{"id":83016,"date":"2020-05-27T19:41:58","date_gmt":"2020-05-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket"},"modified":"2020-05-27T19:41:58","modified_gmt":"2020-05-27T17:41:58","slug":"25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","title":{"rendered":"25 vulnerabilidades no RTOS Zephyr, incluindo aquelas explor\u00e1veis via pacotes ICMP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pesquisadores da NCC Group publicaram<\/a><\/noindex> os resultados da auditoria de um projeto de c\u00f3digo aberto Zephyr<\/a><\/noindex>, em desenvolvimento<\/a><\/noindex> um sistema operacional em tempo real (RTOS) voltado para a capacita\u00e7\u00e3o de dispositivos conforme o conceito de «Internet das Coisas» (IoT, Internet of Things). Durante a auditoria, foram identificados 25 vulnerabilidades<\/a><\/noindex> no Zephyr e 1 vulnerabilidade no MCUboot. O desenvolvimento do Zephyr conta com a participa\u00e7\u00e3o de empresas como a Intel. <\/p>\n

no total, foram identificadas 6 vulnerabilidades na pilha de rede, 4 \u2014 no kernel, 2 \u2014 no shell, 5 nos manipuladores de chamadas de sistema, 5 no subsistema USB e 3 no mecanismo de atualiza\u00e7\u00e3o de firmware. Duas quest\u00f5es foram classificadas como cr\u00edticas, duas como altas, 9 como moderadas, 9 como baixas e 4 para considera\u00e7\u00e3o. Os problemas cr\u00edticos afetam a pilha IPv4 e o analisador MQTT, enquanto os perigosos envolvem os drivers USB de armazenamento em massa e USB DFU. No momento da divulga\u00e7\u00e3o, corre\u00e7\u00f5es estavam dispon\u00edveis apenas para as 15 vulnerabilidades mais cr\u00edticas, permanecendo sem solu\u00e7\u00e3o os problemas que podem causar nega\u00e7\u00e3o de servi\u00e7o ou est\u00e3o relacionados a defici\u00eancias nos mecanismos adicionais de prote\u00e7\u00e3o do kernel.<\/p>\n

Na pilha IPv4 da plataforma, foi descoberta uma vulnerabilidade explor\u00e1vel remotamente que causa corrup\u00e7\u00e3o de mem\u00f3ria ao processar pacotes ICMP modificados de forma espec\u00edfica. Outro grave problema encontrado no analisador do protocolo MQTT \u00e9 causado pela falta de verifica\u00e7\u00e3o adequada do comprimento dos campos no cabe\u00e7alho, podendo levar \u00e0 execu\u00e7\u00e3o remota de c\u00f3digo. Problemas menos perigosos que causam nega\u00e7\u00e3o de servi\u00e7o foram encontrados na pilha IPv6 e na implementa\u00e7\u00e3o do protocolo CoAP.<\/p>\n

As demais quest\u00f5es podem ser exploradas localmente para causar nega\u00e7\u00e3o de servi\u00e7o ou execu\u00e7\u00e3o de c\u00f3digo no n\u00edvel do kernel. A maioria dessas vulnerabilidades est\u00e1 relacionada \u00e0 falta de verifica\u00e7\u00f5es adequadas nos argumentos das chamadas de sistema, o que pode resultar em grava\u00e7\u00f5es e leituras em \u00e1reas arbitr\u00e1rias da mem\u00f3ria do kernel. Os problemas tamb\u00e9m abrangem diretamente o c\u00f3digo de manipula\u00e7\u00e3o das chamadas de sistema \u2014 acessos com n\u00fameros negativos de chamadas de sistema levam a estouro de inteiro. Al\u00e9m disso, foram identificados problemas na implementa\u00e7\u00e3o da prote\u00e7\u00e3o ASLR (randomiza\u00e7\u00e3o do espa\u00e7o de endere\u00e7os) e no mecanismo de configura\u00e7\u00e3o de marcadores can\u00e1rios na pilha, tornando esses mecanismos ineficazes. <\/p>\n

Muitos problemas envolvem a pilha USB e drivers individuais. Por exemplo, um problema no armazenamento USB em massa pode causar um estouro de buffer e executar c\u00f3digo em n\u00edvel de kernel ao conectar o dispositivo a um host USB controlado por um atacante. Uma vulnerabilidade no USB DFU, um driver para carregar novo firmware via USB, permite carregar uma imagem de firmware modificada na mem\u00f3ria flash interna do microcontrolador sem a aplica\u00e7\u00e3o de criptografia e contornando o modo de inicializa\u00e7\u00e3o segura com verifica\u00e7\u00e3o de componentes por assinatura digital. Al\u00e9m disso, o c\u00f3digo do carregador aberto foi estudado. MCUboot<\/a><\/noindex>, no qual foi encontrada uma vulnerabilidade n\u00e3o cr\u00edtica,
\nque pode levar a um estouro de buffer ao usar o protocolo SMP (Simple Management Protocol) atrav\u00e9s de UART.<\/p>\n

Vale lembrar que no Zephyr todos os processos t\u00eam apenas um \u00fanico espa\u00e7o de endere\u00e7amento global compartilhado (SASOS, Sistema Operacional de Espa\u00e7o de Endere\u00e7amento \u00danico). O c\u00f3digo espec\u00edfico de aplica\u00e7\u00f5es \u00e9 combinado com um kernel adaptado para uma aplica\u00e7\u00e3o espec\u00edfica, formando um arquivo execut\u00e1vel monol\u00edtico para carregar e executar em hardware espec\u00edfico. Todos os recursos do sistema s\u00e3o definidos na fase de compila\u00e7\u00e3o, o que reduz o tamanho do c\u00f3digo e aumenta o desempenho. Apenas aqueles recursos do kernel que s\u00e3o necess\u00e1rios para a execu\u00e7\u00e3o da aplica\u00e7\u00e3o podem ser inclu\u00eddos na imagem do sistema.<\/p>\n

Notavelmente, entre as principais vantagens do Zephyr \u00e9 mencionada<\/a><\/noindex> a desenvolvimento com foco em seguran\u00e7a. Alega-se<\/a><\/noindex>, que todas as etapas do desenvolvimento passam por etapas obrigat\u00f3rias de valida\u00e7\u00e3o da seguran\u00e7a do c\u00f3digo: teste de fuzzing, an\u00e1lise est\u00e1tica, testes de penetra\u00e7\u00e3o, revis\u00e3o de c\u00f3digo, an\u00e1lise de backdoors e modelagem de amea\u00e7as.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Zephyr, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (RTOS), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 «\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0432\u0435\u0449\u0435\u0439» (IoT, Internet of Things). \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 25 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Zephyr \u0438 1 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MCUboot. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 Zephyr \u0432\u0435\u0434\u0451\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intel. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83016","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4725 vulnerabilidades no RTOS Zephyr, incluindo aquelas explor\u00e1veis atrav\u00e9s de pacotes ICMP | ProHoster","description":"Pesquisadores da NCC Group publicaram os resultados da auditoria.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4725 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 RTOS Zephyr, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 ICMP-\u043f\u0430\u043a\u0435\u0442 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T17:41:58+00:00","article:modified_time":"2020-05-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83016","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:51:14","updated":"2022-10-02 09:38:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/83016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=83016"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/83016\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=83016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=83016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=83016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}