{"id":71652,"date":"2020-02-27T08:51:34","date_gmt":"2020-02-27T05:51:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8"},"modified":"2020-03-03T16:10:40","modified_gmt":"2020-03-03T13:10:40","slug":"0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","title":{"rendered":"0-p\u00e4eva haavatavus Chromes, mis tuvastati V8 mootori muudatuste anal\u00fc\u00fcsi k\u00e4igus","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Exodus Intelligence'i teadlased demonstratsioon<\/a><\/noindex> on tuvastanud n\u00f5rkuse Chrome'i\/Chromiumi koodibaasi haavatavuste parandamise protsessis. Probleem on selles, et Google avaldab teavet selle kohta, et tehtud parandused on seotud turvaaukudega ainult p\u00e4rast v\u00e4ljalaskmist, kuid
\nlisab reposse koodi, et k\u00f5rvaldada haavatavus V8 mootori puhul enne v\u00e4ljalaske tegemist. M\u00f5nda aega k\u00e4ivad parandused testimisel ja tekib aken, mil haavatavus on koodibaasis parandatud ja anal\u00fc\u00fcsitav, kuid haavatavus j\u00e4\u00e4b endiselt kasutajate s\u00fcsteemides parandamata. <\/p>\n

Uuringute k\u00e4igus, mis on seotud reposse tehtud muudatustega, p\u00f6\u00f6rasid teadlased t\u00e4helepanu 19. veebruaril lisatud parandust<\/a><\/noindex> ja kolme p\u00e4eva jooksul suudeti ette valmistada eksploit<\/a><\/noindex>, mis r\u00fcndab praeguseid Chrome'i v\u00e4ljalaskeid (avalikustatud eksploit ei sisaldanud komponente sandbox-keepebisusest m\u00f6\u00f6da minemiseks). Google korraldas kiiresti v\u00e4lja andnud<\/a><\/noindex> Chrome'i uuenduse 80.0.3987.122, k\u00f5rvaldades seosed esitatud eksploitiga haavatavus<\/a><\/noindex> (CVE-2020-6418). Haavatavus tuvastati algselt Google'i inseneride poolt ja see oli tingitud t\u00fc\u00fcpide t\u00f6\u00f6tlemise probleemist JSCreate operatsioonis, mida saab kasutada Array.pop v\u00f5i Array.prototype.pop meetodi kaudu. M\u00e4rkimisv\u00e4\u00e4rne on, et sarnane probleem oli parandatud<\/a><\/noindex> Firefoxis eelmise suve jooksul.<\/p>\n

Teadlased m\u00e4rkisid ka, et eksploitide loomine on lihtsustunud t\u00e4nu Chrome 80<\/a><\/noindex> mehhanismi p\u00f6idla pakendamise<\/a><\/noindex> (ainult unikaalsed alumised bitid osutist salvestatakse, mis v\u00f5imaldab oluliselt v\u00e4hendada m\u00e4lu tarbimist virnas). N\u00e4iteks m\u00f5ned virna alguses olevad andmestruktuurid, nagu sisseehitatud funktsioonide tabel, «native context» objektid ja j\u00e4\u00e4tme kogumise<\/a><\/noindex> juureobjektid, asuvad n\u00fc\u00fcd ennustatavates ja kirjutatavates pakendatud aadressides.<\/p>\n

Huvitav on, et peaaegu aasta tagasi n\u00e4itas Exodus Intelligence sarnast<\/a><\/noindex> demonstreerimist eksploitide loomise v\u00f5imalusest, anal\u00fc\u00fcsides V8 avalikku paranduste logi, kuid tundub, et kohaseid j\u00e4reldusi ei tehtud. Exodus Intelligence'i teadlaste positsioonil v\u00f5iksid olla kurjategijad v\u00f5i riiklikud teenistused, kellel oleks v\u00f5imalus p\u00e4evade v\u00f5i isegi n\u00e4dalate jooksul varjatud kasutusele v\u00f5tta haavatavus enne j\u00e4rgmise Chrome'i versiooni v\u00e4ljalaskmist.
\nExodus Intelligence v\u00f5ib olla r\u00e4mpspost v\u00f5i salateenistused, kes eksploiteerisid haavatavust p\u00e4evade v\u00f5i isegi n\u00e4dalate jooksul enne j\u00e4rgmise Chrome'i versiooni v\u00e4ljaandmist. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Exodus Intelligence \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043b\u0430\u0431\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 Chrome\/Chromium. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e Google \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u0432\u043d\u0435\u0441\u0451\u043d\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u044e\u0442 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0440\u0435\u043b\u0438\u0437\u0430, \u043d\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 V8 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u0430. \u041a\u0430\u043a\u043e\u0435-\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71652","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd470-p\u00e4evane haavatavus Chrome'is, avastatud V8 mootori muudatuste anal\u00fc\u00fcsimise kaudu | ProHoster","description":"Exodus Intelligence'i teadlased demonstreerisid kergesti parendatavust protsessis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd470-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Chrome, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u0430\u043d\u0430\u043b\u0438\u0437 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 V8 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Exodus Intelligence \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043b\u0430\u0431\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-27T05:51:34+00:00","article:modified_time":"2020-03-03T13:10:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:58:25","updated":"2022-10-01 14:35:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/71652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=71652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/71652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=71652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=71652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=71652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}