{"id":116387,"date":"2024-06-06T15:39:51","date_gmt":"2024-06-06T13:39:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9"},"modified":"2024-06-06T15:39:51","modified_gmt":"2024-06-06T13:39:51","slug":"uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","title":{"rendered":"Haavatavus AV1 ja VP8\/VP9 koodekites standardsetes rakendustes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

AOMedia (Open Media Alliance) arenduses paiknevas libaom teegis, mis pakub AV1 video kodeerimise formaadi standardset teostust, avastati kriitiline haavatavus (CVE-2024-5171), mis toob kaasa t\u00e4isarvu \u00fclevoolu ja m\u00e4lupiirkonna kirjutamise, kui t\u00f6\u00f6deldakse teatud parameetrite liiga suuri v\u00e4\u00e4rtusi. Sarnane haavatavus (CVE-2024-5197) leiti libvpx teegis, mis teostab VP8 ja VP9 koodekeid. Probleemid on lahendatud libaom versioonis 3.9.0 ja libvpx versioonis 1.14.1. Jaotustes j\u00e4\u00e4vad haavatavused siiski parandamata (Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD). <\/p>\n

Libaomis m\u00e4\u00e4rati haavatustele maksimaalne ohtlikkuse tase (10\/10), mis t\u00e4histab v\u00f5imalust \u00e4rakasutamiseks rakendustes, mis kasutavad seda teeki, spetsiaalselt kujundatud sisu t\u00f6\u00f6tlemisel. Libvpx ohtlikkuse tase on 5.9\/10, mis vastab piiratud \u00e4rakasutamise tingimustele. Libaomi ja libvpx haavatavuste peamine oht tuleneb sellest, et neid teeke kasutatakse veebibrauserites, meediam\u00e4ngijates ja teenustes, mis teostavad video kodeerimist. <\/p>\n

Libaomi haavatavus ilmneb funktsioonide aom_img_alloc(), aom_img_wrap() v\u00f5i aom_img_alloc_with_border() kutsumisel, kui parameetrites d_w, d_h ja align on suured v\u00e4\u00e4rtused, mis p\u00f5hjustavad t\u00e4isarvu \u00fclevoolu, kui arvutatakse nihkeid ja puut\u00fckke. Sarnane \u00fclevool toimub funktsioonides vpx_img_alloc() ja vpx_img_wrap(). Nimetatud funktsioone kasutatakse video kodeerimisel. <\/p>\n

Haavatavus on k\u00f5ige ohtlikum, kuna tekib potentsiaalne r\u00fcnnaku v\u00f5imalus brauserites, kus varasemad sarnased haavatavused v\u00f5isid olla \u00e4ra kasutatud spetsiaalselt kujundatud lehe avamise kaudu, mis kutsus esile JavaScripti funktsioone video kodeerimiseks, v\u00f5i WebRTC manipuleerimise kaudu. Google'i esindajate s\u00f5nul ei m\u00f5juta haavatavus Chromiumi mootorit, kuna funktsioonides aom_img_alloc(), aom_img_wrap(), vpx_img_alloc() ja vpx_img_wrap() edastati ainult kontrollitud argumendi d_w ja d_h v\u00e4\u00e4rtused. Firefoxis kasutatakse AV1 dekodeerimiseks teeki dav1d, kuid kodeerimiseks kasutatakse libaomi. Kas Firefox on probleemi suhtes haavatav, pole veel selge, kuna teave selle kohta, kuidas haavatavus konkreetselt tooteid m\u00f5jutab, ei ole veel avalikustatud.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c Open Media (AOMedia) \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libaom, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0434\u0435\u043e AV1, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5171), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u0432\u043d\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445. \u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5197) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libvpx \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0435\u043a\u043e\u0432 VP8 \u0438 VP9. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116387","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Turvaauk AV1 ja VP8\/VP9 kodeerimise viidatud teostustes | ProHoster","description":"Open Media (AOMedia) arendatava libaom teegis, mis pakub AV1 video kodeerimise formaadi viidatud teostust, tuvastati kriitiline turvaauk (CVE-2024-5171), mis p\u00f5hjustab \u00fcksteisega seonduvat probleemikohalikku.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043a\u043e\u0434\u0435\u043a\u043e\u0432 AV1 \u0438 VP8\/VP9 | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c Open Media (AOMedia) \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libaom, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0434\u0435\u043e AV1, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5171), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-06T13:39:51+00:00","article:modified_time":"2024-06-06T13:39:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116387","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 01:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 01:52:19","updated":"2026-01-23 01:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=116387"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116387\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=116387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=116387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=116387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}