e registra ciò che trova. La vulnerabilità risiede nel parser degli Extended Boot Record (EBR), utilizzato per gli schemi di partizione MBR con più di 4 partizioni. Il Codice Vulnerabile libblkid/src/partitions/dos.c, funzione parse_dos_extended(). Questa funzione viene chiamata per ogni partizione estesa in un layout MBR, percorrendo la catena di EBR che descrivono le partizioni logiche (partizioni 5+). static int parse_dos_extended(blkid_probe pr, blkid_parttable tab, uint32_t ex_start, uint32_t ex_size, uint32_t cur_start, uint32_t cur_size){ /* ... */ for (p = p0, i = 0; i = 2) { /* (3) guard SOLO per i≥2 */ if (start + size > cur_size) continue; if (abs_start ex_start + ex_size) continue; } if (blkid_partlist_get_partition_by_start(ls, abs_start)) continue; par = blkid_partlist_add_partition(ls, tab, abs_start, size); /* SINK */ Tre osservazioni dalla lettura del codice: 1: dos_partition_get_start(p) legge un valore little-endian a 32 bit direttamente dal buffer del disco — completamente controllato dall’attaccante. 2: abs_start = cur_start + start è un’addizione uint32_t non verificata. In C, l’aritmetica su interi senza segno è modulo 2³², quindi se la somma supera 0xFFFFFFFF si azzera silenziosamente — nessuna eccezione, nessun warning, nessun UB. 3: Il blocco if (i >= 2) contiene i bounds check che avrebbero intercettato questo problema — ma si applicano solo alla terza e quarta entry dell’EBR. Le prime due entry (la partizione dati e il puntatore al prossimo EBR) vengono elaborate senza alcun controllo. La Matematica Impostando cur_start = 2 (il settore EBR, un valore legittimo comune) e artefando la prima entry dell’EBR con lba_start = 0xFFFFFFFE: abs_start = (uint32_t)(cur_start + start) = (uint32_t)(2 + 0xFFFFFFFE) = (uint32_t)(0x100000000) ← supera il range uint32 = 0x00000000 ← wrap al settore 0 dell'MBR Il valore 0x00000000 viene passato a blkid_partlist_add_partition() come inizio della partizione. libblkid ora ritiene che esista una partizione da 128 KB che inizia al primo settore del disco — l’MBR. Costruzione dell’Immagine Artefatta L’immagine disco artefatta è un file da 4 KB. L’MBR all’offset 0 contiene una entry di partizione estesa standard che punta al settore 2. L’EBR al settore 2 contiene una entry di partizione con lba_start = 0xFFFFFFFE e lba_size = 0x100. import struct, sysdef write_le32(val): return struct.pack(' UINT32_MAX - cur_start) { DBG(LOWPROBE, ul_debug("#%d: EBR start overflow -- ignore", i + 1)); continue;} Il maintainer upstream Karel Zak ha accettato la segnalazione ma ha implementato un fix significativamente più robusto che affronta la causa radice in modo più completo. La sua analisi ha correttamente identificato che il problema non era soltanto l’overflow aritmetico, ma l’assenza totale di una validazione corretta dei bounds per le entry EBR — il codice era debole nel non garantire che i dati EBR rimanessero all’interno dell’area della partizione estesa master. Il fix upstream (firmato da Karel Zak, Reported-by: Michele Piccinni) affronta tre problemi distinti: Fix 1 — Aritmetica a 64 bit elimina il wraparound alla radice Invece di un guard preventivo, l’addizione viene promossa a uint64_t, rendendo fisicamente impossibile l’overflow: uint64_t ex_end = (uint64_t) ex_start + ex_size; /* nuovo: boundary area */...uint64_t abs = (uint64_t) cur_start + start; /* nuovo: addizione 64-bit */abs_start = (uint32_t) abs; /* cast sicuro dopo validazione */(uint64_t)(2 + 0xFFFFFFFE) = 0x100000000 — nessun wraparound. Il valore viene poi validato prima di essere troncato di nuovo a uint32_t. Fix 2 — Bounds check unificato per TUTTE le entry EBR Il codice originale applicava i bounds check solo per gli indici di loop i >= 2. Le entry i=0 e i=1 venivano elaborate senza alcuna validazione. Il fix applica un unico bounds check a tutte e quattro le entry in modo uniforme: /* la partizione dati deve essere all'interno dell'area estesa — per TUTTI i */if (abs ex_end) { DBG(LOWPROBE, ul_debug("#%d: EBR data partition outside " "extended -- ignore", i + 1)); continue;} Questa è la soluzione architetturalmente corretta: qualsiasi partizione dati EBR, per definizione, deve risiedere all’interno dei confini della partizione estesa master. La precedente distinzione i >= 2 era logicamente ingiustificata. Fix 3 — Validazione della chain EBR Il fix rafforza anche l’attraversamento della chain EBR (il processamento del puntatore al prossimo EBR), impedendo link all’indietro e navigazione fuori dai limiti: uint64_t next = (uint64_t) ex_start + start;if (next + size > ex_end) { DBG(LOWPROBE, ul_debug("EBR link outside extended area -- leave")); goto leave;}if (next ex_end) {+ DBG(LOWPROBE, ul_debug("#%d: EBR data partition outside "+ "extended -- ignore", i + 1));+ continue;+ }+ abs_start = (uint32_t) abs;+ if (i >= 2) { if (start + size > cur_size) continue;- if (abs_start ex_start + ex_size)- continue; }@@ -142,8 +150,22 