Byagenze bite
GBHackers ivuga ko abashakashatsi Elad Luz na Ofek Itach w’umutekano wa Oasis bagaragaje CVE-2026-65105 muri NVIDIA NemoClaw. Inenge ivugwa irimo NemoClaw igena serivisi y’ibanze ya Ollama kugira ngo yumve imiyoboro yose y’urusobe, birashoboka ko DNS ishingiye kuri mushakisha ibitero byibutsa kugera kuri API itemewe.
GBHackers ivuga ko abashakashatsi b'umutekano wa Oasis Elad Luz na Ofek Itach bagaragaje intege nke zikurikiranwa nka CVE-2026-65105 muri NVIDIA NemoClaw. Nk’uko raporo ibigaragaza, NemoClaw irashobora kohereza umukozi wa OpenClaw AI imbere muri NVIDIA OpenShell sandbox mugihe ukoresha Ollama kuri nyirarureshwa nkumugongo wibanze. Ingingo ivuga ko imiterere itoroshye igena Ollama hamwe na OLLAMA_HOST = 0.0.0.0: 11434, ihuza serivisi kuri interineti yose aho kuba adresse gusa. GBHackers ivuga ko abakoresha bashobora kubwirwa ko serivisi iboneka kuri localhost: 11434, nubwo iboneza ryemerera kwinjira-imiyoboro.
GBHackers ivuga ko API ya Ollama ku cyambu cya 11434 idasaba kwemezwa kandi ubusanzwe yishingikiriza kuri cheque-nkomoko ya mushakisha, harimo CORS hamwe no kwemeza umutwe-umutwe. Abashakashatsi ngo basanze kwemeza Host-header bishobora kurengerwa mugihe Ollama ihujwe na adresse idasubirwaho nka 0.0.0.0. Mu gitero cyasobanuwe n’ikigo, uwahohotewe asura domaine igenzurwa nigitero kibanza gukemura kuri seriveri yabatera. Indangarugero yaje guhinduka kugirango ikemure kuri aderesi yaho, nka 127.0.0.1, mugihe mushakisha ikomeje gufata izina ryakiriwe nkinkomoko imwe. Ingingo ivuga ko ibi bishobora kwemerera JavaScript kuva kurubuga rubi gusaba ibyifuzo bya serivisi ya Ollama yahohotewe.
Nk’uko GBHackers ibivuga, API yashyizwe ahagaragara irashobora kureka uwagabye igitero akabarura moderi zashyizweho, akamenya verisiyo ya Ollama, gutanga ibyifuzo byerekana, gukuramo moderi nini, cyangwa gusiba moderi zihari. Ingingo irerekana uburozi-bwicyitegererezo cyuburozi nkibikomeye byavuzwe bishoboka. Ivuga ko igitero gishobora kugarura inyandikorugero yemewe binyuze muri / api / kwerekana no gukoresha / api / kurema kugirango ubungabunge izina rigaragara, metadata, ingano, nubushobozi bugaragara mugihe wongeyeho amabwiriza yihishe muburyo ubutumwa butunganywa. GBHackers ivuga ko ayo mabwiriza ashobora gukomeza mu mikoranire nyuma, birashoboka ko yayobora umukozi kubyara kode yinyuma, guhagarika imiburo, gusaba ibicuruzwa bibi cyangwa URL, cyangwa gusohora amakuru niba umukozi afite uburenganzira bwo gusohoka. Ibyavuye mu bushakashatsi ntabwo byemejwe byigenga bivuye ku nkomoko yatanzwe.
Ibisobanuro birambuye: gbhackers.com ↗
Impamvu ari ngombwa
Niba konte ya tekiniki ya raporo ari iy'ukuri, uwagabye igitero yakora ibirenze gukoresha umutungo waho: barashobora guhindura icyitegererezo cyo kuganira cyicyitegererezo kuburyo amabwiriza yihishe agumaho mubikorwa bizaza. Ingaruka zifatika zaterwa nimpushya hamwe na sisitemu ihujwe iboneka kubakozi ba AI.
Ikibazo cyatangajwe gifite akamaro kuko kireba imipaka iri hagati yicyitegererezo cya AI hamwe na software igenga uburyo umukozi asobanura ubutumwa. Sisitemu isanzwe irashobora rimwe na rimwe kurengerwa cyangwa kugenzurwa nkigice cyo kugenzura porogaramu. GBHackers ivuga ko inyandikorugero yo kuganiriraho uburozi ikorera murwego rwo hasi rutunganyirizwa kandi igakoreshwa mugihe cyose usabye, ibyo bikaba bishobora gutuma impinduka igora kubakoresha bisanzwe. Konti yingingo rero isobanura ibyago byo gutsimbarara aho kuba inshuro imwe.
