Gyaran kurji ya haifar da gyaran da bai cika ba don raunin Specter a cikin kernel na Linux

Masu haɓaka aikin Gsecurity raba labari na taka tsantsan yana nuna yadda rashin tunani kawar da gargaɗin mai tarawa zai iya haifar da lahani a cikin lambar. A ƙarshen Mayu, an ba da shawarar gyara don Linux kernel don sabon nau'in amfani da raunin Specter ta hanyar kiran tsarin ptrace.

Yayin gwada facin, masu haɓakawa sun lura cewa lokacin ginawa, mai tarawa yana nuna gargaɗi game da haɗa lamba da ma'anoni (an ayyana tsarin bayan lambar, yana ba da ƙima ga canjin da ke akwai):

int index = n;
idan (n <HBP_NUM) {index = array_index_nospec(index, HBP_NUM); struct perf_event *bp = zaren->ptrace_bps[index];

Linus ya yarda gyara zuwa ga reshen maigidanku, sun rabu da su daga gargaɗin ta hanyar matsar da ma'anar ma'anar zuwa wani toshe:

idan (n <HBP_NUM) {int index = array_index_nospec(n, HBP_NUM); struct perf_event *bp = zaren->ptrace_bps[index];

A watan Yuli, an kuma aika da gyaran zuwa ga tsayayyen rassan kwaya 4.4, 4.9, 4.14, 4.19 da 5.2. Masu kula da tsayayyen rassan su ma sun ci karo da gargaɗin, kuma maimakon su bincika don ganin ko an riga an gyara shi a babban reshen Linus, sai suka yi gyara da kansu. Matsalar ita ce, ba tare da tunanin gaske ba, suna kawai motsi ayyana tsarin sama, ta yadda kiran zuwa array_index_nospec, wanda ke ba da kariya kai tsaye daga rashin lahani, ba a ƙara yin amfani da shi wajen ayyana tsarin, kuma a maimakon ma'anar "index" mai canzawa "n" koyaushe ana amfani da shi:

int index = n;
idan (n <HBP_NUM ){struct perf_event *bp = zaren->ptrace_bps[index];
index = array_index_nospec(index, HBP_NUM);

source: budenet.ru