Ingabe uthintekile yi-CVE-2019-14899? Uhlu lokuhlola lwe-kernel

Isihlukanisi sibonisa i-CVE-2019-14899 kumshini osebenzise i-VPN iminyaka eminingi, futhi umuzwa wokuqala ukuthi i-VPN iphukile. Lokho kuyisakhiwo esingalungile. Inkinga evezwe isiphathelene nomhlaseli osenethiwekhi yendawo yesisulu othola ulwazi mayelana nokuxhumana okuthile kwe-TCP, hhayi iwebhusayithi edicrypta umhubhe wakho.

Dlula ekuhloleni okune ngezansi ngokulandelana. Ngakunye kunciphisa inkinga noma kuqede uphenyo.

Ukuhlola 1: ingabe isixwayiso sihlanganisa i-kernel yakho

Bheka irekhodi lokuphakwa kwakho uqobo, hhayi isifinyezo sebhulogi mayelana nosuku lokukhishwa. Ikhasi lokuphepha le-Ubuntu lale CVE libala iphakethe le-linux elivamile le-18.04 LTS njengelisengozini ngokulungiswa okuhlehlisiwe, futhi lilandela amanye amaphakethe e-kernel emigqeni ehlukene. Qondanisa ukukhishwa okusebenzayo kanye nephakethe le-kernel nomugqa ofanele. Inombolo yenguqulo ebonakala ijwayelekile ayikona ukuqondanisa.

Umphumela wesihlukanisi usho ukuthi isikhombi sisebenza entweni ethile ohlwini lwakho. Akusho ukuthi idivayisi eseduze yasebenzisa kabi umshini.

Ukuhlola 2: ungubani umhlaseli kumodeli

Imodeli yosongo icabanga umhlaseli oseduze ongasebenzisana nenethiwekhi yokufinyelela yesisulu. Leyo yindawo ethile, hhayi isevisi ekude engayithandi i-node yakho yokuphuma. Uma abasebenzisi bexhuma besuka ekhefini, umcabango unengqondo; uma behlezi ngemuva kwe-LAN yebhizinisi elawulwayo, lokho kwenye ingxoxo.

Shiya umbuzo wokwethenjwa kwenethiwekhi yendawo uvulekile ngisho lapho umhubhe ubhaliwe. Ukubhala kuphendula umbuzo ohlukile kunokuba seduze.

Ukuhlola 3: uncike kuluphi ungqimba

I-HTTPS eqinisekiswe kahle inikeza ukuvikelwa kwayo kwamarekhodi ohlelo, futhi i-TLS 1.3 iqinisekisa leyo datha kusukela ekugcineni kuya ekugcineni. Kodwa ayithembisi ukuthi umhlaseli ngeke akwazi ukuphazamisa ukuxhumana kwe-TCP okungaphansi. Ngakho uhlelo lungaphepha ukufundwa kodwa lusengaphazanyiswa, futhi ukuphazamiseka akusona isiphumo esifanayo nokudalulwa. Hlukanisa kokubili ngaphambi kokuhlola ubungozi.

Lowo mehluko ubalulekile embikweni. Uguqula isimangalo esingacacile sokuthi i-VPN ayiphephile sibe isitatimende esilinganiselwe mayelana nalokho umhlaseli oseduze angakubona noma akubonise.

Ukuhlola 4: yiluphi ushintsho lokunciphisa olusebenzisile ngempela

Ukudalulwa kukhuluma ngezindlela zokunciphisa zokuhlela nokuhlunga futhi kucace mayelana nemikhawulo yazo, kuhlanganise nokuhlunga komzila obuyela emuva kanye nemizila engalingani. Unganamatheli inani elilodwa le-sysctl kuyo yonke isiphathi se-VPN bese uthi isixazululiwe. Ukuhlunga komzila obuyela emuva kusebenzisana nokuhlela, ngakho inani elisiza isakhiwo esisodwa lingaphula esinye.

Ukuhlola kungumyalo, hhayi ibhokisi lokumaka. I-sysctl net.ipv4.conf.all.rp_filter ikhombisa inani lomhlaba wonke, futhi i-sysctl net.ipv4.conf.tun0.rp_filter ikhombisa inani lesikhombimsebenzisi esisebenza ngempela. Funda kokubili ngaphambi nangemuva kwanoma yiluphi ushintsho.

Sebenzisa isiqondiso sokuphakwa kanye nomklamo wakho wokuhlela, bese uqinisekisa isilungiselelo kusikhombimsebenzisi esithwala umhubhe, hhayi efayeleni okungekho oyilayishile.

Okufanele ukubhale phansi

Bhala phansi umcabango womhlaseli oseduze, iphakethe le-kernel elisebenzayo, umugqa wesixwayiso owuqondanisa, indlela yokunciphisa esetshenzisiwe nokuthi isebenza kuphi, kanye nokuvikelwa kohlelo okukhona. Faka usuku ohlole ngalo isixwayiso, ngoba lawo makhasi ayashintsha. Leyo nhlanganisela iwukuhlola okuvikelekile.

Usuku lokukhishwa kwe-OS nokuxhumana kwe-VPN okusebenzayo akukona ukuhlola. Kuyiqiniso ezimbili okwenzeka ukuthi kulula ukuziqoqa.