{"id":34721,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","title":{"rendered":"Plans pour renforcer le m\u00e9canisme de protection W^X dans OpenBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Theo De Raadt <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-tech&#038;m=155899373514678&#038;w=2\">partag\u00e9<\/a><\/noindex> des projets visant \u00e0 renforcer le m\u00e9canisme de protection de la m\u00e9moire W^X (Write XOR Execute). L'id\u00e9e du m\u00e9canisme est que les pages de m\u00e9moire d'un processus ne peuvent pas \u00eatre accessibles simultan\u00e9ment en \u00e9criture et en ex\u00e9cution. Ainsi, le code ne peut \u00eatre ex\u00e9cut\u00e9 qu'apr\u00e8s l'interdiction de l'\u00e9criture, et l'\u00e9criture dans une page de m\u00e9moire est possible uniquement apr\u00e8s l'interdiction de l'ex\u00e9cution. Le m\u00e9canisme W^X aide \u00e0 prot\u00e9ger les applications dans l'espace utilisateur contre des attaques typiques r\u00e9alis\u00e9es par d\u00e9bordement de tampon, y compris contre les d\u00e9bordements de pile et est actif dans OpenBSD. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44506\">par d\u00e9faut<\/a><\/noindex>.<\/p>\n<p>D\u00e8s le d\u00e9but des travaux sur W^X, il \u00e9tait \u00e9vident que c'\u00e9tait un long chemin, car il existe un nombre significatif d'applications utilisant JIT. Les impl\u00e9mentations JIT peuvent \u00eatre class\u00e9es en trois cat\u00e9gories :<\/p>\n<ul>\n<li class=\"l\"> La commutation de la m\u00e9moire entre les \u00e9tats W et X, en acceptant le \u00ab co\u00fbt \u00bb de l'appel syst\u00e8me. <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/mprotect.2\">mprotect<\/a><\/noindex>.\n<li class=\"l\"> Cr\u00e9ant des alias entre les paires d'affichages W et X d'une m\u00eame m\u00e9moire.\n<li class=\"l\"> La variante la plus \u00ab sale \u00bb \u2014 des mod\u00e8les de m\u00e9moire W|X, permettant l'\u00e9criture et l'ex\u00e9cution simultan\u00e9es.\n<\/ul>\n<p>Actuellement, il y a beaucoup moins de programmes utilisant la troisi\u00e8me variante et davantage utilisant la premi\u00e8re et la deuxi\u00e8me. Cependant, \u00e9tant donn\u00e9 qu'il \u00e9tait n\u00e9cessaire de faire fonctionner des programmes avec W|X JIT (principalement Chromium et Iridum), une option de montage de syst\u00e8me de fichiers \u00ab wxallowed \u00bb a \u00e9t\u00e9 ajout\u00e9e, permettant d'utiliser la m\u00e9moire \u00e0 la fois pour l'\u00e9criture et l'ex\u00e9cution, si le fichier ELF ex\u00e9cutable est marqu\u00e9 avec le tag \u00ab wxneeded \u00bb, et les applications elles-m\u00eames sont \u00e9galement prot\u00e9g\u00e9es en utilisant des m\u00e9canismes. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43295\">pledge<\/a><\/noindex> et <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49042\">unveil<\/a><\/noindex> pour restreindre la liste des appels syst\u00e8me utilis\u00e9s et des parties du syst\u00e8me de fichiers accessibles \u00e0 l'application.<\/p>\n<p>Pour compliquer encore davantage l'exploitation des vuln\u00e9rabilit\u00e9s dans de telles applications, un compl\u00e9ment au m\u00e9canisme <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48243\">MAP_STACK<\/a><\/noindex>, qui v\u00e9rifie si l'appel syst\u00e8me est effectu\u00e9 \u00e0 partir d'une page de m\u00e9moire accessible en \u00e9criture. Si la page est accessible en \u00e9criture, le processus est forc\u00e9 de se terminer. Ainsi, un attaquant ne pourra pas utiliser les appels syst\u00e8me et sera contraint d'essayer de trouver les gadgets n\u00e9cessaires dans l'impl\u00e9mentation JIT ou m\u00eame de faire un travail beaucoup plus difficile pour d\u00e9couvrir des ustensiles d'appels syst\u00e8me directement \u00e0 l'int\u00e9rieur de <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44320\">la libc al\u00e9atoirement li\u00e9e.<\/a><\/noindex>. <\/p>\n<p>Les processus Chrome\/Iridium sont d\u00e9j\u00e0 assez bien prot\u00e9g\u00e9s gr\u00e2ce \u00e0 pledge et unveil, mais interdire l'utilisation d'appels syst\u00e8me comme write(2) pr\u00e9sente des avantages, car cela complique la t\u00e2che de l'attaquant. Cependant, des difficult\u00e9s peuvent \u00e9galement survenir si la mise en \u0153uvre JIT utilise des appels syst\u00e8me natifs \u00e0 partir de m\u00e9moire W|X. Il y a n\u00e9anmoins des raisons d'esp\u00e9rer que cela ne posera pas de probl\u00e8me, car l'ABI a chang\u00e9 plusieurs fois, mais personne n'a jamais signal\u00e9 de probl\u00e8mes.<\/p>\n<p>Les modifications sont d\u00e9j\u00e0 disponibles dans les instantan\u00e9s r\u00e9guliers de la branche OpenBSD-CURRENT, tous ceux qui sont int\u00e9ress\u00e9s sont invit\u00e9s \u00e0 tester.<\/p>\n<p>Theo a jug\u00e9 n\u00e9cessaire de commenter des nouvelles connexes concernant l'introduction d'un mode dans Chrome\/Iridium. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50559\">JITless<\/a><\/noindex>De son point de vue, cela est acceptable pour certains cas d'utilisation, mais probablement pas pour tous, car ce mode augmentera clairement la charge sur le processeur. Actuellement, Chrome fonctionnera principalement si \u00ab wxallowed \u00bb est d\u00e9sactiv\u00e9 pour \/usr\/local, bien que des probl\u00e8mes avec certaines extensions soient probables (par exemple, ghostery). Quoi qu'il en soit, Theo esp\u00e8re que le fonctionnement complet en mode JITless sera op\u00e9rationnel dans un avenir proche.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50763\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute). \u0421\u0443\u0442\u044c \u043c\u0435\u0445\u043d\u0438\u0437\u043c\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0438\u0441\u0438, \u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c W^X \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34721","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Plans d'am\u00e9lioration du m\u00e9canisme de protection W^X dans OpenBSD | ProHoster","description":"Theo De Raadt a partag\u00e9 ses projets d'am\u00e9lioration du m\u00e9canisme de protection de la m\u00e9moire W^X (Write XOR Execute).","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043b\u0430\u043d\u044b \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b W^X \u0432 OpenBSD | ProHoster","og:description":"\u0422\u0435\u043e \u0414\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043f\u043b\u0430\u043d\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0430\u043c\u044f\u0442\u0438 W^X (Write XOR Execute).","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/plany-po-usileniyu-mehanizma-zashhity-w-x-v-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34721","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/34721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=34721"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/34721\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=34721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=34721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=34721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}