{"id":99808,"date":"2021-04-15T10:22:45","date_gmt":"2021-04-15T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah"},"modified":"2021-04-15T10:22:45","modified_gmt":"2021-04-15T08:22:45","slug":"predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","title":{"rendered":"Bemutatt\u00e1k a patch-eket a Linux kernel verembec\u00edmek v\u00e9letlenszer\u0171s\u00edt\u00e9s\u00e9re rendszerh\u00edv\u00e1sok sor\u00e1n.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kees Cook, a former chief sysadmin of kernel.org and leader of the Ubuntu Security Team, currently working at Google to ensure the security of Android and ChromeOS, published a set of patches that implement stack offset randomization during system call processing. The patches enhance kernel security by modifying the stack placement, making stack attacks significantly more complex and less successful. The initial implementation supports ARM64 and x86\/x86_64 processors. <\/p>\n
A kezdeti \u00f6tlet a PaX RANDKSTACK projekthez kapcsol\u00f3dik. 2019-ben Elena Reshetova, az Intel m\u00e9rn\u00f6ke, megpr\u00f3b\u00e1lta l\u00e9trehozni ennek az \u00f6tletnek egy, a Linux kernel f\u0151 \u00f6sszeszerel\u00e9s\u00e9be val\u00f3 integr\u00e1l\u00e1sra alkalmas megval\u00f3s\u00edt\u00e1s\u00e1t. K\u00e9s\u0151bb a kezdem\u00e9nyez\u00e9st Kis Cook vette \u00e1t, aki bemutatta a f\u0151 kernel verzi\u00f3j\u00e1hoz illeszked\u0151 megold\u00e1st. A patch-eket a 5.13-as kiad\u00e1sba tervezik beilleszteni. A m\u00f3d alap\u00e9rtelmez\u00e9s szerint le lesz tiltva. A bekapcsol\u00e1shoz a kernel parancssora «randomize_kstack_offset=on\/off» opci\u00f3t \u00e9s a CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT be\u00e1ll\u00edt\u00e1st k\u00edn\u00e1lnak. A m\u00f3d aktiv\u00e1l\u00e1sakor a teljes\u00edtm\u00e9ny vesztes\u00e9ge k\u00f6r\u00fclbel\u00fcl 1%-ra becs\u00fclhet\u0151. <\/p>\n
The essence of the proposed protection lies in selecting a random stack offset for each system call, complicating the determination of the stack layout in memory, even if the addresses are obtained, as the base stack address will change with the next system call. Unlike the PaX RANDKSTACK implementation, in the proposed patches for inclusion in the kernel, randomization is performed not at the initial stage (cpu_current_top_of_stack), but after setting the pt_regs structure, making it impossible to use ptrace-based methods to determine the randomized offset during the execution of a long-running system call. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"