{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint pakkus v\u00e4lja Safe-Linking kaitsetehnika, mis muudab haavatavuste kasutamise keerulisemaks.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Checkpoint ettev\u00f5te esitles<\/a><\/noindex> Safe-Linking kaitsemehhanism, mis muudab eksploitide loomise keerukamaks, m\u00f5jutades m\u00e4lu eraldamist malloc'i kutsumisel. Safe-Linking ei takista t\u00e4ielikult haavatavuste kasutamist, kuid minimaalse lisakulu korral muudab see m\u00e4rkimisv\u00e4\u00e4rselt keerulisemaks teatud t\u00fc\u00fcpi eksploitide loomise, kuna lisaks ekspluateeritud m\u00e4lu \u00fclet\u00e4itumisele tuleb leida veel \u00fcks haavatavus, mis paljastab kuhja (heap) asukoha andmed m\u00e4lus.<\/p>\n

Safe-Linking'i rakendamiseks ettevalmistatud plaastrid on saadaval Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) ja Google TCMalloc jaoks, samuti pakutakse neid Chrome'i kaitseuuendamiseks.
\nChromiumis on alates 2012. aastast juba olemas lahendus sarnase probleemi jaoks MaskPtr kaitsetehnika, kuid Checkpointi lahendus n\u00e4itab paremat j\u00f5udlust.
\nPakutud plaastrid on juba kinnitatud ja need avaldatakse augustikuu v\u00e4ljaandes Glibc 3.32<\/a><\/noindex> ning Safe-Linking'i rakendamine on vaikimisi sisse l\u00fclitatud. uClibc-NG-s on Safe-Linking tuli<\/a><\/noindex> kaasa arvatud versioonis 1.0.33 ja sisaldub vaikes\u00e4tetes. gperftools (vana tcmalloc) muudatused on v\u00f5etud<\/a><\/noindex>, kuid need pakutakse \u00fche j\u00e4rgmise v\u00e4ljaande valikuna. <\/p>\n

Arendajad TCMalloc<\/a><\/noindex> (uus tcmalloc) on keeldunud nende vastuv\u00f5tmisest, muudatus<\/a><\/noindex>, viidates j\u00f5udluse t\u00f5sisele langusele ja vajadusele lisada ulatuslikud testid, et regulaarselt kontrollida, kas k\u00f5ik t\u00f6\u00f6tab \u00f5igesti. Checkpointi inseneride testimine n\u00e4itas, et Safe-Linking meetod ei p\u00f5hjusta m\u00e4lukulu suurenemist ning keskmine j\u00f5udluse langus hunnikuga t\u00f6\u00f6tamise ajal on vaid 0,02%, halvimatel juhtudel aga 1,5% (v\u00f5rdluseks on Chromiumis kasutatava meetodi kulu hinnatud v\u00e4hem kui 2%). Kaasamine
\nt\u00e4hendab 2-3 t\u00e4iendava assembleri k\u00e4su t\u00e4itmist iga free() kutsumise korral ja 3-4 k\u00e4su t\u00e4itmist malloc() kutsumise korral. Algusfaaside k\u00e4ivitamine ja juhuslike v\u00e4\u00e4rtuste genereerimine ei ole vajalik.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking ei ole m\u00f5eldud ainult erinevate heap'i realizatsioonide turvalisuse parandamiseks, vaid ka andmestruktuuride terviklikkuse kontrollimiseks, kus kasutatakse \u00fchel linksed viiteid, mis asuvad vahetult ise buffer'ite k\u00f5rval. Meetod on rakendamisel v\u00e4ga lihtne ja n\u00f5uab vaid \u00fche makro lisamist ja selle rakendamist j\u00e4rgmise ploki viidete koodis (n\u00e4iteks Glibci jaoks muudetakse<\/a><\/noindex> aitab vaid m\u00f5nda rida koodis). Meetod koosneb j\u00e4rgmistest muudatustest:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n …<\/p>\n

Meetodi tuum on juhuslike andmete rakendamine ASLR-i aadresside randomiseerimise mehhanismist (mmap_base) \u00fchekordsete linkide, nagu Fast-Bins ja TCache, kaitsmiseks. Enne viitamist j\u00e4rgmise elemendi n\u00e4itaja v\u00e4\u00e4rtusele nimekirjas tehakse maskimise teisendus ja kontrollitakse m\u00e4lulehe piiri j\u00e4rgi joondumist. N\u00e4itaja asendatakse operatsiooni tulemusega '(L >> PAGE_SHIFT) XOR (P)', kus P on n\u00e4itaja v\u00e4\u00e4rtus ja L on m\u00e4lukoht, kus see n\u00e4itaja asub.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

S\u00fcsteemi kasutamisel ASLR<\/a><\/noindex> (Address Space Layout Randomization) m\u00f5ned L bitid heap'i p\u00f5hiaadressiga sisaldavad juhuslikke v\u00e4\u00e4rtusi, mida kasutatakse P kodeerimise v\u00f5tmena (eraldatakse 12-bitise nihke abil 4096-baidiste lehtede jaoks). Selline manipuleerimine v\u00e4hendab viidete haaramise riski exploite, kuna viidet ei hoita algses vormis ja selle asendamiseks on vajalik teada heap'i asetust. Lisaks sisaldab pat\u0161i koodis ka t\u00e4iendavat blooki joondamise kontrolli, mis ei v\u00f5imalda r\u00fcndajal viidet asendada joondamata v\u00e4\u00e4rtusega ja n\u00f5uab teadmisi selle joondamise kohta, mille t\u00f5ttu 64-bitistes s\u00fcsteemides saab blokeerida 15 16-st r\u00fcnnakust, mis ei arvestanud joondamist.<\/p>\n

Meetod on efektiivne r\u00fcnnakute kaitsmiseks, kus kasutatakse viidete osalist \u00fcmberkirjutamist (madalamate baitide muutmine), t\u00e4ielikku viidete \u00fcmberkirjutamist (suunamine r\u00fcndaja koodi) ja loendi asukoha muutmist joondamata aadressil. N\u00e4iteks on n\u00e4idatud, et Safe-Linking rakendamine malloc'is oleks v\u00f5imaldanud hiljutise ekspluateeringu blokeerida. mis tuvastati<\/a><\/noindex> sama uurijate haavatavused CVE-2020-6007<\/a><\/noindex> Philips Hue Bridge'i nutika valgustuse puhul, mille p\u00f5hjustas puhverdus\u00fclekanne ja mis v\u00f5imaldab seadme \u00fcle kontrolli saada.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint esitas kaitsemeetodi Safe-Linking, mis muudab haavatavuste kasutamise keerulisemaks | ProHoster","description":"Ettev\u00f5te Checkpoint tutvustas kaitsemehhanismi Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}