{"id":82556,"date":"2020-05-22T19:41:55","date_gmt":"2020-05-22T17:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc"},"modified":"2020-05-22T19:41:55","modified_gmt":"2020-05-22T17:41:55","slug":"kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","title":{"rendered":"Une vuln\u00e9rabilit\u00e9 critique dans l'impl\u00e9mentation de la fonction memcpy pour ARMv7 dans Glibc","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des chercheurs en s\u00e9curit\u00e9 de Cisco ont r\u00e9v\u00e9l\u00e9<\/a><\/noindex> d\u00e9tails une vuln\u00e9rabilit\u00e9<\/a><\/noindex> (CVE-2020-6096<\/a><\/noindex>) dans l\u2019impl\u00e9mentation de la fonction memcpy() fournie dans Glibc pour la plateforme ARMv7 32 bits. Le probl\u00e8me est caus\u00e9 par un traitement incorrect des valeurs n\u00e9gatives du param\u00e8tre d\u00e9finissant la taille de la zone copi\u00e9e, d\u00fb \u00e0 l'utilisation d'optimisations en assembleur manipulant des entiers sign\u00e9s de 32 bits. L'appel de memcpy() sur des syst\u00e8mes ARMv7 avec une taille n\u00e9gative entra\u00eene une comparaison incorrecte des valeurs et une \u00e9criture en dehors des limites du tampon sp\u00e9cifi\u00e9.<\/p>\n

La vuln\u00e9rabilit\u00e9 peut \u00eatre exploit\u00e9e pour ex\u00e9cuter du code dans des situations o\u00f9 un attaquant peut provoquer la formation d'une valeur n\u00e9gative pour la variable qui transmet la taille des donn\u00e9es copi\u00e9es (par exemple, la valeur devient n\u00e9gative lors de la transmission de plus de 2 Go de donn\u00e9es, mais pour que l'attaque sorte des limites du tampon, il faut transmettre au moins 4 Go). La fonction memcpy() est largement utilis\u00e9e dans des applications, et les processeurs ARMv7 sont courants dans les syst\u00e8mes automobiles, mobiles, industriels, grand public, de communication et dans les dispositifs int\u00e9gr\u00e9s, qui peuvent potentiellement \u00eatre la cible d'attaques utilisant Bluetooth, HD Radio\/DAB, USB, CAN bus, Wi-Fi et d'autres sources de donn\u00e9es externes (par exemple, des services et applications accessibles via le r\u00e9seau pouvant \u00eatre attaqu\u00e9s en acceptant des entr\u00e9es sans limite de taille).<\/p>\n

\u00c0 titre d'exemple, on citera la cr\u00e9ation d'un exploit fonctionnel pour cibler le serveur HTTP int\u00e9gr\u00e9 dans les syst\u00e8mes d'information automobiles, accessible via le r\u00e9seau Wi-Fi du v\u00e9hicule. Un attaquant externe peut exploiter la vuln\u00e9rabilit\u00e9 dans memcpy sur ce serveur en envoyant une requ\u00eate GET de taille tr\u00e8s importante et obtenir un acc\u00e8s root au syst\u00e8me.<\/p>\n

\"Une<\/a><\/noindex><\/center><\/p>\n

Sur les syst\u00e8mes 32 bits x86, le probl\u00e8me ne se manifeste pas, car l'impl\u00e9mentation de memcpy pour cette architecture interpr\u00e8te correctement la variable de taille comme une valeur enti\u00e8re non sign\u00e9e de type size_t (dans l\u2019impl\u00e9mentation en assembleur implementation<\/a><\/noindex> pour ARMv7, au lieu de size_t, elle est trait\u00e9e comme un entier sign\u00e9). Le correctif est actuellement disponible sous la forme d'un correctif<\/a><\/noindex>, qui fera partie de la mise \u00e0 jour d'ao\u00fbt de Glibc 2.32.
\nLe correctif consiste \u00e0 remplacer l'usage des instructions assembleur manipulant des op\u00e9randes sign\u00e9s (bge et blt) par leurs analogues non sign\u00e9s (blo et bhs). <\/p>\n

Le probl\u00e8me n'est pas encore r\u00e9solu dans Debian 9 et 10<\/a><\/noindex> (ne se manifeste pas dans Debian 8), Fedora<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, OpenEmbedded, Tizen (utilise glibc). RHEL<\/a><\/noindex> et SUSE<\/a><\/noindex> le probl\u00e8me n'affecte pas, car ils ne prennent pas en charge les syst\u00e8mes ARMv7 32 bits. Android n'est pas vuln\u00e9rable, car utilise sa propre impl\u00e9mentation de libc (Bionic). Dans OpenWRT<\/a><\/noindex> la plupart des distributions utilise Musl par d\u00e9faut, mais glibc est \u00e9galement disponible dans le d\u00e9p\u00f4t.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cisco \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-6096) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0432 Glibc \u0444\u0443\u043d\u043a\u0446\u0438\u0438 memcpy() \u0434\u043b\u044f 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b ARMv7. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u0440\u0438\u0446\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440 \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438, \u0438\u0437-\u0437\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0441\u0441\u0435\u043c\u0431\u043b\u0435\u0440\u043d\u044b\u0445 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0439, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0437\u043d\u0430\u043a\u043e\u0432\u044b\u043c\u0438 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u043c\u0438 \u0446\u0435\u043b\u044b\u043c\u0438 \u0447\u0438\u0441\u043b\u0430\u043c\u0438. \u0412\u044b\u0437\u043e\u0432 memcpy() \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 ARMv7 \u0441 \u043e\u0442\u0440\u0438\u0446\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u043c\u0443 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82557,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82556","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 critique dans l'impl\u00e9mentation de la fonction memcpy pour ARMv7 dans Glibc | ProHoster","description":"Les chercheurs en s\u00e9curit\u00e9 de Cisco ont r\u00e9v\u00e9l\u00e9 des d\u00e9tails","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 memcpy \u0434\u043b\u044f ARMv7 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Glibc | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cisco \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-22T17:41:55+00:00","article:modified_time":"2020-05-22T17:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82556","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:35:23","updated":"2022-09-28 08:25:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/82556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=82556"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/82556\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/82557"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=82556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=82556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=82556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}