{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint har foresl\u00e5et en sikkerhedsteknik kaldet Safe-Linking, som komplicerer udnyttelsen af s\u00e5rbarheder.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Checkpoint Company pr\u00e6senterede<\/a><\/noindex> Safe-Linking er en beskyttelsesmekanisme, der g\u00f8r det vanskeligere at oprette exploits, der manipulerer med definitionen eller \u00e6ndringen af \u200b\u200bpegepunkter til de buffere, der er tildelt under en malloc-opkald. Safe-Linking blokkerer ikke fuldst\u00e6ndigt muligheden for at udnytte s\u00e5rbarheder, men det g\u00f8r det betydeligt vanskeligere at oprette visse kategorier af exploits med minimale omkostninger, da det ud over den udnyttede bufferoverfyldning er n\u00f8dvendigt at finde en anden s\u00e5rbarhed, der for\u00e5rsager en l\u00e6kage af information om hukommelsens (heap) placering.<\/p>\n

Patches, der implementerer Safe-Linking, er forberedt til Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) og Google TCMalloc, og de er ogs\u00e5 blevet foresl\u00e5et til opdatering af beskyttelsen i Chromium (i
\nChromium har siden 2012 v\u00e6ret udstyret med en teknik til beskyttelse mod samme problem, kaldet MaskPtr, men l\u00f8sningen fra Checkpoint viser h\u00f8jere ydeevne).
\nDe foresl\u00e5ede patches er allerede godkendt til levering i augustudgaven Glibc 3.32<\/a><\/noindex> og anvendelsen af \u200b\u200bSafe-Linking vil v\u00e6re inkluderet som standard. I uClibc-NG vil underst\u00f8ttelse af Safe-Linking blev optaget<\/a><\/noindex> v\u00e6re en del af udgivelsen 1.0.33 og inkluderet som standard. I gperftools (den gamle tcmalloc) er \u00e6ndringerne er blevet vedtaget<\/a><\/noindex>, men de vil blive tilbudt i en af \u200b\u200bde kommende versioner som en mulighed. <\/p>\n

Udviklere TCMalloc<\/a><\/noindex> (den nye tcmalloc) n\u00e6gtede at acceptere \u00e6ndringen<\/a><\/noindex>, henvises der til det markante fald i ydeevnen og behovet for at tilf\u00f8je udvidede tests for regelm\u00e6ssigt at kontrollere, at alt fungerer korrekt. Testning udf\u00f8rt af ingeni\u00f8rer fra Checkpoint viste, at metoden Safe-Linking ikke medf\u00f8rer ekstra hukommelsesforbrug, og at ydeevnen ved udf\u00f8relse af operationer med h\u00e6re i gennemsnit kun falder med 0,02%, mens den i v\u00e6rste tilf\u00e6lde falder med 1,5% (til sammenligning er omkostningerne ved den metode, der anvendes i Chromium, vurderet til at v\u00e6re «mindre end 2%»). Inkludering
\nSafe-Linking resulterer i, at der udf\u00f8res 2-3 ekstra assembly-instruktioner ved hvert free()-opkald og 3-4 instruktioner ved malloc()-opkald. K\u00f8rsel af initialiseringstrin og generering af tilf\u00e6ldige v\u00e6rdier er ikke n\u00f8dvendig.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking kan ikke kun anvendes til at \u00f8ge sikkerheden for forskellige metoder til heap-h\u00e5ndtering, men ogs\u00e5 til at tilf\u00f8je integritetskontrol til enhver datakonstruktion, hvor der bruges singly-linked lister, der placeres i n\u00e6rheden af de faktiske buffere. Metoden er meget enkel at implementere og kr\u00e6ver kun tilf\u00f8jelsen af en makro og dens anvendelse p\u00e5 pointere til den n\u00e6ste blok i koden (for eksempel for Glibc \u00e6ndres<\/a><\/noindex> kun et par linjer i koden). Metoden indeb\u00e6rer f\u00f8lgende \u00e6ndringer:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n \u2026<\/p>\n

Metodens essens ligger i anvendelsen af tilf\u00e6ldige data fra ASLR-adresse randomiseringsmekanismen (mmap_base) for at beskytte enkeltk\u00e6delister som Fast-Bins og TCache. F\u00f8r anvendelse p\u00e5 v\u00e6rdien af pegepinden til det n\u00e6ste element i listen udf\u00f8res der en masketransformation og en justeringskontrol i forhold til hukommelsessiden. Pegepinden erstattes med resultatet af operationen «(L >> PAGE_SHIFT) XOR (P)», hvor P er pegepindsv\u00e6rdien, og L er lokationen i hukommelsen, hvor denne pegepind opbevares.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Ved brug i systemet ASLR<\/a><\/noindex> (Address Space Layout Randomization) indeholder nogle bits i L med basisadressen for heap'en tilf\u00e6ldige v\u00e6rdier, der bruges som en n\u00f8gle til kodning af P (udtrukket ved en bitshift p\u00e5 12 for 4096-byte sider). En s\u00e5dan manipulation mindsker risikoen for, at pointeren bliver fanget i et exploit, da pointeren ikke opbevares i sin originale form, og for at erstatte den kr\u00e6ves det at kende information om, hvordan heap'en er placeret. Desuden indeholder patch-koden ogs\u00e5 en ekstra kontrol for blokjustering, hvilket forhindrer en angriber i at erstatte pointeren med en ikke-justeret v\u00e6rdi og kr\u00e6ver viden om antallet af bits, som justering er udf\u00f8rt, hvilket i 64-bit systemer yderligere muligg\u00f8r at blokere 15 ud af 16 angrebsfors\u00f8g, der ikke tager h\u00f8jde for justering.<\/p>\n

Metoden er effektiv til at beskytte mod angreb, hvor delvise overskrivninger af pointere anvendes (\u00e6ndring af laveste bytes), fuld overskrivning af pointere (omdirigering til angriberens kode) og \u00e6ndring af positionen af listen til en ikke-justeret adresse. Som eksempel er det vist, at anvendelsen af Safe-Linking i malloc ville kunne blokere for udnyttelse af nyligt opdaget<\/a><\/noindex> de samme forskere s\u00e5rbarheder CVE-2020-6007<\/a><\/noindex> i den smarte belysning Philips Hue Bridge, for\u00e5rsaget af buffer overflow og som tillader kontrol over enheden.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint har foresl\u00e5et en beskyttelsesteknik kaldet Safe-Linking, der komplicerer udnyttelsen af s\u00e5rbarheder | ProHoster","description":"Firmaet Checkpoint pr\u00e6senterede beskyttelsesmekanismen Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}