Ọdịmma dị oke mkpa na mmejuputa ọrụ memcpy maka ARMv7 sitere na Glibc

Ndị nyocha nchekwa Cisco kpuchie nkọwa adịghị ike (CVE-2020-6096) na mmejuputa ọrụ Glibc nyere memcpy () maka ikpo okwu 32-bit ARMv7. A na-akpata nsogbu ahụ site na njikwa na-ezighi ezi nke ụkpụrụ na-adịghị mma nke oke nke na-ekpebi nha ebe ahụ depụtaghachiri, n'ihi iji njikarịcha mgbakọ na-emegharị akara ọnụọgụ 32-bit bịanyere aka na ya. Ịkpọ memcpy () na sistemu ARMv7 nwere oke adịghị mma na-arụpụta ntụnyere ụkpụrụ na-ezighi ezi wee dee na mpaghara na-abụghị oke nke nchekwa akọwapụtara.

Enwere ike iji ike mee ihe iji mebie koodu n'ọnọdụ ebe onye na-awakpo nwere ike ịhazi nhazi nke uru na-adịghị mma nke mgbanwe site na nha nke data a na-ebufe (dịka ọmụmaatụ, ọ ga-adị njọ mgbe ị na-ebufe ihe karịrị 2 GB nke). data, mana n'oge mwakpo ahụ, ịgafe oke nchekwa, ịkwesịrị ịnyefe opekata mpe 4GB). A na-eji ọrụ memcpy () eme ihe na ngwa, yana ndị na-arụ ọrụ ARMv7 na-ahụkarị na sistemụ ụgbọ ala, mkpanaka, ụlọ ọrụ mmepụta ihe, ndị ahịa, nkwukọrịta na ngwaọrụ agbakwunyere, nke nwere ike ibute mwakpo site na iji Bluetooth, HD Radio/DAB, USB, CAN ụgbọ ala, Enwere ike ibuso Wi-Fi Fi na isi mmalite data mpụga ndị ọzọ (dịka ọmụmaatụ, ọrụ na ngwa a na-enweta na netwọkụ na-anabata data ntinye na-enweghị mmachi nha).

Otu ihe atụ bụ imepụta ihe na-arụ ọrụ iji wakpo ihe nkesa HTTP arụnyere n'ime sistemụ ozi ụgbọ ala, nke a na-enweta site na netwọk Wi-Fi ụgbọ ala. Onye na-awakpo n'èzí nwere ike iji memcpy adịghị ike na ihe nkesa a site na izipu arịrịọ GET buru ibu wee nweta mgbọrọgwụ na sistemụ.

Na sistemu 32-bit x86, nsogbu ahụ anaghị apụta, ebe ọ bụ na mmejuputa memcpy maka ihe owuwu a na-akọwa nke ọma nha mgbanwe dị ka uru integer na-edeghị aha nke ụdị size_t (na asụsụ mgbakọ). mmejuputa iwu maka ARMv7 a na-emeso ya dị ka integer bịanyere aka na ya kama size_t). Ndozi dị ugbu a dị ka kwachie, nke a ga-etinye na August Glibc 2.32 nwelite.
Ndozi ahụ gbadara iji dochie ntuziaka mgbakọ na-arụ ọrụ na operands mbinye aka (bge na blt) na ndị ogbo na-edebanyeghị aha (blo na bhs).

Edobebeghị nsogbu ahụ Debian 9 na 10 (anaghị ahụ ya na Debian 8), Fedora, Ubuntu, OpenEmbedded, Tizen (nke glibc na-eji). RHEL и EBU A naghị emetụta okwu a n'ihi na ha anaghị akwado usoro 32-bit ARMv7. Android adịghị emetụta adịghị ike ahụ n'ihi na ọ na-eji mmejuputa libc (Bionic) nke ya. N'ime OpenWRT Site na ndabara, ọtụtụ ndị na-ewu ụlọ na-eji Musl, mana glibc dịkwa na ebe nchekwa ahụ.

isi: opennet.ru