{"id":82793,"date":"2020-05-25T07:41:55","date_gmt":"2020-05-25T05:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu"},"modified":"2020-05-25T07:41:55","modified_gmt":"2020-05-25T05:41:55","slug":"70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","title":{"rendered":"70% sigurnosnih problema u Chromiumu uzrokovani su gre\u0161kom u radu s memorijom","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Razvija\u010di projekta Chromium <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/memory-safety\">analizirali<\/a><\/noindex> Otkriveno je 912 opasnih i kriti\u010dnih ranjivosti u stabilnim izdanjima Chromea od 2015. godine, te je zaklju\u010deno da je 70% njih uzrokovano nesigurnim radom s memorijom (gre\u0161ke u radu s pokaziva\u010dima u C\/C++ kodu). Polovica ovih problema (36,1%) uzrokovana je pristupima baferu nakon osloba\u0111anja povezane memorije (use-after-free).<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/_\/rsrc\/1589581287612\/Home\/chromium-security\/memory-safety\/piechart.png\"><img decoding=\"async\" alt=\"70% sigurnosnih problema u Chromiumu uzrokovani su gre\u0161kom u radu s memorijom\" src=\"\/wp-content\/uploads\/2020\/05\/31912b956dc2548e17b682d29dbab909.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>Prilikom projektiranja Chromiuma prvotno je <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/guts\">predvi\u0111eno<\/a><\/noindex>, da kod ne isklju\u010duje mogu\u0107nost pojave gre\u0161aka, stoga je ve\u0107i naglasak stavljen na primjenu sandbox izolacije kako bi se ograni\u010dili posljedici otkrivanja ranjivosti. Trenutno su mogu\u0107nosti primjene ove tehnologije dostigle svoj maksimum, a daljnje razdvajanje na procese nije isplativo s obzirom na potro\u0161nju resursa. <\/p>\n<p>Kako bi odr\u017eao sigurnost svoje kodne baze, Google tako\u0111er primjenjuje &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/chromium.googlesource.com\/chromium\/src\/+\/master\/docs\/security\/rule-of-2.md\">pravilo dvojice<\/a><\/noindex>&#171;, prema kojem svaki dodani kod mora ispuniti najvi\u0161e dva od tri uvjeta: rad s neprovjerenim ulaznim podacima, kori\u0161tenje nesigurnog programskog jezika (C\/C++) i izvr\u0161avanje s povi\u0161enim privilegijama. Iz ovog pravila slijedi da kod za obradu vanjskih podataka mora ili biti sveden na minimalne privilegije (izoliran), ili napisati na sigurnom programskom jeziku.<\/p>\n<p>Za daljnje ja\u010danje sigurnosti osnovnog koda pokrenut je projekt za sprje\u010davanje gre\u0161aka u radu s memorijom u osnovnom kodu. Isti\u010du se tri osnovna pristupa: kreiranje C++ biblioteka s funkcijama za sigurni rad s memorijom i pro\u0161irenje podru\u010dja primjene sakuplja\u010da sme\u0107a, primjena hardverskih mehanizama za\u0161tite <noindex><a rel=\"nofollow\" href=\"https:\/\/llvm.org\/devmtg\/2018-10\/slides\/Serebryany-Stepanov-Tsyrklevich-Memory-Tagging-Slides-LLVM-2018.pdf\">MTE<\/a><\/noindex> (Memory Tagging Extension) i pisanje komponenti na jezicima koji osiguravaju siguran rad s memorijom (Java, Kotlin, JavaScript, Rust, Swift).<\/p>\n<p>O\u010dekuje se da \u0107e rad biti usredoto\u010den na dva smjera: <\/p>\n<ul>\n<li class=\"l\"> Zna\u010dajnu promjenu procesa razvoja u C++, koja potencijalno mo\u017ee negativno utjecati na performanse (dodatne provjere granica i sakupljenje sme\u0107a). Umjesto raw pokaziva\u010da preporu\u010duje se kori\u0161tenje tipa <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/document\/d\/1pnnOAIz_DMWDI4oIOFoMAqLnf_MZ2GsrJNb_dbQ3ZBg\/edit#heading=h.jx7cpliyfer\">MiraclePtr<\/a><\/noindex>, koji smanjuje iskori\u0161tene gre\u0161ke klase use-after-free na sigurnosno bezopasne rupe, bez zna\u010dajnog negativnog utjecaja na performanse, potro\u0161nju memorije i stabilnost.\n<li class=\"l\"> Kori\u0161tenje jezika koji su dizajnirani za provjeru sigurnog rada s memorijom tijekom kompilacije (omogu\u0107uje isklju\u010divanje negativnog utjecaja na performanse, \u0161to je karakteristi\u010dno za takve provjere tijekom izvo\u0111enja koda, ali \u0107e donijeti dodatne tro\u0161kove u organizaciji interakcije koda na novom jeziku s kodom na C++).\n<\/ul>\n<p>Kori\u0161tenje biblioteka za sigurni rad s memorijom predstavlja najjednostavniji, ali manje u\u010dinkovit na\u010din. Prepisivanje koda na Rust smatra se naju\u010dinkovitijim, ali i vrlo skupim putem.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/a77db9aa-a-7b23c8ea-s-sites.googlegroups.com\/a\/chromium.org\/dev\/Home\/chromium-security\/memory-safety\/sat3CHOc8lXZbGicChW6w5Q.png?attachauth=ANoY7cqyfZiTko5osYGVMP1ewI31nrE7lTP8m8fXIDsqh42vdzKk9CPyjYMd54R7RUD3QviaGPZKpgWTOFblPaSIGPePPGlMbi9rN1ZbO4lhXjP7mfoJCt5i_m7cFFFesGuNIVU0hjjc7M-FTXLyjc_YqMxC7-NUPaFMZe_83_IuUY6frEvOHBZ-6AxVa-PU49aLScaDVt6z3SSF1krIhvKgjaZjUeI0hhgKDayLg13AFRHUidIJd5wnbvomNQyzuH3wD6DxMfh2lrQ6EK3hK7RTMw-eMeWAEw%3D%3D&#038;attredirects=0\"><img decoding=\"async\" alt=\"70% sigurnosnih problema u Chromiumu uzrokovani su gre\u0161kom u radu s memorijom\" src=\"\/wp-content\/uploads\/2020\/05\/48aac9ae5a251323dddebf73dfa73286.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53019\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Chrome \u0441 2015 \u0433\u043e\u0434\u0430, \u0438 \u043f\u0440\u0438\u0448\u043b\u0438 \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e 70% \u0438\u0437 \u043d\u0438\u0445 \u0431\u044b\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e (\u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043d\u0430 C\/C++). \u041f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0438\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c (36.1%) \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0443\u0444\u0435\u0440\u0443 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u043f\u0430\u043c\u044f\u0442\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82794,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82793","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4770% sigurnosnih problema u Chromiumu uzrokovano je gre\u0161kama u radu s memorijom | ProHoster","description":"Programeri projekta Chromium analizirali su 912 opasnih i kriti\u010dnih ranjivosti otkrivenih u.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-25T05:41:55+00:00","article:modified_time":"2020-05-25T05:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82793","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:31:26","updated":"2022-09-30 17:34:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/82793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=82793"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/82793\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/82794"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=82793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=82793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=82793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}