{"id":83016,"date":"2020-05-27T19:41:58","date_gmt":"2020-05-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket"},"modified":"2020-05-27T19:41:58","modified_gmt":"2020-05-27T17:41:58","slug":"25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","title":{"rendered":"25 s\u00e5rbarheder i RTOS Zephyr, herunder s\u00e5rbarheder udnyttet via ICMP-pakker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra NCC Group har offentliggjort<\/a><\/noindex> resultaterne af revisionen af det frie projekt Zephyr<\/a><\/noindex>, udvikling<\/a><\/noindex> operativsystemer i realtid (RTOS), der er designet til at udstyre enheder, der passer til konceptet 'Internet of Things' (IoT). Under audit blev det identificeret 25 s\u00e5rbarheder<\/a><\/noindex> i Zephyr og 1 s\u00e5rbarhed i MCUboot. Udviklingen af Zephyr foreg\u00e5r med deltagelse af virksomhederne Intel. <\/p>\n

I alt blev der identificeret 6 s\u00e5rbarheder i netv\u00e6rksstakken, 4 i kernen, 2 i kommandolinjen, 5 i h\u00e5ndteringen af systemopkald, 5 i USB-undersystemet og 3 i firmwareopdateringsmekanismen. To af problemerne blev klassificeret som kritiske, to som h\u00f8je, 9 som moderate, 9 som lave og 4 som til overvejelse. De kritiske problemer p\u00e5virker IPv4-stakken og MQTT-parseren, de farlige involverer USB-mass storage og USB DFU-drivere. P\u00e5 tidspunktet for oplysningen var der kun blevet forberedt rettelser til de 15 mest farlige s\u00e5rbarheder, mens problemerne, der f\u00f8rer til serviceafbrydelser eller relateres til mangler i kernens yderligere beskyttelsesmekanismer, endnu ikke var l\u00f8st.<\/p>\n

I IPv4-stakken p\u00e5 platformen blev der identificeret en fjernudnyttelig s\u00e5rbarhed, som kan for\u00e5rsage hukommelsesskader ved behandling af specielt modificerede ICMP-pakker. Et andet alvorligt problem blev fundet i MQTT-protokolens parser, som skyldes manglende korrekt l\u00e6ngdekontrol af felter i overskriften og kan f\u00f8re til fjernudf\u00f8relse af kode. Mindre farlige problemer, der f\u00f8rer til serviceafbrydelser, er blevet fundet i IPv6-stakken og implementeringen af CoAP-protokollen.<\/p>\n

De resterende problemer kan udnyttes lokalt til at for\u00e5rsage serviceafbrydelser eller udf\u00f8relse af kode p\u00e5 kernniveau. Mange af disse s\u00e5rbarheder er relateret til manglende passende kontrol af argumenterne for systemopkald, og kan f\u00f8re til skrivning og l\u00e6sning af vilk\u00e5rlige omr\u00e5der i kernen. Problemerne omfatter ogs\u00e5 selve koden til h\u00e5ndtering af systemopkald - adgang ved hj\u00e6lp af et negativt systemopkaldsnummer f\u00f8rer til integer overflow. I kernen er der ogs\u00e5 fundet problemer i implementeringen af ASLR-beskyttelsen (Address Space Layout Randomization) og mekanismen til at s\u00e6tte kanariefugle i stakken, hvilket g\u00f8r disse mekanismer ineffektive. <\/p>\n

Mange problemer p\u00e5virker USB-stakken og enkelte drivere. For eksempel tillader et problem med USB-masselagring, at der kan opst\u00e5 buffer overflow, hvilket kan udf\u00f8re kode p\u00e5 kerne niveau, n\u00e5r en enhed tilsluttes en USB-v\u00e6rt kontrolleret af en angriber. S\u00e5rbarheden i USB DFU, driveren til opdatering af ny firmware via USB, muligg\u00f8r indl\u00e6sning af et modificeret firmwarebillede i den interne Flash-mikrocontroller uden brug af kryptering og omg\u00e5else af den beskyttede opstartstilstand, der kontrollerer komponenter gennem digitale signaturer. Derudover blev koden fra den \u00e5bne bootloader unders\u00f8gt. MCUboot<\/a><\/noindex>, hvor \u00e9n ukritisk s\u00e5rbarhed blev fundet,
\nsom kan f\u00f8re til buffer overflow ved brug af SMP (Simple Management Protocol) via UART.<\/p>\n

Vi minder om, at i Zephyr for alle processer er der kun \u00e9t globalt delt virtuelt adresserum (SASOS, Single Address Space Operating System). Applikationsspecifik kode kombineres med en tilpasset kerne og danner en monolitisk eksekverbar fil til indl\u00e6sning og k\u00f8rsel p\u00e5 et bestemt udstyr. Alle systemressourcer defineres i kompileringsfasen, hvilket reducerer st\u00f8rrelsen af koden og \u00f8ger ydeevnen. Kun de kernefunktioner, der kr\u00e6ves for at k\u00f8re applikationen, kan inkluderes i systembilledet.<\/p>\n

Det er bem\u00e6rkelsesv\u00e6rdigt, at blandt de vigtigste fordele ved Zephyr n\u00e6vnes<\/a><\/noindex> er udvikling med fokus p\u00e5 sikkerhed. Det h\u00e6vdes<\/a><\/noindex>, at alle udviklingsfaser gennemg\u00e5r obligatoriske sikkerhedsgodkendelsestrin: fuzzing-test, statisk analyse, penetrationstest, kodegennemgang, analyse af bagd\u00f8rsimplementeringer og trusselsmodellering.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Zephyr, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (RTOS), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 «\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0432\u0435\u0449\u0435\u0439» (IoT, Internet of Things). \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 25 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Zephyr \u0438 1 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MCUboot. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 Zephyr \u0432\u0435\u0434\u0451\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intel. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83016","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4725 s\u00e5rbarheder i RTOS Zephyr, herunder udnyttelige via ICMP-pakke | ProHoster","description":"Forskere fra NCC Group har offentliggjort resultaterne af en revision.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4725 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 RTOS Zephyr, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 ICMP-\u043f\u0430\u043a\u0435\u0442 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T17:41:58+00:00","article:modified_time":"2020-05-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83016","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:51:14","updated":"2022-10-02 09:38:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/83016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=83016"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/83016\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=83016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=83016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=83016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}