{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"A Checkpoint prop\u00f4s a t\u00e9cnica de prote\u00e7\u00e3o Safe-Linking, que dificulta a explora\u00e7\u00e3o de vulnerabilidades.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A empresa Checkpoint apresentou<\/a><\/noindex> \u00e9 um mecanismo de prote\u00e7\u00e3o Safe-Linking, projetado para dificultar a cria\u00e7\u00e3o de exploits que manipulam a defini\u00e7\u00e3o ou a altera\u00e7\u00e3o de ponteiros para buffers alocados durante a chamada de malloc. O Safe-Linking n\u00e3o bloqueia totalmente a explora\u00e7\u00e3o de vulnerabilidades, mas aumenta significativamente a complexidade de cria\u00e7\u00e3o de algumas categorias de exploits com um custo m\u00ednimo, uma vez que, al\u00e9m do estouro de buffer explor\u00e1vel, \u00e9 necess\u00e1rio encontrar outra vulnerabilidade que provoque uma vazamento de informa\u00e7\u00f5es sobre a aloca\u00e7\u00e3o de heap na mem\u00f3ria.<\/p>\n

Os patches com a implementa\u00e7\u00e3o do Safe-Linking foram preparados para Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) e Google TCMalloc, e tamb\u00e9m foram sugeridos para moderniza\u00e7\u00e3o da prote\u00e7\u00e3o no Chromium (em
\nO Chromium desde 2012 j\u00e1 possui uma t\u00e9cnica de prote\u00e7\u00e3o chamada MaskPtr, que visa resolver o mesmo problema, mas a solu\u00e7\u00e3o da Checkpoint demonstra um desempenho superior).
\nOs patches sugeridos j\u00e1 foram aprovados para inclus\u00e3o na vers\u00e3o de agosto Glibc 3.32<\/a><\/noindex> e a implementa\u00e7\u00e3o do Safe-Linking ser\u00e1 inclu\u00edda por padr\u00e3o. No uClibc-NG, o suporte ao Safe-Linking entrou<\/a><\/noindex> est\u00e1 inclu\u00eddo na vers\u00e3o 1.0.33 e ativado por padr\u00e3o. No gperftools (o antigo tcmalloc), as altera\u00e7\u00f5es foram aceitas<\/a><\/noindex>, mas ser\u00e3o propostas em uma das pr\u00f3ximas vers\u00f5es como uma op\u00e7\u00e3o. <\/p>\n

Desenvolvedores TCMalloc<\/a><\/noindex> (o novo tcmalloc) optou por n\u00e3o aceitar a mudan\u00e7a<\/a><\/noindex>, referindo-se \u00e0 forte diminui\u00e7\u00e3o do desempenho e \u00e0 necessidade de adicionar testes adicionais para verificar regularmente se tudo est\u00e1 funcionando corretamente. Os testes realizados pelos engenheiros da Checkpoint mostraram que o m\u00e9todo Safe-Linking n\u00e3o leva a um consumo de mem\u00f3ria adicional, e o desempenho durante as opera\u00e7\u00f5es com a pilha, em m\u00e9dia, diminui apenas 0,02%, e nas piores circunst\u00e2ncias, 1,5% (para compara\u00e7\u00e3o, as despesas gerais no m\u00e9todo utilizado no Chromium s\u00e3o estimadas como 'menos de 2%'). A inclus\u00e3o
\ndo Safe-Linking resulta em 2-3 instru\u00e7\u00f5es adicionais de assembly sendo executadas em cada chamada de free() e 3-4 instru\u00e7\u00f5es durante a chamada de malloc(). N\u00e3o \u00e9 necess\u00e1rio executar etapas de inicializa\u00e7\u00e3o e gera\u00e7\u00e3o de valores aleat\u00f3rios.<\/p>\n

