{"id":99808,"date":"2021-04-15T10:22:45","date_gmt":"2021-04-15T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah"},"modified":"2021-04-15T10:22:45","modified_gmt":"2021-04-15T08:22:45","slug":"predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","title":{"rendered":"Byly p\u0159edstaveny patche pro randomizaci adresy z\u00e1sobn\u00edku j\u00e1dra Linux p\u0159i syst\u00e9mov\u00fdch vol\u00e1n\u00edch","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kees Cook, b\u00fdval\u00fd hlavn\u00ed syst\u00e9mov\u00fd administr\u00e1tor kernel.org a vedouc\u00ed Ubuntu Security Team, nyn\u00ed pracuj\u00edc\u00ed ve spole\u010dnosti Google na zabezpe\u010den\u00ed Android a ChromeOS, zve\u0159ejnil sadu patch\u016f s implementac\u00ed randomizace posunut\u00ed ve stohu j\u00e1dra p\u0159i zpracov\u00e1n\u00ed syst\u00e9mov\u00fdch vol\u00e1n\u00ed. Patche zvy\u0161uj\u00ed bezpe\u010dnost j\u00e1dra zm\u011bnou um\u00edst\u011bn\u00ed stohu, co\u017e \u010din\u00ed \u00fatoky na stoh v\u00fdrazn\u011b slo\u017eit\u011bj\u0161\u00edmi a m\u00e9n\u011b \u00fasp\u011b\u0161n\u00fdmi. Po\u010d\u00e1te\u010dn\u00ed implementace podporuje procesory ARM64 a x86\/x86_64. <\/p>\n

P\u016fvodn\u00ed my\u0161lenka tohoto patche poch\u00e1z\u00ed z projektu PaX RANDKSTACK. V roce 2019 se in\u017een\u00fdrka z firmy Intel, Elena Re\u0161etov, pokusila vytvo\u0159it implementaci t\u00e9to my\u0161lenky vhodnou pro za\u010dlen\u011bn\u00ed do hlavn\u00edho j\u00e1dra Linuxu. Pozd\u011bji tuto iniciativu p\u0159evzal Kees Cook, kter\u00fd p\u0159edstavil implementaci vhodnou pro hlavn\u00ed variantu j\u00e1dra. Patche se pl\u00e1nuje za\u0159adit do verze 5.13. Tento re\u017eim bude ve v\u00fdchoz\u00edm nastaven\u00ed vypnut\u00fd. Pro jeho aktivaci byly navr\u017eeny parametry p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku j\u00e1dra «randomize_kstack_offset=on\/off» a nastaven\u00ed CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT. N\u00e1klady na aktivaci re\u017eimu jsou odhadov\u00e1ny na p\u0159ibli\u017en\u011b 1% ztr\u00e1tu v\u00fdkonu. <\/p>\n

Podstata navrhovan\u00e9 ochrany spo\u010d\u00edv\u00e1 ve v\u00fdb\u011bru n\u00e1hodn\u00e9ho posunut\u00ed stohu p\u0159i ka\u017ed\u00e9m syst\u00e9mov\u00e9m vol\u00e1n\u00ed, co\u017e zt\u011b\u017euje ur\u010den\u00ed rozlo\u017een\u00ed stohu v pam\u011bti, i kdy\u017e z\u00edsk\u00e1me \u00fadaje o adres\u00e1ch, proto\u017ee p\u0159i dal\u0161\u00edm syst\u00e9mov\u00e9m vol\u00e1n\u00ed se z\u00e1kladn\u00ed adresa stohu zm\u011bn\u00ed. Na rozd\u00edl od implementace PaX RANDKSTACK v navrhovan\u00fdch patchech pro za\u0159azen\u00ed do j\u00e1dra se randomizace prov\u00e1d\u00ed ne na po\u010d\u00e1te\u010dn\u00ed f\u00e1zi (cpu_current_top_of_stack), ale po nastaven\u00ed struktury pt_regs, co\u017e znemo\u017e\u0148uje pou\u017eit\u00ed metod na z\u00e1klad\u011b ptrace pro ur\u010den\u00ed randomizovan\u00e9ho posunu v procesu pr\u00e1ce dlouho b\u011b\u017e\u00edc\u00edho syst\u00e9mov\u00e9ho vol\u00e1n\u00ed.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0441 \u041a\u0443\u043a (Kees Cook), \u0431\u044b\u0432\u0448\u0438\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0441\u0438\u0441\u0430\u0434\u043c\u0438\u043d kernel.org \u0438 \u043b\u0438\u0434\u0435\u0440 Ubuntu Security Team, \u043d\u044b\u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043d\u0430\u0434 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b Android \u0438 ChromeOS, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u0439 \u0432 \u0441\u0442\u044d\u043a\u0435 \u044f\u0434\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432. \u041f\u0430\u0442\u0447\u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u044f\u0434\u0440\u0430 \u043f\u0443\u0442\u0451\u043c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0441\u0442\u0435\u043a\u0430, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0442\u0435\u043a \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99808","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 P\u0159edstavujeme patche pro randomizaci adres\u016f stohu j\u00e1dra Linux p\u0159i syst\u00e9mov\u00fdch vol\u00e1n\u00edch | ProHoster","description":"Kees Cook, b\u00fdval\u00fd hlavn\u00ed syst\u00e9mov\u00fd administr\u00e1tor kernel.org a vedouc\u00ed Ubuntu Security Team, nyn\u00ed pracuj\u00edc\u00ed ve spole\u010dnosti Google na zabezpe\u010den\u00ed Android a ChromeOS, zve\u0159ejnil sadu patch\u016f s implementac\u00ed randomizace.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u0430\u0445 | ProHoster","og:description":"\u041a\u0438\u0441 \u041a\u0443\u043a (Kees Cook), \u0431\u044b\u0432\u0448\u0438\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0441\u0438\u0441\u0430\u0434\u043c\u0438\u043d kernel.org \u0438 \u043b\u0438\u0434\u0435\u0440 Ubuntu Security Team, \u043d\u044b\u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043d\u0430\u0434 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b Android \u0438 ChromeOS, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-15T08:22:45+00:00","article:modified_time":"2021-04-15T08:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99808","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-15 08:37:16","updated":"2022-09-29 02:14:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=99808"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99808\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=99808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=99808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=99808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}