{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint je predlo\u017eio tehniku za\u0161tite Safe-Linking koja ote\u017eava eksploataciju ranjivosti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tvrtka Checkpoint predstavila<\/a><\/noindex> mehanizam za\u0161tite Safe-Linking, koji ote\u017eava stvaranje eksploita koji manipuliraju definicijom ili izmjenom pokaziva\u010da na memorijske bufre dodijeljene prilikom poziva malloc. Safe-Linking ne blokira potpuno mogu\u0107nost eksploatacije ranjivosti, ali uz minimalne tro\u0161kove zna\u010dajno ote\u017eava stvaranje odre\u0111enih kategorija eksploita, budu\u0107i da pored iskori\u0161tenog prelivanja bafera treba prona\u0107i jo\u0161 jednu ranjivost koja uzrokuje curenje podataka o polo\u017eaju hrpe u memoriji.<\/p>\n

Zakrpane verzije s implementacijom Safe-Linkinga pripremljene su za Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) i Google TCMalloc, a tako\u0111er su ponu\u0111ene za modernizaciju za\u0161tite u Chromiumu (za
\nChromium od 2012. godine ve\u0107 ima ugra\u0111enu tehniku za\u0161tite MaskPtr usmjerenu na rje\u0161avanje iste problematike, ali rje\u0161enje Checkpointa pokazuje vi\u0161u izvedbu).
\nPredlo\u017eene zakrpe ve\u0107 su odobrene za isporuku u kolovozskom izdanju Glibc 3.32<\/a><\/noindex> i primjena Safe-Linkinga bit \u0107e uklju\u010dena prema zadanim postavkama. U uClibc-NG podr\u0161ka za Safe-Linking pristupila<\/a><\/noindex> bit \u0107e uklju\u010dena u izdanju 1.0.33 prema zadanim postavkama. U gperftools (stari tcmalloc) promjene su prihva\u0107ene<\/a><\/noindex>, ali bit \u0107e ponu\u0111ene u nekom od budu\u0107ih izdanja kao opcija. <\/p>\n

Razvija\u010di TCMalloc<\/a><\/noindex> novi tcmalloc promjena<\/a><\/noindex>, oslanjaju\u0107i se na zna\u010dajno smanjenje performansi i potrebu za dodavanjem pro\u0161irenih testova za redovno provjeravanje da sve funkcioni\u0161e ispravno. Testiranje od strane in\u017eenjera Checkpoint-a pokazalo je da metoda Safe-Linking ne dovodi do dodatne potro\u0161nje memorije, a performanse pri izvr\u0161avanju operacija s heap-om se u prosjeku smanjuju za samo 0.02%, a u najgorem slu\u010daju za 1.5% (za usporedbu, tro\u0161kovi u metodi kori\u0161tenoj u Chromiumu procjenjuju se na \u201emanje od 2%\u201d). Uklju\u010divanje
\nSafe-Linkinga dovodi do izvr\u0161avanja 2-3 dodatne asemberske instrukcije pri svakom pozivu free() i 3-4 instrukcije pri pozivu malloc(). Pokretanje faza inicijalizacije i generiranja nasumi\u010dnih vrijednosti nije potrebno.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking se mo\u017ee koristiti ne samo za pove\u0107anje sigurnosti raznih implementacija hrpa (heap), ve\u0107 i za dodavanje sredstava kontrole integriteta u sve strukture podataka u kojima se koriste jednostruki povezani popisi pokazatelja, smje\u0161teni pored samih bafera. Metoda je vrlo jednostavna za implementaciju i zahtijeva samo dodatak jedne makronaredbe i njeno primjenjivanje na pokazatelje na sljede\u0107i blok u kodu (na primjer, za Glibc mijenja se<\/a><\/noindex> samo nekoliko redaka u kodu). Metoda se svodi na sljede\u0107e izmjene:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n \u2026<\/p>\n

Su\u0161tina metode je u primjeni nasumi\u010dnih podataka iz mehanizma randomizacije adresa ASLR (mmap_base) za za\u0161titu jednostavanih listi, kao \u0161to su Fast-Bins i TCache. Prije primjene na vrijednost pokaziva\u010da na sljede\u0107i element u listi, vr\u0161i se transformacija prema maski i provjera poravnanja uz granicu stranice memorije. Pokaziva\u010d se mijenja u rezultat operacije \u201e(L >> PAGE_SHIFT) XOR (P)\u201d, gdje je P - vrijednost pokaziva\u010da, a L - lokacija u memoriji gdje se taj pokaziva\u010d pohranjuje.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Kada se koristi u sustavu ASLR<\/a><\/noindex> (Address Space Layout Randomization) dio bitova L s osnovnom adresom hrpe sadr\u017ei slu\u010dajne vrijednosti, koje se koriste kao klju\u010d za kodiranje P (izvla\u010de se operacijom pomaka za 12 bitova za 4096-bajtne stranice). Sli\u010dna manipulacija smanjuje rizik od hvatanja pokazatelja u eksploataciji, budu\u0107i da se pokazatelj ne \u010duva u originalnom obliku i za njegovu zamjenu potrebno je znati informacije o polo\u017eaju hrpe. Osim toga, u kodu zakrpe postoji i dodatna provjera poravnanja bloka, koja ne dozvoljava napada\u010du da zamijeni pokazatelj na neporavnatu vrijednost i zahtijeva znanje broja bitova na koje je izvr\u0161eno poravnanje, \u0161to na 64-bitnim sustavima dodatno omogu\u0107ava blokiranje 15 od 16 poku\u0161aja napada, koji ne uzimaju u obzir poravnanje.<\/p>\n

Metoda je u\u010dinkovita za za\u0161titu od napada koji koriste djelomi\u010dno prepisivanje pokazatelja (izmjena ni\u017eih bajtova), potpuno prepisivanje pokazatelja (preusmjeravanje na kod napada\u010da) i promjenu pozicije popisa na neporavnatom adresu. Kao primjer je pokazano da bi primjena Safe-Linkinga u malloc-u mogla blokirati eksploataciju nedavno utvr\u0111ene<\/a><\/noindex> istej istra\u017eiva\u010di ranjivosti CVE-2020-6007<\/a><\/noindex> u pametnom osvjetljenju Philips Hue Bridge, uzrokovanom prelivanjem bafera i omogu\u0107ava preuzimanje kontrole nad ure\u0111ajem.<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint je predstavio tehniku za\u0161tite Safe-Linking koja ote\u017eava eksploataciju ranjivosti | ProHoster","description":"Tvrtka Checkpoint predstavila je mehanizam za\u0161tite Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}