{"id":83016,"date":"2020-05-27T19:41:58","date_gmt":"2020-05-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket"},"modified":"2020-05-27T19:41:58","modified_gmt":"2020-05-27T17:41:58","slug":"25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","title":{"rendered":"25 sebezhet\u0151s\u00e9g a Zephyr RTOS-ban, t\u00f6bbek k\u00f6z\u00f6tt ICMP-csomagokon kereszt\u00fcl kihaszn\u00e1lhat\u00f3ak","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Az NCC Group kutat\u00f3i k\u00f6zz\u00e9tett\u00e9k<\/a><\/noindex> a ny\u00edlt forr\u00e1sk\u00f3d\u00fa projekt audit\u00e1l\u00e1s\u00e1nak eredm\u00e9nyei Zephyr<\/a><\/noindex>, fejleszt\u00e9s alatt \u00e1ll\u00f3<\/a><\/noindex> val\u00f3s idej\u0171 oper\u00e1ci\u00f3s rendszert (RTOS) c\u00e9lozva k\u00e9sz\u00fcl, amely a \"Dolgok Internete\" (IoT, Internet of Things) koncepci\u00f3hoz kapcsol\u00f3d\u00f3 eszk\u00f6z\u00f6k felszerel\u00e9s\u00e9re ir\u00e1nyul. Az audit sor\u00e1n kider\u00fclt, 25 sebezhet\u0151s\u00e9g<\/a><\/noindex> a Zephyrben \u00e9s 1 sebezhet\u0151s\u00e9g a MCUbootban. A Zephyr fejleszt\u00e9se Intel c\u00e9gek r\u00e9szv\u00e9tel\u00e9vel zajlik. <\/p>\n

\u00d6sszesen 6 sebezhet\u0151s\u00e9get tal\u00e1ltak a h\u00e1l\u00f3zati veremben, 4 -et a kernelben, 2 -t a parancssorban, 5 -t a rendszerh\u00edv\u00e1sok kezel\u0151iben, 5 -t az USB alrendszerben \u00e9s 3 -t a firmware friss\u00edt\u00e9si mechanizmusban. K\u00e9t probl\u00e9ma kritikus vesz\u00e9lyess\u00e9gi szintet kapott, kett\u0151 magas, 9 m\u00e9rs\u00e9kelt, 9 alacsony \u00e9s 4 figyelembev\u00e9telre. A kritikus probl\u00e9m\u00e1k az IPv4 veremet \u00e9s az MQTT elemz\u0151t \u00e9rintik, a vesz\u00e9lyesek pedig az USB mass storage \u00e9s USB DFU illeszt\u0151programokat. Az inform\u00e1ci\u00f3 nyilv\u00e1noss\u00e1gra hozatalakor jav\u00edt\u00e1sokat csak a 15 legvesz\u00e9lyesebb sebezhet\u0151s\u00e9gre k\u00e9sz\u00edtettek, a szolg\u00e1ltat\u00e1smegtagad\u00e1sra vezet\u0151 vagy a kernel v\u00e9delmi mechanizmusaink hib\u00e1ival kapcsolatos probl\u00e9m\u00e1k jav\u00edtatlanok maradtak.<\/p>\n

Az IPv4 stackben t\u00e1volr\u00f3l kihaszn\u00e1lhat\u00f3 sebezhet\u0151s\u00e9get tal\u00e1ltak, amely mem\u00f3ria s\u00e9r\u00fcl\u00e9shez vezet a bizonyos m\u00f3don m\u00f3dos\u00edtott ICMP-csomagok feldolgoz\u00e1sa sor\u00e1n. Egy m\u00e1sik s\u00falyos probl\u00e9ma az MQTT protokoll parser\u00e9ben tal\u00e1lhat\u00f3, amely a mez\u0151k hossz\u00e1nak megfelel\u0151 ellen\u0151rz\u00e9s\u00e9nek hi\u00e1ny\u00e1b\u00f3l fakad, \u00e9s t\u00e1voli k\u00f3dv\u00e9grehajt\u00e1shoz vezethet. Kev\u00e9sb\u00e9 vesz\u00e9lyes probl\u00e9m\u00e1k, amelyek szolg\u00e1ltat\u00e1si megszak\u00edt\u00e1st okoznak, az IPv6 stackben \u00e9s a CoAP protokoll megval\u00f3s\u00edt\u00e1s\u00e1ban tal\u00e1lhat\u00f3k.<\/p>\n

A t\u00f6bbi probl\u00e9ma lok\u00e1lisan kihaszn\u00e1lhat\u00f3 szolg\u00e1ltat\u00e1smegtagad\u00e1s vagy kernel szint\u0171 k\u00f3d v\u00e9grehajt\u00e1s\u00e1nak el\u0151id\u00e9z\u00e9s\u00e9re. E sebezhet\u0151s\u00e9gek nagy r\u00e9sze a rendszerh\u00edv\u00e1sok argumentumainak megfelel\u0151 ellen\u0151rz\u00e9sek hi\u00e1ny\u00e1val kapcsolatos, \u00e9s a kernel mem\u00f3riater\u00fcleteinek \u00edr\u00e1s\u00e1hoz \u00e9s olvas\u00e1s\u00e1hoz vezethet. A probl\u00e9m\u00e1k kiterjednek a rendszerh\u00edv\u00e1sok kezel\u0151 k\u00f3dj\u00e1ra is - a negat\u00edv rendszerh\u00edv\u00e1s sz\u00e1mra val\u00f3 hivatkoz\u00e1s eg\u00e9sz sz\u00e1mok t\u00fall\u00e9p\u00e9s\u00e9hez vezet. A kernelben szint\u00e9n probl\u00e9m\u00e1k mer\u00fcltek fel az ASLR (c\u00edmz\u00e9si t\u00e9r v\u00e9letlenszer\u0171s\u00edt\u00e9se) v\u00e9delem megval\u00f3s\u00edt\u00e1s\u00e1ban \u00e9s a veremben l\u00e9v\u0151 kann\u00e1s c\u00edmk\u00e9k be\u00e1ll\u00edt\u00e1s\u00e1nak mechanizmus\u00e1ban, amelyek hat\u00e1stalann\u00e1 teszik ezeket a mechanizmusokat. <\/p>\n

