Glibc ikuphatikiza kukonza kusatetezeka kwa memcpy kokonzedwa ndi opanga Aurora OS

Opanga makina ogwiritsira ntchito mafoni a Aurora (foloko la Sailfish OS lopangidwa ndi kampani ya Open Mobile Platform) adagawana nkhani yowulula za kuchotsa. kusatetezeka kwambiri (CVE-2020-6096) mu Glibc, yomwe imangowonekera pa nsanja ya ARMv7. Zambiri zokhudzana ndi chiwopsezo zidawululidwa kale mu Meyi, koma mpaka masiku aposachedwa, kukonza sikunapezeke, ngakhale kuti zofookazo zinalipo. kupatsidwa chiopsezo chachikulu ndipo pali chiwonetsero chogwira ntchito chomwe chimakupatsani mwayi wokonza ma code pamene mukukonza deta yokonzedwa mwanjira inayake mu memcpy () ndi memmove () ntchito. Kukonzekera kwa paketi Debian и Ubuntu sichinatulutsidwebe ndipo chiwopsezocho sichinakhazikike kwa pafupifupi miyezi iwiri kuchokera pomwe anthu adawululira komanso miyezi isanu kuchokera pomwe opanga Glibc adadziwitsidwa.

Chiwopsezocho chinadziwonetsera pakukhazikitsa memcpy() ndi memmove() m'chilankhulo cholumikizira cha ARMv7 ndipo kudachitika chifukwa chakusintha kolakwika kwazinthu zoyipa za parameter yomwe imatsimikizira kukula kwa malo omwe adakopera. Mavuto ndi chitukuko cha zigamba anayamba pamene makampani SUSE и Red Hat adalengeza kuti nsanja zawo sizikukhudzidwa ndi vutoli, popeza samamanga machitidwe a 32-bit ARMv7, ndipo sanatenge nawo gawo popanga kukonza. Opanga magawo ambiri ophatikizidwa akuwoneka kuti adalira gulu la Glibc, ndipo sanatenge nawo gawo pokonzekera kukonza.

Zosankha chigamba Kuti aletse vutoli, Huawei pafupifupi nthawi yomweyo adaganiza kuti ayese kusintha malangizo a msonkhano omwe akugwira ntchito ndi ma operands osayinidwa (bge ndi blt) ndi ma analogi osasainidwa (blo ndi bhs). Osamalira a Glibc adapanga mayeso kuti awone zolakwika zosiyanasiyana, pambuyo pake zidapezeka kuti chigamba cha Huawei sichinali choyenera ndipo sichinakonze zophatikizira zonse zomwe zingatheke.

Popeza Aurora OS ili ndi 32-bit yomanga ya ARM, opanga ake adaganiza zotseka chiwopsezo pawokha ndikupereka yankho kwa anthu ammudzi. Chovuta chinali chakuti kunali koyenera kulemba bwino chinenero cha msonkhano kukhazikitsidwa kwa ntchitoyo ndikuganizira zosankha zosiyanasiyana zotsutsana. Kukhazikitsa kwalembedwanso pogwiritsa ntchito malangizo omwe sanasainidwe. Chigamba Zinapezeka kuti zinali zazing'ono, koma vuto lalikulu linali kusunga liwiro la kuphedwa ndikupewa kuwonongeka kwa magwiridwe antchito a memcpy ndi memmove, ndikusunga kuyenderana ndi zosakaniza zonse zolowera.

Kumayambiriro kwa Juni, mitundu iwiri yakukonzekera idakonzedwa, kupititsa mayeso a oyang'anira Glibc ndi mayeso amkati a Aurora. Pa June 3, chimodzi mwazosankha chinasankhidwa ndi kutumiza ku mndandanda wamakalata a Glibc. Patapita sabata
anali analimbikitsa chigamba china chofanana ndi njira, chomwe chinakonza vuto pakukhazikitsa ma multiarch, omwe Huawei adayesa kale kukonza. Kuyesedwa kunatenga mwezi ndi kulembetsa mwalamulo chifukwa cha kufunikira kwa chigambacho.
July 8 zosintha anavomerezedwa ku nthambi yayikulu yakutulutsidwa kwa glibc 2.32 komwe kukubwera. Kukhazikitsa kuli ndi zigawo ziwiri - первый pakukhazikitsa ma multiarch a memcpy a ARMv7, ndi wachiwiri pakukhazikitsa chilankhulo cha memcpy() ndi memmove() cha ARM.

Vutoli likukhudza mamiliyoni a zida za ARMv7 ndi Linux Popanda zosintha zoyenera, eni ake amakhala pachiwopsezo chowalumikiza ku netiweki (ntchito zopezeka pa netiweki ndi mapulogalamu omwe amalandila deta yolowera popanda zoletsa kukula akhoza kuukiridwa). Mwachitsanzo, kugwiritsa ntchito komwe kunakonzedwa ndi ofufuza omwe adapeza kufooka kukuwonetsa momwe angaukire seva ya HTTP yomwe idamangidwa mu dongosolo lazidziwitso la galimotoyo potumiza pempho lalikulu kwambiri la GET ndikupeza mwayi wolowera mu dongosololi.

Source: opennet.ru

Gulani kuchititsa kodalirika kwamasamba okhala ndi chitetezo cha DDoS, ma seva a VPS VDS Gulani malo odalirika osungira mawebusayiti okhala ndi chitetezo cha DDoS, ma seva a VPS VDS | ProHoster