Ndị nyocha sitere na Netflix na Google Enwere adịghị ike asatọ na mmejuputa iwu dị iche iche nke HTTP/2 protocol nke nwere ike ime ka ịgọnarị ọrụ site na izipu iyi nke arịrịọ netwọk n'ụzọ ụfọdụ. Nsogbu a na-emetụta ọtụtụ sava HTTP nwere nkwado HTTP/2 ruo n'ókè ụfọdụ ma mee ka onye ọrụ na-agwụ na ebe nchekwa ma ọ bụ na-emepụta ibu CPU dị ukwuu. Ewepụtalarị mmelite ndị na-ewepụ adịghị ike и , ma ugbu a maka Apache httpd na .
Nsogbu ndị a sitere na nsogbu ndị ewebatara na protocol HTTP / 2 jikọtara ya na iji usoro ọnụọgụ abụọ, usoro maka igbochi ntinye data n'ime njikọ, usoro ntinye ụzọ, na ọnụnọ nke ozi njikwa ICMP na-arụ ọrụ na njikọ HTTP/2. ọkwa (dịka ọmụmaatụ, ping, nrụpụta, na ntọala eruba). Ọtụtụ mmejuputa iwu emeghị ka nke ọma eruba nke ozi njikwa, ejighị nke ọma jikwaa ndị bụ isi kwụ n'ahịrị mgbe a na-edozi arịrịọ, ma ọ bụ jiri suboptimal mmejuputa iwu nke usoro akara algọridim.
Ọtụtụ n'ime ụzọ mwakpo ndị a chọpụtara na-agbadata izipu ụfọdụ arịrịọ na ihe nkesa, na-eduga n'ọgbọ nke ọnụ ọgụgụ buru ibu nke nzaghachi. Ọ bụrụ na onye ahịa ahụ agụghị data sitere na oghere ma ghara imechi njikọ ahụ, kwụ n'ahịrị nkpuchi nzaghachi na akụkụ nkesa na-ejupụta. Omume a na-emepụta ibu na sistemu njikwa kwụ n'ahịrị maka nhazi njikọ netwọkụ yana, dabere na njirimara mmejuputa, na-eduga na ike ọgwụgwụ nke ebe nchekwa dị ma ọ bụ akụrụngwa CPU.
Achọpụtara adịghị ike:
- CVE-2019-9511 (Data Dribble) - onye na-awakpo na-arịọ data buru ibu n'ime ọtụtụ eri site na ijikwa nha windo na-amị amị na mkpa eri, na-amanye ihe nkesa ka ọ kwụ n'ahịrị data na ngọngọ 1-byte;
- CVE-2019-9512 (Ping Iju mmiri) - onye na-awakpo na-aga n'ihu na-emebi ozi ping na njikọ HTTP/2, na-eme ka ahịrị dị n'ime nke nzaghachi ezigara na idei mmiri n'akụkụ nke ọzọ;
- CVE-2019-9513 (Resource Loop) - onye na-awakpo na-emepụta ọtụtụ eriri arịrịọ ma na-agbanwe ihe ndị dị mkpa nke eriri ahụ, na-eme ka osisi dị mkpa gbanwee;
- CVE-2019-9514 (Iju mmiri tọgharịa) - onye na-awakpo na-emepụta ọtụtụ eriri
ma ziga arịrịọ na-ezighi ezi site na eri nke ọ bụla, na-eme ka ihe nkesa ahụ ziga fremu RST_STREAM, mana ọ naghị anabata ha ka ha mejupụta ahịrị nzaghachi; - CVE-2019-9515 (Iju mmiri Ntọala) - onye na-awakpo ahụ na-eziga iyi nke okpokolo agba “SETTINGS” efu, na nzaghachi nke ihe nkesa ga-ekwenye na nnata nke arịrịọ ọ bụla;
- CVE-2019-9516 (0-Length Headers Leak) - onye na-awakpo na-eziga iyi nke nkụnye eji isi mee na aha efu na uru efu, na ihe nkesa na-ekenye ihe nchekwa na ebe nchekwa iji chekwaa nkụnye eji isi mee ọ bụla ma ghara ịhapụ ya ruo mgbe nnọkọ ahụ kwụsịrị. ;
- CVE-2019-9517 (Nchekwa data dị n'ime) - onye mwakpo mepere
Window na-amị amị HTTP/2 maka ihe nkesa iji zipu data na-enweghị mgbochi, mana na-emechi windo TCP, na-egbochi data ka edee ya na oghere. Na-esote, onye na-awakpo ahụ na-eziga arịrịọ nke chọrọ nzaghachi buru ibu; - CVE-2019-9518 (Iju mmiri Frames efu) - Onye na-awakpo na-eziga iyi nke okpokolo agba nke ụdị DATA, HEADERS, CONTINUATION, ma ọ bụ PUSH_PROMISE, mana na-ebu ụgwọ efu na enweghị ọkọlọtọ nkwụsị. Ihe nkesa ahụ na-etinye oge ịhazi etiti ọ bụla, na-adabaghị na bandwit nke onye mwakpo ahụ riri.
isi: opennet.ru