{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint p\u0159edstavil ochrannou techniku Safe-Linking, kter\u00e1 komplikuje vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Checkpoint p\u0159edstavila<\/a><\/noindex> ochrann\u00fd mechanismus Safe-Linking, kter\u00fd komplikuje vytv\u00e1\u0159en\u00ed exploit\u016f manipuluj\u00edc\u00edch s definic\u00ed nebo zm\u011bnou ukazatel\u016f na pam\u011b\u0165ov\u00e9 buffery alokovan\u00e9 p\u0159i vol\u00e1n\u00ed malloc. Safe-Linking zcela neblokuje mo\u017enost vyu\u017eit\u00ed zranitelnost\u00ed, ale s minim\u00e1ln\u00edmi n\u00e1klady v\u00fdrazn\u011b zt\u011b\u017euje vytv\u00e1\u0159en\u00ed n\u011bkter\u00fdch kategori\u00ed exploit\u016f, proto\u017ee krom\u011b exploatovan\u00e9ho p\u0159ete\u010den\u00ed bufferu je t\u0159eba naj\u00edt je\u0161t\u011b jednu zranitelnost, kter\u00e1 zp\u016fsobuje \u00fanik informac\u00ed o um\u00edst\u011bn\u00ed haldy (heap) v pam\u011bti.<\/p>\n

Z\u00e1platy s implementac\u00ed Safe-Linking byly p\u0159ipraveny pro Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) a Google TCMalloc, a tak\u00e9 jsou navr\u017eeny pro modernizaci ochrany v Chromiu (v
\nChromiu je od roku 2012 ji\u017e integrovan\u00e1 technika ochrany MaskPtr, zam\u011b\u0159en\u00e1 na \u0159e\u0161en\u00ed stejn\u00e9ho probl\u00e9mu, ale \u0159e\u0161en\u00ed od Checkpoint vykazuje vy\u0161\u0161\u00ed v\u00fdkon).
\nNavrhovan\u00e9 z\u00e1platy ji\u017e byly schv\u00e1leny pro dod\u00e1n\u00ed v srpnov\u00e9m vyd\u00e1n\u00ed Glibc 3.32<\/a><\/noindex> a pou\u017eit\u00ed Safe-Linking bude zahrnuto jako standardn\u00ed. Podpora Safe-Linking v uClibc-NG byla<\/a><\/noindex> zahrnuta do vyd\u00e1n\u00ed 1.0.33 a je zahrnuta jako standardn\u00ed. V gperftools (star\u00fd tcmalloc) zm\u011bny byly p\u0159ijaty<\/a><\/noindex>, ale budou nab\u00eddnuty v n\u011bkter\u00e9m z budouc\u00edch vyd\u00e1n\u00ed jako volba. <\/p>\n

V\u00fdvoj\u00e1\u0159i TCMalloc<\/a><\/noindex> nov\u00fd tcmalloc zm\u011bna<\/a><\/noindex>, s odkazem na siln\u00e9 sn\u00ed\u017een\u00ed v\u00fdkonu a nutnost p\u0159id\u00e1n\u00ed roz\u0161\u00ed\u0159en\u00fdch test\u016f pro pravidelnou kontrolu, zda v\u0161e funguje spr\u00e1vn\u011b. Testov\u00e1n\u00ed in\u017een\u00fdry Checkpoint uk\u00e1zalo, \u017ee metoda Safe-Linking nevede k dodate\u010dn\u00e9 spot\u0159eb\u011b pam\u011bti, a \u017ee v\u00fdkon p\u0159i prov\u00e1d\u011bn\u00ed operac\u00ed s haldou se pr\u016fm\u011brn\u011b sni\u017euje pouze o 0,02 %, a v nejhor\u0161\u00edm p\u0159\u00edpad\u011b o 1,5 % (pro srovn\u00e1n\u00ed, re\u017eijn\u00ed n\u00e1klady pou\u017e\u00edvan\u00e9 v Chromiu jsou odhadov\u00e1ny jako \u201em\u00e9n\u011b ne\u017e 2 %\u201c). Za\u010dlen\u011bn\u00ed
\nSafe-Linking vede k vykon\u00e1n\u00ed 2-3 dodate\u010dn\u00fdch assemblerov\u00fdch instrukc\u00ed p\u0159i ka\u017ed\u00e9m vol\u00e1n\u00ed free() a 3-4 instrukc\u00ed p\u0159i vol\u00e1n\u00ed malloc(). Nen\u00ed nutn\u00e9 spou\u0161t\u011bt f\u00e1ze inicializace a generov\u00e1n\u00ed n\u00e1hodn\u00fdch hodnot.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking m\u016f\u017ee b\u00fdt pou\u017eit nejen k zv\u00fd\u0161en\u00ed bezpe\u010dnosti r\u016fzn\u00fdch implementac\u00ed haldy (heap), ale tak\u00e9 k p\u0159id\u00e1n\u00ed prost\u0159edk\u016f pro kontrolu integrity do jak\u00fdchkoli datov\u00fdch struktur, v nich\u017e se pou\u017e\u00edvaj\u00ed jednosm\u011brn\u00e9 seznamy ukazatel\u016f um\u00edst\u011bn\u00e9 pobl\u00ed\u017e samotn\u00fdch buffer\u016f. Metoda je velmi jednoduch\u00e1 na implementaci a vy\u017eaduje pouze p\u0159id\u00e1n\u00ed jednoho makra a jeho pou\u017eit\u00ed na ukazatele na dal\u0161\u00ed blok v k\u00f3du (nap\u0159\u00edklad pro Glibc m\u011bn\u00ed<\/a><\/noindex> pouze n\u011bkolik \u0159\u00e1dk\u016f k\u00f3du). Metoda spo\u010d\u00edv\u00e1 v n\u00e1sleduj\u00edc\u00edch zm\u011bn\u00e1ch:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n …<\/p>\n