Ingaruka zishobora guterwa nicyo umukozi ashobora kugeraho. GBHackers ivuga ko OpenShell ishobora kugabanya urwego rwabashitsi rwerekanwe binyuze muri sisitemu ya sisitemu, urusobe, hamwe no kwigunga, ariko kandi ishimangira ko ingaruka zisigaye ziterwa n’uruhushya rwatanzwe n’umukozi. Raporo yerekana ububiko bwinkomoko, sisitemu ya CI / CD, imbere muri APIs, urubuga rwibicu, serivisi zubutumwa, hamwe na seriveri ya Model Context Protocol nkurugero rwibikoresho bihujwe. Niba umukozi wangiritse ashobora kugera kuri sisitemu, amabwiriza yihishe ashobora guhindura code, ibyifuzo, gukoresha amakuru, cyangwa ibikorwa byakozwe binyuze muri ubwo buryo. Inkomoko ntisobanura ko bumwe muri ubwo buryo bwangiritse.
Raporo 0.0.0.0 ihuza nayo itera impungenge yihariye-y'urusobe. GBHackers ivuga ko ibindi bikoresho biri kumurongo umwe bishobora kubona serivisi ya Ollama udakoresheje DNS yibutsa. Ibyo byagura ikibazo kirenze uwahohotewe asura urubuga rubi kandi bigatuma igice cyurusobe hamwe na serivise bigaragarira mubyemezo byo kohereza. Muri icyo gihe, isoko ntabwo itanga ibimenyetso byerekana ko byakoreshejwe mu gasozi, ingaruka z’ibikorwa byoherejwe, kumvikana neza n’umuryango nyawo, cyangwa kwemeza ubujura bwamakuru. Ntabwo kandi yigenga yerekana uburyo buri gikoresho cya NemoClaw cyashyizweho.
Uburyo bukoreshwa: Uburyo bukora
Shakisha ikoranabuhanga ryihishe inyuma yiri terambere.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
Ibyo kureba
Igisubizo cya NVIDIA, icyerekezo icyo aricyo cyose cyangwa ibiyobora, hamwe no kwemeza tekinike yigenga nibibazo byingenzi byingenzi. Amashyirahamwe akoresha NemoClaw hamwe na Ollama agomba gusuzuma icyambu 11434, akabuza kwinjira, hamwe nubugenzuzi bwicyitegererezo cyimpinduka zitemewe.
Ikibazo cya mbere cyo kureba ni ukumenya niba NVIDIA yemeza CVE-2026-65105 ikanatangaza patch, mituweli, cyangwa ivugururwa ryubuyobozi. GBHackers avuga ko abashakashatsi babimenyesheje itsinda rya NVIDIA ry’ibisubizo by’umutekano w’ibicuruzwa mbere yo gutangazwa, ariko ingingo yatanzwe ntabwo ikubiyemo igisubizo cya NVIDIA cyangwa ngo bavuge niba hari igisubizo cyakemutse gutangazwa. Kugeza ubwo ayo makuru aboneka, ubukana no gukosora bigomba gufatwa nkuko byatangajwe aho kugenzurwa byigenga.
Abakoresha bagomba gusuzuma niba Ollama igomba kuba 0.0.0.0 cyangwa indi aderesi idasubirwaho, ikabuza kugera ku cyambu cya 11434, kandi ikagenzura amategeko ya firewall kugirango imenyekane. GBHackers irasaba cyane cyane gusubiramo intera igaragara hamwe nubugenzuzi bwikitegererezo cyerekana impinduka zitemewe. Abayobozi bagomba kandi gusuzuma amadosiye, ububiko, ibyangombwa, APIs, serivisi zicu, hamwe na seriveri ya MCP umukozi ashobora kubona, kubera ko ingingo ivuga ko izo mpushya zigena aho ubwumvikane buke bwurwego rushobora kugera. Izi ni ingamba zo kwirwanaho zikomoka kuri raporo, ntabwo ari ibimenyetso byerekana ko habaye ikibazo.
Kwororoka kwigenga nubundi bugenzuzi bwingenzi. Amatsinda yumutekano nabashakashatsi bazakenera kumenya niba inzira yasobanuwe DNS-isubiza inyuma ikora kurubuga rushyigikiwe, sisitemu y'imikorere, verisiyo ya NemoClaw, hamwe na Ollama, kandi niba impinduka zicyitegererezo zikomeza nkuko byavuzwe. Bagomba kandi kumenya uburyo abayobozi bashobora kumenya neza inyandikorugero zahinduwe kandi niba igenzura ryumusenyi ribuza kugera kubintu byoroshye. Inkomoko yatanzwe ntisobanura urwego rwahinduwe, amanota ya CVSS, gukoresha kode iboneka, igihe cyagenwe, cyangwa umubare wubushakashatsi bwashyizwe ahagaragara, ubwo rero ibisobanuro bikomeza kuba ibisobanuro bitazwi.