Glibc ikuphatikiza kukonza kusatetezeka kwa memcpy kokonzedwa ndi opanga Aurora OS

Opanga makina ogwiritsira ntchito mafoni a Aurora (foloko la Sailfish OS lopangidwa ndi kampani ya Open Mobile Platform) adagawana nkhani yowulula za kuchotsa. kusatetezeka kwambiri (CVE-2020-6096) mu Glibc, yomwe imangowonekera pa nsanja ya ARMv7. Zambiri zokhudzana ndi chiwopsezo zidawululidwa kale mu Meyi, koma mpaka masiku aposachedwa, kukonza sikunapezeke, ngakhale kuti zofookazo zinalipo. kupatsidwa chiopsezo chachikulu ndipo pali chiwonetsero chogwira ntchito chomwe chimakupatsani mwayi wokonza ma code pamene mukukonza deta yokonzedwa mwanjira inayake mu memcpy () ndi memmove () ntchito. Kukonzekera kwa paketi Debian ΠΈ Ubuntu sichinatulutsidwebe ndipo chiwopsezocho sichinakhazikike kwa pafupifupi miyezi iwiri kuchokera pomwe anthu adawululira komanso miyezi isanu kuchokera pomwe opanga Glibc adadziwitsidwa.

Chiwopsezocho chinadziwonetsera pakukhazikitsa memcpy() ndi memmove() m'chilankhulo cholumikizira cha ARMv7 ndipo kudachitika chifukwa chakusintha kolakwika kwazinthu zoyipa za parameter yomwe imatsimikizira kukula kwa malo omwe adakopera. Mavuto ndi chitukuko cha zigamba anayamba pamene makampani SUSE ΠΈ Red Hat adalengeza kuti nsanja zawo sizikukhudzidwa ndi vutoli, popeza samamanga machitidwe a 32-bit ARMv7, ndipo sanatenge nawo gawo popanga kukonza. Opanga magawo ambiri ophatikizidwa akuwoneka kuti adalira gulu la Glibc, ndipo sanatenge nawo gawo pokonzekera kukonza.

Zosankha chigamba Kuti aletse vutoli, Huawei pafupifupi nthawi yomweyo adaganiza kuti ayese kusintha malangizo a msonkhano omwe akugwira ntchito ndi ma operands osayinidwa (bge ndi blt) ndi ma analogi osasainidwa (blo ndi bhs). Osamalira a Glibc adapanga mayeso kuti awone zolakwika zosiyanasiyana, pambuyo pake zidapezeka kuti chigamba cha Huawei sichinali choyenera ndipo sichinakonze zophatikizira zonse zomwe zingatheke.

Popeza Aurora OS ili ndi 32-bit yomanga ya ARM, opanga ake adaganiza zotseka chiwopsezo pawokha ndikupereka yankho kwa anthu ammudzi. Chovuta chinali chakuti kunali koyenera kulemba bwino chinenero cha msonkhano kukhazikitsidwa kwa ntchitoyo ndikuganizira zosankha zosiyanasiyana zotsutsana. Kukhazikitsa kwalembedwanso pogwiritsa ntchito malangizo omwe sanasainidwe. Chigamba Zinapezeka kuti zinali zazing'ono, koma vuto lalikulu linali kusunga liwiro la kuphedwa ndikupewa kuwonongeka kwa magwiridwe antchito a memcpy ndi memmove, ndikusunga kuyenderana ndi zosakaniza zonse zolowera.

Kumayambiriro kwa Juni, mitundu iwiri yakukonzekera idakonzedwa, kupititsa mayeso a oyang'anira Glibc ndi mayeso amkati a Aurora. Pa June 3, chimodzi mwazosankha chinasankhidwa ndi kutumiza ku mndandanda wamakalata a Glibc. Patapita sabata
anali analimbikitsa chigamba china chofanana ndi njira, chomwe chinakonza vuto pakukhazikitsa ma multiarch, omwe Huawei adayesa kale kukonza. Kuyesedwa kunatenga mwezi ndi kulembetsa mwalamulo chifukwa cha kufunikira kwa chigambacho.
July 8 zosintha anavomerezedwa ku nthambi yayikulu yakutulutsidwa kwa glibc 2.32 komwe kukubwera. Kukhazikitsa kuli ndi zigawo ziwiri - ΠΏΠ΅Ρ€Π²Ρ‹ΠΉ pakukhazikitsa ma multiarch a memcpy a ARMv7, ndi wachiwiri pakukhazikitsa chilankhulo cha memcpy() ndi memmove() cha ARM.

Vutoli limakhudza mamiliyoni a zida za ARMv7 zomwe zikuyenda pa Linux, ndipo popanda kusintha koyenera, eni ake ali pachiwopsezo powalumikiza ku netiweki (mautumiki ofikira pa netiweki ndi mapulogalamu omwe amavomereza zolowetsa popanda zoletsa za kukula akhoza kuwukiridwa). Mwachitsanzo, kugwiritsidwa ntchito kokonzedwa ndi ofufuza omwe adazindikira kuti ali pachiwopsezo akuwonetsa momwe angawukire seva ya HTTP yomangidwa mumayendedwe azidziwitso zamagalimoto potumiza pempho lalikulu kwambiri la GET ndikupeza mizu ku dongosolo.

Source: opennet.ru

Kuwonjezera ndemanga