Buffer kusefukira mu OpenSSL kudagwiritsidwa ntchito potsimikizira masatifiketi a X.509

Kutulutsidwa kowongolera kwa OpenSSL cryptographic library 3.0.7 kwasindikizidwa, komwe kumakonza zovuta ziwiri. Nkhani ziwirizi zimayamba chifukwa cha kuchuluka kwa ma buffer pamakalata otsimikizira malo a imelo mu ziphaso za X.509 ndipo zitha kupangitsa kuti ma code aperekedwe pokonza satifiketi yopangidwa mwapadera. Pa nthawi yosindikizidwa, opanga OpenSSL anali asanalembepo umboni uliwonse wa kukhalapo kwa ntchito yomwe ingayambitse kuphedwa kwa code ya wowukirayo.

Ngakhale kuti chisanadze kumasulidwa kulengeza kwa kumasulidwa kwatsopano kunatchula kukhalapo kwa nkhani yovuta, kwenikweni, mu ndondomeko yomwe inatulutsidwa mkhalidwe wa chiwopsezo unachepetsedwa kufika pamlingo woopsa, koma osati wovuta kwambiri. Mogwirizana ndi malamulo omwe amatengedwa mu polojekitiyi, mlingo wa ngozi umachepetsedwa ngati vutoli likudziwonetsera mwadongosolo la atypical kapena ngati pali mwayi wochepa wogwiritsa ntchito chiwopsezocho pochita.

Pachifukwa ichi, kuchuluka kwazovuta kunachepetsedwa chifukwa kusanthula mwatsatanetsatane za kusatetezeka kwa mabungwe angapo kunatsimikizira kuti kuthekera kochita ma code panthawi yogwiritsira ntchito kunatsekedwa ndi njira zotetezera kusefukira kwa stack zomwe zimagwiritsidwa ntchito pamapulatifomu ambiri. Kuphatikiza apo, mawonekedwe a gridi omwe amagwiritsidwa ntchito m'magawidwe ena a Linux amapangitsa kuti ma byte 4 omwe amatuluka m'malire akhazikike pachitetezo chotsatira pa stack, chomwe sichinagwiritsidwebe ntchito. Komabe, ndizotheka kuti pali nsanja zomwe zingagwiritsidwe ntchito pochita ma code.

Zazindikirika:

• CVE-2022-3602 - chiwopsezo, chomwe chidawonetsedwa ngati chovuta, chimatsogolera ku kusefukira kwa 4-byte mukamayang'ana munda ndi imelo yopangidwa mwapadera mu satifiketi ya X.509. Mu kasitomala wa TLS, kusatetezeka kungagwiritsidwe ntchito polumikizana ndi seva yoyendetsedwa ndi wowukirayo. Pa seva ya TLS, chiwopsezocho chikhoza kugwiritsidwa ntchito ngati kutsimikizika kwa kasitomala pogwiritsa ntchito satifiketi kugwiritsidwa ntchito. Pachifukwa ichi, chiwopsezo chikuwonekera pa siteji pambuyo pa kutsimikiziridwa kwa unyolo wa chikhulupiliro chogwirizana ndi satifiketi, i.e. Kuwukiraku kumafuna kuti wolamulira satifiketi atsimikizire satifiketi yoyipa ya woukirayo.
• CVE-2022-3786 ndi vector ina yopezera chiopsezo cha CVE-2022-3602, yomwe idadziwika pakuwunika vutoli. Kusiyanaku kumafikira ku kuthekera kwa kusefukira kwa buffer pa stack ndi kuchuluka kosasintha kwa ma byte okhala ndi "." (i.e. wowukira sangathe kuwongolera zomwe zasefukira ndipo vuto litha kugwiritsidwa ntchito kungopangitsa kuti pulogalamuyo iwonongeke).

Zofooka zimangowoneka munthambi ya OpenSSL 3.0.x (chilombocho chinayambika mu Unicode conversion code (punycode) yowonjezedwa ku nthambi ya 3.0.x). Kutulutsidwa kwa OpenSSL 1.1.1, komanso malaibulale a OpenSSL fork LibreSSL ndi BoringSSL, sikukhudzidwa ndi vutoli. Nthawi yomweyo, zosintha za OpenSSL 1.1.1s zidatulutsidwa, zomwe zili ndi zosintha zopanda chitetezo zokha.

Nthambi ya OpenSSL 3.0 imagwiritsidwa ntchito pogawa monga Ubuntu 22.04, CentOS Stream 9, RHEL 9, OpenMandriva 4.2, Gentoo, Fedora 36, ​​​​Debian Testing/Unstable. Ogwiritsa ntchito machitidwewa akulimbikitsidwa kukhazikitsa zosintha posachedwa (Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch). Mu SUSE Linux Enterprise 15 SP4 ndi openSUSE Leap 15.4, mapaketi okhala ndi OpenSSL 3.0 akupezeka mwakufuna kwawo, phukusi ladongosolo limagwiritsa ntchito nthambi ya 1.1.1. Debian 1, Arch Linux, Void Linux, Ubuntu 11, Slackware, ALT Linux, RHEL 20.04, OpenWrt, Alpine Linux 8 ndi FreeBSD amakhalabe pa nthambi za OpenSSL 3.16.x.

Source: opennet.ru