{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint pakkus v\u00e4lja Safe-Linking kaitsetehnika, mis raskendab haavatavuste \u00e4rakasutamist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Checkpointi ettev\u00f5te esituse<\/a><\/noindex> Safe-Linking kaitsemehhanism, mis raskendab eksploitide loomist, mis manipuleerivad malloc-i kutsumise k\u00e4igus eraldatud puhvrite aadresside m\u00e4\u00e4ratlemise v\u00f5i muutmisega. Safe-Linking ei blokeeri t\u00e4ielikult haavatavuste ekspluateerimise v\u00f5imalust, kuid minimaalsete k\u00e4sitsikandmise kuludega muudab teatud kategooriate eksploitide loomise oluliselt keerulisemaks, kuna lisaks eksploateeritavale puhvri \u00fclevoolule tuleb leida veel \u00fcks haavatavus, mis p\u00f5hjustab m\u00e4lu sirgjoone lekke (heap).<\/p>\n

Safe-Linkingut rakendavaid plaastrid on valmistatud Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) ja Google TCMalloc jaoks ning on ette pandud kaitsestrateegia t\u00e4iustamiseks Chromiumis (
\nChromiumis on alates 2012. aastast juba sisse ehitatud sama probleemi lahendamise tehnika MaskPtr, kuid Checkpointi lahendus n\u00e4itab suuremat j\u00f5udlust).
\nPakutud plaastrid on juba heaks kiidetud k\u00e4esoleva aasta augusti v\u00e4ljaandele Glibc 3.32<\/a><\/noindex> ja Safe-Linking rakendamine lisatakse vaikeseadetena. Uuendatud toetas uClibc-NG on<\/a><\/noindex> v\u00e4ljaande 1.0.33 koos vaikeseadete aktiveerimisega. gperftools (vana tcmalloc) muudatused on vastu v\u00f5etud<\/a><\/noindex>, kuid need pakutakse tulevastes v\u00e4ljaannetes valikuna. <\/p>\n

Arendajad TCMalloc<\/a><\/noindex> (uus tcmalloc) ei ole vastu v\u00f5etud muudatus<\/a><\/noindex>, viidates t\u00f5sisele j\u00f5udluse langusele ja vajadusele lisada t\u00e4iendavaid teste regulaarselt kontrollimiseks, et k\u00f5ik t\u00f6\u00f6tab korralikult. Checkpointi inseneride testimine n\u00e4itas, et Safe-Linking meetod ei too kaasa t\u00e4iendavaid m\u00e4lu kulusid, ning j\u00f5udlus m\u00e4lu operaatorite t\u00e4itmisel v\u00e4heneb keskmiselt vaid 0,02%, halvimatel juhtudel kuni 1,5% (v\u00f5rdluseks, Chromiumi kasutatavaid meetodite kulusid hinnatakse kui \u201ealla 2%\u201d). L\u00fclitamine
\nSafe-Linking toob kaasa 2-3 t\u00e4iendava assembleri k\u00e4su t\u00e4itmise iga free() v\u00e4ljakutse korral ja 3-4 k\u00e4su malloc() v\u00e4ljakutse korral. Algatamise ja juhuslike v\u00e4\u00e4rtuste genereerimise etappide k\u00e4ivitamine pole vajalik.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking saab kasutada mitte ainult erinevate kuhjade (heap) turvalisuse suurendamiseks, vaid ka terviklikkuse kontrollimise vahendite lisamiseks mis tahes and structures, kus kasutatakse \u00fchekettalisi osutite loendeid, mis asuvad vahetult buffere k\u00f5rval. Meetod on v\u00e4ga lihtne rakendada ja n\u00f5uab vaid \u00fche makro lisamist ja selle rakendamist j\u00e4rgmise ploki osutitele koodis (n\u00e4iteks Glibci jaoks. muudetakse<\/a><\/noindex> vaid m\u00f5ned read koodis). Meetod p\u00f5hineb j\u00e4rgmistel muudatustel:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n …<\/p>\n

Meetodi p\u00f5hiolemus seisneb ASLR (mmap_base) aadressi randomiseerimise mehhanismi juhuslike andmete rakendamises \u00fcksikute linkide loendite, nagu Fast-Bins ja TCache, kaitsmiseks. Enne j\u00e4rgmisel loendi elemendil viitava n\u00e4itaja v\u00e4\u00e4rtusele rakendamist viiakse l\u00e4bi maskeerimisoperatsioon ja m\u00e4lulehe piiri joondamise kontroll. N\u00e4itaja asendatakse operatsiooni tulemusega \u201e(L >> PAGE_SHIFT) XOR (P)\u201d, kus P on n\u00e4itaja v\u00e4\u00e4rtus ja L on m\u00e4lukoht, kus see n\u00e4itaja asub.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

S\u00fcsteemis kasutamisel ASLR<\/a><\/noindex> (Address Space Layout Randomization) bitide L p\u00f5hiv\u00e4\u00e4rtuse kuhja aadress sisaldab juhuslikke v\u00e4\u00e4rtusi, mida kasutatakse P kodeerimise v\u00f5tmena (saadakse 12-bitise nihkeoperatsiooni abil 4096-baidiste lehek\u00fclgede jaoks). Sarnane manipuleerimine v\u00e4hendab pointeri haaramise riski ekspluateerimises, kuna pointeri ei salvestata algses vormis ning selle asendamiseks on vajalik teada kuhja paiknemise teavet. Lisaks on plaastrikoodis olemas ka t\u00e4iendav ploki joondamise kontroll, mis ei luba r\u00fcndajal asendada pointerit joondamata v\u00e4\u00e4rtusega ja n\u00f5uab teadmisi selle kohta, kui palju bite on joondamiseks kasutatud, mis 64-bitistel s\u00fcsteemidel veelgi takistab 15 16-st r\u00fcnnaku katset, mis ei arvestanud joondamist.<\/p>\n

Meetod on t\u00f5hus kaitse meetodite vastu, kus kasutatakse pointerite osalist \u00fclekirjutamist (madalamate baitide muutmine), pointerite t\u00e4ielikku \u00fcmberkirjutamist (suunamine r\u00fcndaja koodile) ja positsiooni vahetamist joondamata aadressil. N\u00e4iteks on n\u00e4idatud, et Safe-Linking rakendamine malloc'is v\u00f5imaldaks blokeerida hiljuti ekspluateerimist. mis tuvastati<\/a><\/noindex> samade uurijate haavatavus CVE-2020-6007<\/a><\/noindex> Philips Hue Bridge'i nutikas valguses, mis on p\u00f5hjustatud puhvri \u00fclet\u00e4itumisest ja v\u00f5imaldab seadme kontrolli alla saada.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint pakkus Safe-Linking kaitsetehnikat, mis keerulisemaks muudab haavatavuste \u00e4rakasutamist | ProHoster","description":"Ettev\u00f5te Checkpoint tutvustas kaitsemehhanismi Safe-Linking, mis muudab eksploiteerimise keerulisemaks, manipuleerides puhvritele viitamise m\u00e4\u00e4ratlemise v\u00f5i muutmisega, mis on eraldatud malloc'i v\u00e4ljakutse t\u00e4itmise ajal. Safe-Linking ei blokeeri t\u00e4ielikult haavatavuste \u00e4rakasutamise v\u00f5imalust, kuid minimaalsete kuludega muudab teatud kategooriate eksploiteerimise loomise oluliselt keerulisemaks, kuna lisaks puhvri \u00fclet\u00e4itumisele tuleb leida veel \u00fcks haavatavus, mis p\u00f5hjustab andmete lekke.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}