{"id":82793,"date":"2020-05-25T07:41:55","date_gmt":"2020-05-25T05:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu"},"modified":"2020-05-25T07:41:55","modified_gmt":"2020-05-25T05:41:55","slug":"70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","title":{"rendered":"70% dos problemas de seguran\u00e7a no Chromium s\u00e3o causados por erros de gerenciamento de mem\u00f3ria","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Desenvolvedores do projeto Chromium <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/memory-safety\">analisaram<\/a><\/noindex> 912 vulnerabilidades perigosas e cr\u00edticas identificadas nas vers\u00f5es est\u00e1veis do Chrome desde 2015, e foi conclu\u00eddo que 70% delas foram causadas por manipula\u00e7\u00e3o insegura da mem\u00f3ria (erros no uso de ponteiros no c\u00f3digo em C\/C++). Metade desses problemas (36,1%) \u00e9 causada por acessos ao buffer ap\u00f3s a libera\u00e7\u00e3o da mem\u00f3ria associada (use-after-free).<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/_\/rsrc\/1589581287612\/Home\/chromium-security\/memory-safety\/piechart.png\"><img decoding=\"async\" alt=\"70% dos problemas de seguran\u00e7a no Chromium s\u00e3o causados por erros de gerenciamento de mem\u00f3ria\" src=\"\/wp-content\/uploads\/2020\/05\/31912b956dc2548e17b682d29dbab909.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>No design do Chromium, foi originalmente <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/guts\">considerado<\/a><\/noindex>, que erros no c\u00f3digo n\u00e3o poderiam ser exclu\u00eddos, portanto, uma grande \u00eanfase foi colocada na aplica\u00e7\u00e3o da isolamento sandbox para limitar as consequ\u00eancias da manifesta\u00e7\u00e3o de vulnerabilidades. Atualmente, as capacidades de aplica\u00e7\u00e3o desta tecnologia atingiram o limite de suas possibilidades e a fragmenta\u00e7\u00e3o adicional em processos n\u00e3o \u00e9 vi\u00e1vel do ponto de vista do consumo de recursos. <\/p>\n<p>Para manter a seguran\u00e7a da base de c\u00f3digo, o Google tamb\u00e9m aplica &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/chromium.googlesource.com\/chromium\/src\/+\/master\/docs\/security\/rule-of-2.md\">regra dos dois<\/a><\/noindex>&#171;, de acordo com o qual qualquer c\u00f3digo adicionado deve atender a n\u00e3o mais do que duas das tr\u00eas condi\u00e7\u00f5es: trabalhar com entradas n\u00e3o verificadas, usar uma linguagem de programa\u00e7\u00e3o n\u00e3o segura (C\/C++) e executar com privil\u00e9gios elevados. Dessa regra, conclui-se que o c\u00f3digo para o processamento de dados externos deve ser ou reduzido ao m\u00ednimo de privil\u00e9gios (isolado), ou escrito em uma linguagem de programa\u00e7\u00e3o segura.<\/p>\n<p>Para aumentar ainda mais a seguran\u00e7a da base de c\u00f3digo, foi lan\u00e7ado um projeto para evitar a manifesta\u00e7\u00e3o de erros de manipula\u00e7\u00e3o de mem\u00f3ria na base de c\u00f3digo. Tr\u00eas abordagens principais est\u00e3o sendo destacadas: cria\u00e7\u00e3o de bibliotecas C++ com fun\u00e7\u00f5es para manipula\u00e7\u00e3o segura da mem\u00f3ria e amplia\u00e7\u00e3o do escopo do coletor de lixo, aplica\u00e7\u00e3o de mecanismos de prote\u00e7\u00e3o de hardware <noindex><a rel=\"nofollow\" href=\"https:\/\/llvm.org\/devmtg\/2018-10\/slides\/Serebryany-Stepanov-Tsyrklevich-Memory-Tagging-Slides-LLVM-2018.pdf\">MTE<\/a><\/noindex> (Memory Tagging Extension) e escrita de componentes em linguagens que garantem manipula\u00e7\u00e3o segura da mem\u00f3ria (Java, Kotlin, JavaScript, Rust, Swift).