\"A<\/a><\/noindex><\/center><\/p>\n

O Safe-Linking pode ser aplicado n\u00e3o apenas para aumentar a seguran\u00e7a de v\u00e1rias implementa\u00e7\u00f5es de heap, mas tamb\u00e9m para adicionar mecanismos de controle de integridade a quaisquer estruturas de dados que utilizem listas encadeadas de ponteiros, que s\u00e3o colocadas ao lado dos pr\u00f3prios buffers. O m\u00e9todo \u00e9 muito simples de implementar e requer apenas a adi\u00e7\u00e3o de um macro e sua aplica\u00e7\u00e3o aos ponteiros do pr\u00f3ximo bloco no c\u00f3digo (por exemplo, para Glibc \u00e9 alterado<\/a><\/noindex> apenas algumas linhas no c\u00f3digo). O m\u00e9todo se resume \u00e0s seguintes altera\u00e7\u00f5es:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n \u2026<\/p>\n

A ess\u00eancia do m\u00e9todo \u00e9 a aplica\u00e7\u00e3o de dados aleat\u00f3rios do mecanismo de randomiza\u00e7\u00e3o de endere\u00e7os ASLR (mmap_base) para proteger listas encadeadas simples, como Fast-Bins e TCache. Antes da aplica\u00e7\u00e3o ao valor do ponteiro para o pr\u00f3ximo elemento na lista, \u00e9 realizada uma transforma\u00e7\u00e3o atrav\u00e9s de uma m\u00e1scara e uma verifica\u00e7\u00e3o de alinhamento \u00e0 fronteira da p\u00e1gina de mem\u00f3ria. O ponteiro \u00e9 substitu\u00eddo pelo resultado da opera\u00e7\u00e3o '(L >> PAGE_SHIFT) XOR (P)', onde P \u00e9 o valor do ponteiro, e L \u00e9 a localiza\u00e7\u00e3o na mem\u00f3ria onde esse ponteiro \u00e9 armazenado.
\n

\"A<\/a><\/noindex><\/center><\/p>\n

Ao ser usado no sistema ASLR<\/a><\/noindex> (Address Space Layout Randomization) parte dos bits L com o endere\u00e7o base do heap cont\u00e9m valores aleat\u00f3rios, que s\u00e3o usados como chave para codificar P (extra\u00eddos pela opera\u00e7\u00e3o de deslocamento de 12 bits para p\u00e1ginas de 4096 bytes). Essa manipula\u00e7\u00e3o reduz o risco de captura do ponteiro em um exploit, uma vez que o ponteiro n\u00e3o \u00e9 armazenado em sua forma original e para sua substitui\u00e7\u00e3o \u00e9 necess\u00e1rio conhecer informa\u00e7\u00f5es sobre a aloca\u00e7\u00e3o do heap. Al\u00e9m disso, o c\u00f3digo do patch tamb\u00e9m inclui uma verifica\u00e7\u00e3o adicional de alinhamento do bloco, que impede que um atacante substitua o ponteiro por um valor desalinhado e requer conhecimento do n\u00famero de bits pelo qual o alinhamento foi feito, o que em sistemas de 64 bits adicionalmente bloqueia 15 de 16 tentativas de ataque que n\u00e3o consideram o alinhamento.<\/p>\n

O m\u00e9todo \u00e9 eficaz para proteger contra ataques que utilizam a sobreposi\u00e7\u00e3o parcial de ponteiros (modifica\u00e7\u00e3o dos bytes menos significativos), a reescrita completa de ponteiros (redirecionamento para o c\u00f3digo do atacante) e mudan\u00e7a de posi\u00e7\u00e3o da lista em um endere\u00e7o desalinhado. Como exemplo, foi mostrado que a aplica\u00e7\u00e3o do Safe-Linking no malloc poderia bloquear a explora\u00e7\u00e3o de uma recentemente descoberta<\/a><\/noindex> as mesmas vulnerabilidades investigadas CVE-2020-6007<\/a><\/noindex> na ilumina\u00e7\u00e3o inteligente do Philips Hue Bridge, causada por um buffer overflow, permitindo obter controle sobre o dispositivo.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint apresentou a t\u00e9cnica de prote\u00e7\u00e3o Safe-Linking, que dificulta a explora\u00e7\u00e3o de vulnerabilidades | ProHoster","description":"A empresa Checkpoint apresentou o mecanismo de prote\u00e7\u00e3o Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}