Podstata metody spo\u010d\u00edv\u00e1 v pou\u017eit\u00ed n\u00e1hodn\u00fdch dat z mechanismu randomizace adres ASLR (mmap_base) pro ochranu jednosm\u011brn\u00fdch seznam\u016f, jako jsou Fast-Bins a TCache. P\u0159ed pou\u017eit\u00edm na hodnotu ukazatele na n\u00e1sleduj\u00edc\u00ed prvek v seznamu se prov\u00e1d\u00ed transformace podle masky a kontrola zarovn\u00e1n\u00ed podle hranice str\u00e1nky pam\u011bti. Ukazatel se nahrazuje v\u00fdsledkem operace \u201e(L >> PAGE_SHIFT) XOR (P)\u201c, kde P je hodnota ukazatele a L je um\u00edst\u011bn\u00ed v pam\u011bti, kde se tento ukazatel ukl\u00e1d\u00e1.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

P\u0159i pou\u017eit\u00ed v syst\u00e9mu ASLR<\/a><\/noindex> (N\u00e1hodn\u00e9 rozlo\u017een\u00ed adresov\u00e9ho prostoru) \u010d\u00e1st bit\u016f L s z\u00e1kladn\u00ed adresou haldy obsahuje n\u00e1hodn\u00e9 hodnoty, kter\u00e9 se pou\u017e\u00edvaj\u00ed jako kl\u00ed\u010d k zak\u00f3dov\u00e1n\u00ed P (extrahov\u00e1ny operac\u00ed posunu o 12 bit\u016f pro 4096-bajtov\u00e9 str\u00e1nky). Takov\u00e1 manipulace sni\u017euje riziko zachycen\u00ed ukazatele v exploitu, proto\u017ee ukazatel nen\u00ed uchov\u00e1v\u00e1n v p\u016fvodn\u00ed podob\u011b a pro jeho nahrazen\u00ed je t\u0159eba zn\u00e1t informace o um\u00edst\u011bn\u00ed haldy. Krom\u011b toho v patch k\u00f3du rovn\u011b\u017e existuje dal\u0161\u00ed kontrola zarovn\u00e1n\u00ed bloku, kter\u00e1 \u00fato\u010dn\u00edkovi neumo\u017e\u0148uje nahradit ukazatel nezarovnanou hodnotou a vy\u017eaduje znalost po\u010dtu bit\u016f, o kter\u00e9 bylo provedeno zarovn\u00e1n\u00ed, co\u017e na 64bitov\u00fdch syst\u00e9mech nav\u00edc umo\u017e\u0148uje zablokovat 15 z 16 pokus\u016f o \u00fatoky, kter\u00e9 neberou v \u00favahu zarovn\u00e1n\u00ed.<\/p>\n

Metoda je \u00fa\u010dinn\u00e1 p\u0159i ochran\u011b proti \u00fatok\u016fm, kter\u00e9 vyu\u017e\u00edvaj\u00ed \u010d\u00e1ste\u010dn\u00e9 p\u0159epakov\u00e1n\u00ed ukazatel\u016f (zm\u011bna nejni\u017e\u0161\u00edch byt\u016f), \u00fapln\u00e9 p\u0159eps\u00e1n\u00ed ukazatel\u016f (p\u0159esm\u011brov\u00e1n\u00ed na k\u00f3d \u00fato\u010dn\u00edka) a zm\u011bnu polohy seznamu na nezarovnanou adresu. Jako p\u0159\u00edklad je uvedeno, \u017ee pou\u017eit\u00ed Safe-Linking v malloc by zablokovalo exploataci ned\u00e1vno odhalen\u00e9<\/a><\/noindex> t\u00fdmi\u017e v\u00fdzkumn\u00edky zranitelnosti CVE-2020-6007<\/a><\/noindex> v inteligentn\u00edm osv\u011btlen\u00ed Philips Hue Bridge, zp\u016fsobenou p\u0159ete\u010den\u00edm z\u00e1sobn\u00edku a umo\u017e\u0148uj\u00edc\u00ed p\u0159evz\u00edt kontrolu nad za\u0159\u00edzen\u00ed.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint navrhl techniku ochrany Safe-Linking, kter\u00e1 zt\u011b\u017euje zneu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed | ProHoster","description":"Spole\u010dnost Checkpoint p\u0159edstavila mechanismus ochrany Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}