Sok probl\u00e9m\u00e1t \u00e9rintenek az USB stack \u00e9s az egyes meghajt\u00f3k. P\u00e9ld\u00e1ul az USB mass storage probl\u00e9m\u00e1ja lehet\u0151v\u00e9 teszi a buffer overflow el\u0151id\u00e9z\u00e9s\u00e9t, \u00e9s k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a kernel szintj\u00e9n, amikor az eszk\u00f6zt egy t\u00e1mad\u00f3 \u00e1ltal ellen\u0151rz\u00f6tt USB hosthoz csatlakoztatj\u00e1k. Az USB DFU, az \u00faj firmware USB-n kereszt\u00fcli let\u00f6lt\u00e9s\u00e9re szolg\u00e1l\u00f3 meghajt\u00f3, lehet\u0151v\u00e9 teszi, hogy titkos\u00edt\u00e1s alkalmaz\u00e1sa n\u00e9lk\u00fcl m\u00f3dos\u00edtott firmware k\u00e9pet t\u00f6ltsenek be a bels\u0151 Flash mikrokontrollerbe, megker\u00fclve az al\u00e1\u00edr\u00e1s-ellen\u0151rz\u00e9s \u00e1ltal biztos\u00edtott v\u00e9dett indul\u00e1si m\u00f3dot. Ezenk\u00edv\u00fcl \u00e1ttekintett\u00e9k az open-source bootloader k\u00f3dj\u00e1t. MCUboot<\/a><\/noindex>, amelyben tal\u00e1ltak egy nem kritikus s\u00e9r\u00fcl\u00e9kenys\u00e9get,
\nami puffert\u00falcsordul\u00e1shoz vezethet az SMP (Simple Management Protocol) protokoll UART-on kereszt\u00fcli haszn\u00e1lata sor\u00e1n.<\/p>\n

Eml\u00e9keztet\u0151\u00fcl, a Zephyr minden folyamat sz\u00e1m\u00e1ra csak egy glob\u00e1lis megosztott virtu\u00e1lis c\u00edmtartom\u00e1nyt (SASOS, Single Address Space Operating System) biztos\u00edt. Az alkalmaz\u00e1sokra specifikus k\u00f3d kombin\u00e1l\u00f3dik az adott felhaszn\u00e1l\u00e1sra optimaliz\u00e1lt maggal, amely monolitikus futtathat\u00f3 f\u00e1jlt k\u00e9pez a bet\u00f6lt\u00e9shez \u00e9s az adott hardveren t\u00f6rt\u00e9n\u0151 futtat\u00e1shoz. Minden rendszerforr\u00e1st a ford\u00edt\u00e1si f\u00e1zisban hat\u00e1roznak meg, ami cs\u00f6kkenti a k\u00f3d m\u00e9ret\u00e9t \u00e9s n\u00f6veli a teljes\u00edtm\u00e9nyt. A rendszerk\u00e9p csak azokat a magfunkci\u00f3kat tartalmazhatja, amelyek az alkalmaz\u00e1s v\u00e9grehajt\u00e1s\u00e1hoz sz\u00fcks\u00e9gesek.<\/p>\n

Figyelemre m\u00e9lt\u00f3, hogy a Zephyr egyik kulcsfontoss\u00e1g\u00fa el\u0151nye eml\u00edtve van<\/a><\/noindex> a biztons\u00e1gra val\u00f3 tekintettel t\u00f6rt\u00e9n\u0151 fejleszt\u00e9s. Azt \u00e1ll\u00edtj\u00e1k<\/a><\/noindex>, hogy a fejleszt\u00e9s minden szakasza k\u00f6telez\u0151 k\u00f3dbiztons\u00e1gi ellen\u0151rz\u00e9si l\u00e9p\u00e9seken megy kereszt\u00fcl: fuzzing tesztel\u00e9s, statikus elemz\u00e9s, penetr\u00e1ci\u00f3s tesztel\u00e9s, k\u00f3dellen\u0151rz\u00e9s, backdoor be\u00e9p\u00edt\u00e9sek elemz\u00e9se \u00e9s fenyeget\u00e9smodellez\u00e9s.<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Zephyr, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (RTOS), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 «\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0432\u0435\u0449\u0435\u0439» (IoT, Internet of Things). \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 25 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Zephyr \u0438 1 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MCUboot. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 Zephyr \u0432\u0435\u0434\u0451\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intel. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83016","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4725 s\u00e9r\u00fcl\u00e9kenys\u00e9g az RTOS Zephyrben, bele\u00e9rtve az ICMP-csomagokon kereszt\u00fcl kihaszn\u00e1lhat\u00f3akat | ProHoster","description":"Az NCC Group kutat\u00f3i k\u00f6zz\u00e9tett\u00e9k az audit eredm\u00e9nyeit.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4725 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 RTOS Zephyr, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 ICMP-\u043f\u0430\u043a\u0435\u0442 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T17:41:58+00:00","article:modified_time":"2020-05-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83016","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:51:14","updated":"2022-10-02 09:38:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/83016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=83016"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/83016\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=83016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=83016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=83016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}