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab, if (i == 4) goto leave;- cur_start = ex_start + start;- cur_size = size;+ {+ uint64_t next = (uint64_t) ex_start + start;++ if (next + size > ex_end) {+ DBG(LOWPROBE, ul_debug("EBR link outside "+ "extended area -- leave"));+ goto leave;+ }+ if (next = 2 esiste come ulteriore sanity check per i casi anomali; non era mai stato pensato come confine di sicurezza per le prime due entry. Una Vulnerabilità Presente da 17 Anni Uno degli aspetti più significativi di questo finding è la sua longevità. Il file dos.c che contiene parse_dos_extended() reca nel copyright header: Copyright (C) 2009 Karel Zak Il codice vulnerabile — l’addizione uint32_t senza overflow guard alla riga 96 — è presente sin dalla prima scrittura del file nel 2009, quando Karel Zak estese libblkid per supportare il probing delle tabelle delle partizioni in util-linux-ng 2.17. La vulnerabilità è sopravvissuta intatta per 17 anni attraverso decine di release, centinaia di commit e un’intera generazione di aggiornamenti di distribuzione. Nel 2016, CVE-2016-5011 aveva già portato attenzione proprio su parse_dos_extended(), identificando un bug di loop infinito nella stessa funzione. Quel fix ha aggiunto un check per i duplicati (riga 112), ma non ha toccato il codice di addizione aritmetica a riga 96. Due bug distinti, stessa funzione, a 7 anni di distanza. Perché è sopravvissuta così a lungo? La risposta è nella natura stessa del bug: l’overflow uint32_t è comportamento definito in C (standard ISO/IEC 9899:2018 §6.2.5). Non è undefined behaviour, non è un errore di compilazione, non è un warning con -Wall o -fanalyzer. Il codice è sintatticamente corretto, semanticamente sbagliato. Solo un checker taint-aware come Coverity o Clang alpha.security.taint — strumenti non tipicamente integrati nelle CI pipeline dei progetti open source — riesce a tracciare il percorso da un byte letto dal disco fino al suo utilizzo come indice critico senza sanitizzazione. Questa combinazione, vecchio codice, bug definito ma semanticamente errato, assenza di strumenti taint-aware nella CI, è esattamente il profilo delle vulnerabilità che rimangono nascoste per decenni in componenti critici di infrastruttura.

SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 (CVSS score: 9.8) - A code injection vulnerability in SAP Quotation Management Insurance application (FS-QUO) CVE-2026-27685 (CVSS score: 9.1) - An insecure deserialization vulnerability in SAP NetWeaver Enterprise Portal Administration "The application uses an outdated artifact of Apache Log4j 1.2.17 that is vulnerable to CVE-2019-17571," SAP security company Onapsis said. "It allows an unprivileged attacker to execute arbitrary code remotely on the server, causing high impact on confidentiality, integrity, and availability of the application." CVE-2026-27685, on the other hand, stems from missing or insufficient validation during the deserialization of uploaded content, which could allow an attacker to upload untrusted or malicious content. "Only the fact that an attacker requires high privileges for a successful exploit prevents the vulnerability from being tagged with a CVSS score of 10," Onapsis added. The disclosure comes as Microsoft shipped patches for 84 vulnerabilities across products, including dozens of privilege escalation and remote code execution flaws. On Tuesday, Adobe also announced patches for 80 vulnerabilities, four of which are critical flaws impacting Adobe Commerce and Magento Open Source that could result in privilege escalation and security feature bypass. Separately, it fixed five critical vulnerabilities in Adobe Illustrator that could pave the way for arbitrary code execution. Elsewhere, Hewlett Packard Enterprise put out fixes for five shortcomings in Aruba Networking AOS-CX. The most severe of the flaws is CVE-2026-23813 (CVSS score: 9.8), an authentication bypass affecting the management interface. "A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls," HPE said. "In some cases, this could enable resetting the admin password." "Exploitation of this Aruba vulnerability potentially gives attackers full control of AOS-CX network devices and the ability to compromise an entire system undetected," Ross Filipek, CISO at Corsica Technologies, said in a statement. "A successful compromise could lead to the disruption of network communications or the erosion of the integrity of key business services. This flaw is a reminder that vulnerabilities in network devices are becoming more common in today's hyper-connected world. When attackers gain privileged access to these devices, it puts organizations at significant risk." Software Patches from Other Vendors Security updates have also been released by other vendors over the past few weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD Arm Atlassian Bosch Broadcom (including VMware) Canon Cisco Commvault Dassault Systèmes Dell Devolutions Drupal Elastic F5 Fortinet Fortra Foxit Software GitLab Google Android and Pixel Google Chrome Google Cloud Google Pixel Watch Google Wear OS Grafana Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird n8n NVIDIA Palo Alto Networks QNAP Qualcomm Ricoh Samsung Schneider Electric ServiceNow Siemens SolarWinds Splunk Synology TP-Link Trend Micro WatchGuard Western Digital Zoom, and Zyxel

Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703) On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, and CVE-2025-48703, a vulnerability in Control Web Panel (CWP), a web hosting control panel designed for managing servers running CentOS or CentOS-based distributions. While active exploitation of CVE-2025-11371 has been reported on since early October 2025, exploitation attempts involving CVE-2025-48703, though detected by cybersecurity professionals, have so far been less widespread (or observed). What is Control Web Panel (CWP)? CWP is server management software that runs on CentOS (whos development was discontinued in late 2020) and its community-driven successors, Rocky Linux and AlmaLinux. CWP users can opt for the free version what offers core features for single-server management, and a (paid) Pro version with better security, automatic updates, and improved support. The software is popular with virtual private server (VPS) and dedicated server operators and is used to manage services like web servers, databases, email servers, DNS, as well as security features. About CVE-2025-48703 CVE-2025-48703 is a critical OS Command Injection flaw that “allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request.” The vulnerability’s current CVSS string indicates that it’s exploitable remotely over a network, without prior authentication or user interaction, but also that it’s not trivially exploitable. Maxime Rinaudo, co-founder of penetration testing firm Fenrisk, explained that attackers must know or guess a valid non-root username to bypass authentication requirements before exploiting CVE-2025-48703. The bad news is that such usernames are often predictable. CVE-2025-48703 is triggered by sending a HTTPS request with a specially crafted t_total value to the user file manager endpoint (filemanager&acc=changePerm), and allows attackers to run commands as that local user. Thus, an attacker can drop web shells, create persistence, pivot, or escalate further depending on local misconfigurations. What to do? With Rinaudo’s technical write-up and PoC published in late June 2025 and other PoC exploits appearing on GitHub since, it was only a matter of time until attackers began attempting to exploit the flaw. In July 2025, FindSec researchers noted that “exploits are being actively developed and shared in hacking forums,” and advised organization runing CWP to manage Linux-based web hosting environments to patch quickly. According to Shodan, there are currently over 220,000 internet-facing CWP instances, though it remains unclear how many are still running a vulnerable version. CVE-2025-48703 affects CWP versions before 0.9.8.1205, released in June 2025. Users should: Upgrade to version 0.9.8.1205 or later. Restrict access to port 2083 (the user interface) to trusted IPs. Look for signs of compromise, e.g., unexpected reverse shell connections, suspicious chmod executions in logs, new or modified .bashrc, .ssh, or cron entries, connections to unfamiliar IP addresses, and unknown user accounts. If found, the host should be isolated, logs preserved, and a forensic investigation mounted. Use intrusion detection systems to detect/block exploitation attempts. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important, two are rated Moderate, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege escalation, followed by remote code execution (35), information disclosure (18), spoofing (8), and denial-of-service (4) defects. This is in addition to 16 vulnerabilities addressed in Microsoft's Chromium-based Edge browser since the release of last month's Patch Tuesday update, including two spoofing bugs affecting Edge for Android. Included among the vulnerabilities is a privilege escalation vulnerability impacting Microsoft Exchange Server hybrid deployments (CVE-2025-53786, CVSS score: 8.0) that Microsoft disclosed last week. The publicly disclosed zero-day is CVE-2025-53779 (CVSS score: 7.2), another privilege escalation flaw in Windows Kerberos that stems from a case of relative path traversal. Akamai researcher Yuval Gordon has been credited with discovering and reporting the bug. It's worth mentioning here that the issue was documented in detail back in May 2025 by the web infrastructure and security company, giving it the codename BadSuccessor. The novel technique essentially allows a threat actor with sufficient privileges to compromise an Active Directory (AD) domain by misusing delegated Managed Service Account (dMSA) objects. "The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act," Adam