0-hnub qhov tsis zoo hauv Chrome tau txheeb xyuas los ntawm kev txheeb xyuas cov kev hloov pauv hauv V8 lub cav

Cov kws tshawb fawb los ntawm Exodus Intelligence tau pom lub ntsiab lus tsis muaj zog hauv cov txheej txheem kho qhov tsis zoo hauv Chrome / Chromium codebase. Qhov teeb meem tshwm sim los ntawm qhov tseeb tias Google nthuav tawm tias cov kev hloov pauv tau cuam tshuam nrog cov teeb meem kev nyab xeeb tsuas yog tom qab tso tawm, tab sis
Ntxiv cov cai rau lub chaw cia khoom los kho qhov tsis zoo hauv V8 lub cav ua ntej tshaj tawm qhov kev tso tawm. Qee lub sij hawm, cov kev kho tau raug sim thiab lub qhov rais tshwm thaum lub sij hawm qhov tsis zoo yuav raug kho nyob rau hauv cov cai hauv paus thiab muaj rau kev tshuaj xyuas, tab sis qhov tsis zoo tseem tsis tau kho ntawm cov neeg siv tshuab.

Thaum kawm txog cov kev hloov pauv tau ua rau lub chaw khaws cia, cov kws tshawb nrhiav pom qee yam ntxiv rau Lub Ob Hlis 19 kho thiab nyob rau hauv peb hnub lawv muaj peev xwm npaj tau siv, cuam tshuam txog kev tso tawm tam sim no ntawm Chrome (qhov kev siv luam tawm tsis suav nrog cov khoom siv los hla kev cais sandbox). Google tam sim ntawd tso tawm Chrome 80.0.3987.122 hloov tshiab, kho cov kev siv dag zog yooj yim (CVE-2020-6418). Qhov tsis zoo yog thawj zaug txheeb xyuas los ntawm Google engineers thiab yog tshwm sim los ntawm qhov teeb meem nrog kev tuav hauv JSCreate ua haujlwm, uas tuaj yeem siv los ntawm Array.pop lossis Array.prototype.pop txoj kev. Nws yog noteworthy tias muaj ib qho teeb meem zoo sib xws tsau hauv Firefox lub caij ntuj sov dhau los.

Cov kws tshawb fawb kuj tau sau tseg qhov yooj yim ntawm kev tsim kev siv nyiaj vim kev suav nrog Chrome 80 tshuab ntim cov cim (es tsis txhob khaws tag nrho 64-ntsis tus nqi, tsuas yog cov khoom qis qis ntawm tus taw qhia tau muab khaws cia, uas tuaj yeem txo qis heap nco noj). Piv txwv li, ib co head-of-heap cov ntaub ntawv qauv xws li lub built-in function table, haiv neeg cov khoom, thiab cov khoom hauv paus Cov khib nyiab khib nyiab tam sim no tau faib rau cov chaw nyob uas tuaj yeem paub tau thiab sau tau.

Interestingly, yuav luag ib xyoos dhau los Exodus Intelligence yog ua tiav Ib qho kev qhia zoo sib xws ntawm qhov muaj peev xwm tsim tau qhov kev siv nyiaj raws li kev kawm cov ntaub ntawv pej xeem ntawm kev kho hauv V8, tab sis, pom tseeb, cov lus xaus tsis raug ua raws li. Nyob rau hauv qhov chaw ntawm kev tshawb fawb
Exodus Intelligence tuaj yeem yog cov neeg tawm tsam lossis cov koom haum txawj ntse uas, thaum tsim kev siv dag zog, yuav muaj sijhawm los zais qhov tsis zoo rau hnub lossis txawm lub lis piam ua ntej Chrome tso tawm tom ntej.

Tau qhov twg los: opennet.ru