<\/p>\n<p>Espera-se que o trabalho esteja focado em duas dire\u00e7\u00f5es: <\/p>\n<ul>\n<li class=\"l\"> Mudan\u00e7a significativa do processo de desenvolvimento em C++, sem excluir a possibilidade de impacto negativo no desempenho (verifica\u00e7\u00f5es adicionais de limites e coleta de lixo). Em vez de ponteiros raw, prop\u00f5e-se o uso no c\u00f3digo do tipo <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/document\/d\/1pnnOAIz_DMWDI4oIOFoMAqLnf_MZ2GsrJNb_dbQ3ZBg\/edit#heading=h.jx7cpliyfer\">MiraclePtr<\/a><\/noindex>, que permite reduzir erros explor\u00e1veis do tipo use-after-free a falhas que n\u00e3o representam risco \u00e0 seguran\u00e7a, sem impacto negativo significativo no desempenho, consumo de mem\u00f3ria e estabilidade.\n<li class=\"l\"> A aplica\u00e7\u00e3o de linguagens projetadas para realizar verifica\u00e7\u00f5es de seguran\u00e7a da mem\u00f3ria durante a compila\u00e7\u00e3o (permitindo eliminar o impacto negativo na performance, caracter\u00edstico de tais verifica\u00e7\u00f5es durante a execu\u00e7\u00e3o do c\u00f3digo, mas levando a custos adicionais na organiza\u00e7\u00e3o da intera\u00e7\u00e3o do c\u00f3digo em uma nova linguagem com o c\u00f3digo em C++).\n<\/ul>\n<p>O uso de bibliotecas para o manejo seguro da mem\u00f3ria \u00e9 a abordagem mais simples, mas menos eficaz. Reescrever o c\u00f3digo em Rust \u00e9 considerado o caminho mais eficaz, mas tamb\u00e9m muito caro.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/a77db9aa-a-7b23c8ea-s-sites.googlegroups.com\/a\/chromium.org\/dev\/Home\/chromium-security\/memory-safety\/sat3CHOc8lXZbGicChW6w5Q.png?attachauth=ANoY7cqyfZiTko5osYGVMP1ewI31nrE7lTP8m8fXIDsqh42vdzKk9CPyjYMd54R7RUD3QviaGPZKpgWTOFblPaSIGPePPGlMbi9rN1ZbO4lhXjP7mfoJCt5i_m7cFFFesGuNIVU0hjjc7M-FTXLyjc_YqMxC7-NUPaFMZe_83_IuUY6frEvOHBZ-6AxVa-PU49aLScaDVt6z3SSF1krIhvKgjaZjUeI0hhgKDayLg13AFRHUidIJd5wnbvomNQyzuH3wD6DxMfh2lrQ6EK3hK7RTMw-eMeWAEw%3D%3D&#038;attredirects=0\"><img decoding=\"async\" alt=\"70% dos problemas de seguran\u00e7a no Chromium s\u00e3o causados por erros de gerenciamento de mem\u00f3ria\" src=\"\/wp-content\/uploads\/2020\/05\/48aac9ae5a251323dddebf73dfa73286.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53019\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Chrome \u0441 2015 \u0433\u043e\u0434\u0430, \u0438 \u043f\u0440\u0438\u0448\u043b\u0438 \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e 70% \u0438\u0437 \u043d\u0438\u0445 \u0431\u044b\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e (\u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043d\u0430 C\/C++). \u041f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0438\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c (36.1%) \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0443\u0444\u0435\u0440\u0443 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u043f\u0430\u043c\u044f\u0442\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82794,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82793","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4770% dos problemas de seguran\u00e7a no Chromium s\u00e3o causados por erros no manejo da mem\u00f3ria | ProHoster","description":"Os desenvolvedores do projeto Chromium analisaram 912 vulnerabilidades cr\u00edticas e perigosas identificadas em.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-25T05:41:55+00:00","article:modified_time":"2020-05-25T05:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82793","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:31:26","updated":"2022-09-30 17:34:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/82793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=82793"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/82793\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/82794"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=82793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=82793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=82793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}