Barnett, lead software engineer at Rapid7, told The Hacker News. "However, abuse of CVE-2025-53779 is certainly plausible as the final link of a multi-exploit chain which stretches from no access to total pwnage." Action1's Mike Walters noted that the path traversal flaw can be abused by an attacker to create improper delegation relationships, enabling them to impersonate privileged accounts, escalate to a domain administrator, and potentially gain full control of the Active Directory domain. "An attacker who already has a compromised privileged account can use it to move from limited administrative rights to full domain control," Walters added. "It can also be paired with methods such as Kerberoasting or Silver Ticket attacks to maintain persistence." "With domain administrator privileges, attackers can disable security monitoring, modify Group Policy, and tamper with audit logs to hide their activity. In multi-forest environments or organizations with partner connections, this flaw could even be leveraged to move from one compromised domain to others in a supply chain attack." Satnam Narang, senior staff research engineer at Tenable, said the immediate impact of BadSuccessor is limited, as only 0.7% of Active Directory domains had met the prerequisite at the time of disclosure. "To exploit BadSuccessor, an attacker must have at least one domain controller in a domain running Windows Server 2025 in order to achieve domain compromise," Narang pointed out. Some of the notable Critical-rated vulnerabilities patched by Redmond this month are below - CVE-2025-53767 (CVSS score: 10.0) - Azure OpenAI Elevation of Privilege Vulnerability CVE-2025-53766 (CVSS score: 9.8) - GDI+ Remote Code Execution Vulnerability CVE-2025-50165 (CVSS score: 9.8) - Windows Graphics Component Remote Code Execution Vulnerability CVE-2025-53792 (CVSS score: 9.1) - Azure Portal Elevation of Privilege Vulnerability CVE-2025-53787 (CVSS score: 8.2) - Microsoft 365 Copilot BizChat Information Disclosure Vulnerability CVE-2025-50177 (CVSS score: 8.1) - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability CVE-2025-50176 (CVSS score: 7.8) - DirectX Graphics Kernel Remote Code Execution Vulnerability Microsoft noted that the three cloud service CVEs impacting Azure OpenAI, Azure Portal, and Microsoft 365 Copilot BizChat have already been remediated, and that they require no customer action. Check Point, which disclosed CVE-2025-53766 alongside CVE-2025-30388, said the vulnerabilities allow attackers to execute arbitrary code on the affected system, leading to a full system compromise. "The attack vector involves interacting with a specially crafted file. When a user opens or processes this file, the vulnerability is triggered, allowing the attacker to take control," the cybersecurity company said. The Israeli firm revealed that it also uncovered a vulnerability in a Rust-based component of the Windows kernel that can result in a system crash that, in turn, triggers a hard reboot. "For organizations with large or remote workforces, the risk is significant: attackers could exploit this flaw to simultaneously crash numerous computers across an enterprise, resulting in widespread disruption and costly downtime," Check Point said. "This discovery highlights that even with advanced security technologies like Rust, continuous vigilance and proactive patching are essential to maintaining system integrity in a complex software environment." Another vulnerability of importance is CVE-2025-50154 (CVSS score: 6.5), an NTLM hash disclosure spoofing vulnerability that's actually a bypass for a similar bug (CVE-2025-24054, CVSS score: 6.5) that was plugged by Microsoft in March 2025. "The original vulnerability demonstrated how specially crafted requests could trigger NTLM authentication and expose sensitive credentials," Cymulate researcher Ruben Enkaoua said. "This new vulnerability [...] allows an attacker to extract NTLM hashes without any user interaction, even on fully patched systems. By exploiting a subtle gap left in the mitigation, an attacker can trigger NTLM authentication requests automatically, enabling offline cracking or relay attacks to gain unauthorized access." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — 7-Zip Adobe Amazon Web Services AMD AMI Apple Arm ASUS Atlassian Autodesk Axis Communications Bosch Broadcom (including VMware) Check Point Cisco CODESYS D-Link Dell Drupal Elastic Emerson F5 Fortinet Fortra Foxit Software FUJIFILM Fujitsu Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Google Wear OS HMS Networks HP HP Enterprise (including Aruba Networking) Huawei IBM Intel Ivanti Juniper Networks Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA Palo Alto Networks Qualcomm Rockwell Automation Salesforce Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Sophos Splunk Spring Framework Supermicro Synology TP-Link Trend Micro WinRAR Xerox Zimbra Zoom, and Zyxel