{"id":99982,"date":"2021-04-21T22:23:44","date_gmt":"2021-04-21T20:23:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej"},"modified":"2021-04-21T22:23:44","modified_gmt":"2021-04-21T20:23:44","slug":"universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej","title":{"rendered":"Minnesota \u00dclikool on Linuxi p\u00f5hijuurdep\u00e4\u00e4sust k\u00f5rvaldatu, saates kahtlaseid pat\u0161e.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Greg Kroah-Hartman, kes vastutab Linuxi tuuma stabiilse haru toetuse eest, otsustas keelata igasuguste muudatuste vastuv\u00f5tmise Linuxi tuumas Minnesotaa \u00dclikoolist ning tagasi v\u00f5tta k\u00f5ik varasemad aktsepteeritud plaastrid ja l\u00e4bi viia nende uuesti \u00fclevaatamise. Keeldumise p\u00f5hjuseks sai uurimisgrupp, kes uuris v\u00f5imalust varjatud haavatavuste edendamiseks avatud projektide koodis. Antud grupp saatis plaastrid, mis sisaldasid erinevaid vigu, j\u00e4lgis kogukonna reaktsioone ning uuris, kuidas petta muudatuste \u00fclevaatamise protsessi. Gregi arvates on selliste katsete l\u00e4biviimine pahatahtlike muudatuste integreerimiseks vastuv\u00f5etamatu ja ebaeetik. <\/p>\n

Blokeerimise p\u00f5hjus oli selle grupi liikmete saatud pat\u0161i saatmine, mis lisas n\u00e4idiku kontrolli, et v\u00e4ltida v\u00f5imalikke topeltk\u00f5nesid funktsioonile \u201efree\u201c. Arvestades n\u00e4idiku kasutuse konteksti, oli kontroll m\u00f5ttetu. Pat\u0161i saatmise eesm\u00e4rk oli uurida, kas vale muudatus l\u00e4bib tuumaarendajate l\u00e4bit\u00f6\u00f6tamise. Lisaks nimetatud pat\u0161ile on ilmnenud ka teisi katseid Minnesota \u00fclikooli arendajatelt kahtlaste muudatuste tegemiseks tuumas, sealhulgas seoses varjatud haavatavuste lisamisega. <\/p>\n

Patchide saatnud osaleja \u00fcritas \u00f5igustada, et katsetab uut staatilist anal\u00fcsaatorit ja muudatus oli ette valmistatud selle kontrolli tulemuste p\u00f5hjal. Kuid Greg juhib t\u00e4helepanu, et pakutud parandused ei ole t\u00fc\u00fcpilised staatiliste anal\u00fcsaatorite tuvastatud vigade jaoks ning k\u00f5ik saadetud pat\u0161id ei paranda midagi. Arvestades, et k\u00f5nealune teadlaste grupp on varem proovinud edendada parandusi, millel on varjatud haavatavused, on ilmne, et nad j\u00e4tkavad oma katsetusi kerni arendajate kogukonna \u00fcle. <\/p>\n

Huvitav on see, et varem osales katsetuste l\u00e4biviija juht legitiimsetes haavatavuste parandustes, n\u00e4iteks tuvastas ta teabe lekked USB-steki (CVE-2016-4482) ja v\u00f5rgu alams\u00fcsteemi (CVE-2016-4485). Varjatud haavatavuste edendamise uuringus toob Minnesota \u00fclikooli grupp v\u00e4lja haavatavuse CVE-2019-12819, mille p\u00f5hjustas 2014. aastal tuuma vastu v\u00f5etud parandamine. Parandamine lisas vea t\u00f6\u00f6tlemise plokki mdio_bus funktsiooni put_device kutsumise, kuid viis aastat hiljem selgus, et selline manipuleerimine viib m\u00e4lubloki juurde p\u00e4rast selle vabastamist (\u201euse-after-free\u201c). <\/p>\n

Sellegipoolest v\u00e4idavad uuringu autorid, et oma t\u00f6\u00f6s on nad generaliseerinud andmed 138 paranduse kohta, mis toovad kaasa vigu ja ei ole seotud uuringus osalejatega. Proovikiri oma vigadega paranduste saatmiseks piirdus ainult e-kirjadega ning sellised muudatused ei j\u00f5udnud Git'i (kui p\u00e4rast paranduse saatmist e-posti teel pidas haldaja parandust normaalseks, paluti tal mitte kaasata muudatust, kuna seal oli viga, p\u00e4rast mida saadeti \u00f5ige paranduse). <\/p>\n

