{"id":71652,"date":"2020-02-27T08:51:34","date_gmt":"2020-02-27T05:51:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8"},"modified":"2020-03-03T16:10:40","modified_gmt":"2020-03-03T13:10:40","slug":"0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","title":{"rendered":"0-day zranitelnost v Chrome, odhalena anal\u00fdzou zm\u011bn v enginu V8","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z firmy Exodus Intelligence p\u0159edvedli<\/a><\/noindex> zranitelnost v procesu opravov\u00e1n\u00ed chyb v k\u00f3du Chrome\/Chromium. Probl\u00e9m spo\u010d\u00edv\u00e1 v tom, \u017ee Google zve\u0159ej\u0148uje informace o tom, \u017ee proveden\u00e9 opravy se t\u00fdkaj\u00ed bezpe\u010dnostn\u00edch probl\u00e9m\u016f a\u017e po vyd\u00e1n\u00ed, ale
\np\u0159id\u00e1v\u00e1 do repozit\u00e1\u0159e k\u00f3d pro odstran\u011bn\u00ed zranitelnosti v enginu V8 p\u0159ed publikac\u00ed vyd\u00e1n\u00ed. Ur\u010dit\u00fd \u010das opravy prob\u00edhaj\u00ed testov\u00e1n\u00edm a vznik\u00e1 okno, b\u011bhem n\u011bho\u017e je zranitelnost opravena v k\u00f3du a dostupn\u00e1 pro anal\u00fdzu, ale zranitelnost z\u016fst\u00e1v\u00e1 neopraven\u00e1 na u\u017eivatelsk\u00fdch syst\u00e9mech. <\/p>\n

P\u0159i zkoum\u00e1n\u00ed zm\u011bn v repozit\u00e1\u0159i v\u011bdci zaznamenali, \u017ee bylo p\u0159id\u00e1no 19. \u00fanora oprava<\/a><\/noindex> a b\u011bhem t\u0159\u00ed dn\u016f byli schopni p\u0159ipravit exploataci<\/a><\/noindex>, kter\u00e1 zasahuje aktu\u00e1ln\u00ed verze Chrome (publikovan\u00e1 exploatace nezahrnovala komponenty pro obch\u00e1zen\u00ed sandboxov\u00e9 izolace). Spole\u010dnost Google rychle vyu\u017eila<\/a><\/noindex> aktualizovala Chrome na verzi 80.0.3987.122 a odstranila souvisej\u00edc\u00ed probl\u00e9m s navr\u017eenou exploatac\u00ed zranitelnost<\/a><\/noindex> (CVE-2020-6418). Zranitelnost byla p\u016fvodn\u011b odhalena in\u017een\u00fdry Googlu a byla zp\u016fsobena probl\u00e9mem s zpracov\u00e1n\u00edm typ\u016f v operaci JSCreate, kter\u00fd m\u016f\u017ee b\u00fdt vyu\u017eit prost\u0159ednictv\u00edm metody Array.pop nebo Array.prototype.pop. Je zaj\u00edmav\u00e9, \u017ee podobn\u00fd probl\u00e9m byl byla opraven\u00e1<\/a><\/noindex> ve Firefoxu minul\u00fd rok v l\u00e9t\u011b.<\/p>\n

V\u00fdzkumn\u00edci tak\u00e9 zd\u016fraznili zjednodu\u0161en\u00ed vytv\u00e1\u0159en\u00ed exploatac\u00ed d\u00edky zahrnut\u00ed do zapo\u010dal proces postupn\u00e9ho vyp\u00edn\u00e1n\u00ed podpory FTP ve v\u00fdchoz\u00edm nastaven\u00ed (pro ur\u010dit\u00e9 procento u\u017eivatel\u016f), a na Chrome 82 je napl\u00e1nov\u00e1no \u00fapln\u00e9 odstran\u011bn\u00ed k\u00f3du, kter\u00fd zaji\u0161\u0165uje funkci FTP klienta. Podle odhad\u016f Google se FTP ji\u017e t\u00e9m\u011b\u0159 nepou\u017e\u00edv\u00e1 \u2014 pod\u00edl u\u017eivatel\u016f FTP je kolem 0.1%.<\/a><\/noindex> mechanismu balen\u00ed ukazatel\u016f<\/a><\/noindex> (m\u00edsto cel\u00e9ho 64bitov\u00e9ho hodnoty se ukl\u00e1daj\u00ed pouze jedine\u010dn\u00e9 doln\u00ed bity ukazatele, co\u017e v\u00fdrazn\u011b sni\u017euje spot\u0159ebu pam\u011bti v hald\u011b). Nap\u0159\u00edklad n\u011bkter\u00e9 datov\u00e9 struktury nach\u00e1zej\u00edc\u00ed se na za\u010d\u00e1tku haldy, jako je tabulka zabudovan\u00fdch funkc\u00ed, objekty «nativn\u00ed kontext» a ko\u0159enov\u00e9 objekty<\/a><\/noindex> garbage collectoru, nyn\u00ed um\u00edst\u011bny na p\u0159edv\u00eddateln\u00fdch a zapisovateln\u00fdch zabalen\u00fdch adres\u00e1ch.<\/p>\n

Je zaj\u00edmav\u00e9, \u017ee t\u00e9m\u011b\u0159 p\u0159ed rokem prezentovala spole\u010dnost Exodus Intelligence podobnou<\/a><\/noindex> demonstra\u010dn\u00ed mo\u017enost vytvo\u0159en\u00ed exploatace na z\u00e1klad\u011b studia ve\u0159ejn\u00e9ho logu oprav v V8, ale zd\u00e1 se, \u017ee nebyly u\u010din\u011bny \u017e\u00e1dn\u00e9 d\u016fsledky. Na m\u00edst\u011b v\u00fdzkumn\u00edk\u016f
\nExodus Intelligence by mohli b\u00fdt \u00fato\u010dn\u00edci nebo zpravodajsk\u00e9 slu\u017eby, kte\u0159\u00ed by p\u0159i vytv\u00e1\u0159en\u00ed exploatace m\u011bli mo\u017enost t\u00fddny nebo dokonce m\u011bs\u00edce tajn\u011b zneu\u017e\u00edvat zranitelnost p\u0159ed vyd\u00e1n\u00edm dal\u0161\u00ed verze Chrome. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Exodus Intelligence \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043b\u0430\u0431\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 Chrome\/Chromium. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e Google \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u0432\u043d\u0435\u0441\u0451\u043d\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u044e\u0442 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0440\u0435\u043b\u0438\u0437\u0430, \u043d\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 V8 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u0430. \u041a\u0430\u043a\u043e\u0435-\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71652","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd470-day zranitelnost v Chromu zji\u0161t\u011bn\u00e1 anal\u00fdzou zm\u011bn v enginu V8 | ProHoster","description":"V\u00fdzkumn\u00edci ze spole\u010dnosti Exodus Intelligence demonstrovali slab\u00e9 m\u00edsto v procesu oprav.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd470-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Chrome, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u0430\u043d\u0430\u043b\u0438\u0437 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 V8 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Exodus Intelligence \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043b\u0430\u0431\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-27T05:51:34+00:00","article:modified_time":"2020-03-03T13:10:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:58:25","updated":"2022-10-01 14:35:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/71652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=71652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/71652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=71652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=71652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=71652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}