Lisa 1: Autorite kritiseeritud paranduse aktiivsuse p\u00f5hjal saadab ta juba ammu pat\u0161e erinevatesse tuuma allk\u00fclgedesse. N\u00e4iteks on radeon ja nouveau draiverite jaoks hiljuti vastu v\u00f5etud muudatused, mis kutsuvad esile pm_runtime_put_autosuspend(dev->dev) veat\u00f6\u00f6tluse plokis, mis t\u00f5en\u00e4oliselt toob kaasa puhvri kasutamise p\u00e4rast tema seotud m\u00e4lust vabastamist. <\/p>\n

T\u00e4iendamine 2: Greg tagandas 190 kinnitust, mis olid seotud aadressidega \u201e@umn.edu\u201c ja k\u00e4ivitas nende kordusl\u00e4bit\u00f6\u00f6tamise. Probleem on see, et aadressidega \u201e@umn.edu\u201c osalejad mitte ainult ei katsetanud kahtlaste pat\u0161ide edendamist, vaid ka k\u00f5rvaldavad tegelikke haavatavusi, ja muudatuste tagasikr\u00fcptimine v\u00f5ib viia varem parandatud turvaprobleemide tagasitulekuni. M\u00f5ned hooldajad on juba uuesti kontrollinud t\u00fchistatud muudatusi ega leidnud probleeme, kuid \u00fcks hooldaja m\u00e4rkis, et \u00fches saadetud pat\u0161is olid vead.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0435\u0433 \u041a\u0440\u043e\u0430-\u0425\u0430\u0440\u0442\u043c\u0430\u043d (Greg Kroah-Hartman), \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0439 \u0437\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 \u044f\u0434\u0440\u0430 Linux, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u043f\u0440\u0438\u0451\u043c \u0432 \u044f\u0434\u0440\u043e Linux \u043b\u044e\u0431\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u0445 \u0438\u0437 \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041c\u0438\u043d\u043d\u0435\u0441\u043e\u0442\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043a\u0430\u0442\u0438\u0442\u044c \u0432\u0441\u0435 \u0440\u0430\u043d\u0435\u0435 \u043f\u0440\u0438\u043d\u044f\u0442\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0438\u0445 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0435 \u0440\u0435\u0446\u0435\u043d\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435. \u041f\u0440\u0438\u0447\u0438\u043d\u043e\u0439 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0442\u0430\u043b\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u044b, \u0438\u0437\u0443\u0447\u0430\u044e\u0449\u0435\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0423\u043a\u0430\u0437\u0430\u043d\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0430 \u043f\u0430\u0442\u0447\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99982","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Minnesota \u00dclikool on eemaldatud Linuxi tuuma arendusest kahtlaste pat\u0161ide saatmise t\u00f5ttu | ProHoster","description":"Greg Kroah-Hartman, kes vastutab Linuxi stabiilse haru toetamise eest, otsustas keelata k\u00f5ik muudatused, mis tulevad Minnesota \u00fclikoolist, ning t\u00fchistada k\u00f5ik juba tehtud muudatused.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442 \u041c\u0438\u043d\u043d\u0435\u0441\u043e\u0442\u044b \u043e\u0442\u0441\u0442\u0440\u0430\u043d\u0451\u043d \u043e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u044f\u0434\u0440\u0430 Linux \u0437\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 | ProHoster","og:description":"\u0413\u0440\u0435\u0433 \u041a\u0440\u043e\u0430-\u0425\u0430\u0440\u0442\u043c\u0430\u043d (Greg Kroah-Hartman), \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0439 \u0437\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 \u044f\u0434\u0440\u0430 Linux, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u043f\u0440\u0438\u0451\u043c \u0432 \u044f\u0434\u0440\u043e Linux \u043b\u044e\u0431\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u0445 \u0438\u0437 \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041c\u0438\u043d\u043d\u0435\u0441\u043e\u0442\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043a\u0430\u0442\u0438\u0442\u044c \u0432\u0441\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-21T20:23:44+00:00","article:modified_time":"2021-04-21T20:23:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99982","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-21 20:50:32","updated":"2022-09-30 11:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=99982"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99982\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=99982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=99982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=99982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}