{"id":82556,"date":"2020-05-22T19:41:55","date_gmt":"2020-05-22T17:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc"},"modified":"2020-05-22T19:41:55","modified_gmt":"2020-05-22T17:41:55","slug":"kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","title":{"rendered":"Vulnerabilitate critic\u0103 \u00een implementarea func\u021biei memcpy pentru ARMv7 din Glibc","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii \u00een securitate de la compania Cisco au dezv\u0103luit<\/a><\/noindex> detalii vulnerabilit\u0103\u021bi<\/a><\/noindex> (CVE-2020-6096<\/a><\/noindex>) \u00een implementarea func\u021biei memcpy() din Glibc pentru platforma ARMv7 pe 32 de bi\u021bi. Problema este cauzat\u0103 de o procesare incorect\u0103 a valorilor negative ale parametrului care determin\u0103 dimensiunea zonei copiate, din cauza utiliz\u0103rii optimiz\u0103rilor de asamblare care manipuleaz\u0103 numere \u00eentregi semnate pe 32 de bi\u021bi. Apelul func\u021biei memcpy() pe sistemele ARMv7 cu o dimensiune negativ\u0103 duce la o compara\u021bie incorect\u0103 a valorilor \u0219i scriere \u00een zone \u00een afara limitelor buffer-ului specificat.<\/p>\n

Vulnerabilitatea poate fi exploatat\u0103 pentru a executa cod \u00een situa\u021bia \u00een care un atacator poate provoca generarea unei valori negative a variabilei prin care este transmis\u0103 dimensiunea datelor copiate (de exemplu, trecerea \u00een minus se va produce la transmiterea a mai mult de 2 GB de date, dar \u00een timpul atacului pentru a dep\u0103\u0219i buffer-ul trebuie s\u0103 fie transmise cel pu\u021bin 4GB). Func\u021bia memcpy() este utilizat\u0103 frecvent \u00een aplica\u021bii, iar procesoarele ARMv7 sunt r\u0103sp\u00e2ndite \u00een sisteme auto, dispozitive mobile, industriale, de consum, de comunica\u021bie \u0219i \u00eencorporate, care pot deveni poten\u021biale obiecte ale atacurilor utiliz\u00e2nd Bluetooth, HD Radio\/DAB, USB, CAN bus, Wi-Fi \u0219i alte surse externe de date (de exemplu, pot fi atacate serviciile \u0219i aplica\u021biile disponibile pe re\u021bea care accept\u0103 datele de intrare f\u0103r\u0103 restric\u021bii de dimensiune).<\/p>\n

Ca exemplu este prezentat un exploit func\u021bional pentru atacul asupra serverului http \u00eencorporat \u00een sistemele de informare ale automobilelor, accesibil prin re\u021beaua Wi-Fi a ma\u0219inii. Un atacator extern poate exploata vulnerabilitatea din memcpy \u00een acest server prin transmiterea unei cereri GET de dimensiuni foarte mari \u0219i ob\u021bine acces root la sistem.<\/p>\n

\"Vulnerabilitate<\/a><\/noindex><\/center><\/p>\n

Pe sistemele pe 32 de bi\u021bi x86, problema nu se manifest\u0103, deoarece implementarea memcpy pentru aceast\u0103 arhitectur\u0103 interpreteaz\u0103 corect variabila de dimensiune ca un num\u0103r \u00eentreg f\u0103r\u0103 semn de tip size_t (\u00een asamblare, pentru ARMv7 \u00een loc de size_t este tratat ca un \u00eentreg semnat). Corec\u021bia este \u00een prezent disponibil\u0103 sub forma implementare<\/a><\/noindex> , care va fi inclus \u00een actualizarea din august a Glibc 2.32. patch<\/a><\/noindex>Corec\u021bia const\u0103 \u00een \u00eenlocuirea utiliz\u0103rii instruc\u021biunilor de asamblare care opereaz\u0103 cu operanzi semna\u021bi (bge \u0219i blt) cu analoge f\u0103r\u0103 semn (blo \u0219i bhs).
\nProblema nu a fost \u00eenc\u0103 rezolvat\u0103 \u00een <\/p>\n

Debian 9 \u0219i 10 (\u00een Debian 8 nu se manifest\u0103),<\/a><\/noindex> (nu se manifest\u0103 \u00een Debian 8), Fedora<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, OpenEmbedded, Tizen (utilizeaz\u0103 glibc). RHEL<\/a><\/noindex> \u0219i SUSE<\/a><\/noindex> problema nu afecteaz\u0103, deoarece acestea nu suport\u0103 sistemele ARMv7 de 32 de bi\u021bi. Android nu este vulnerabil, deoarece folose\u0219te propria implementare libc (Bionic). \u00cen OpenWRT<\/a><\/noindex> mod default, \u00een majoritatea versiunilor se folose\u0219te Musl, dar \u00een depozit exist\u0103 \u0219i glibc.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cisco \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-6096) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0432 Glibc \u0444\u0443\u043d\u043a\u0446\u0438\u0438 memcpy() \u0434\u043b\u044f 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b ARMv7. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u0440\u0438\u0446\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440 \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438, \u0438\u0437-\u0437\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0441\u0441\u0435\u043c\u0431\u043b\u0435\u0440\u043d\u044b\u0445 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0439, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0437\u043d\u0430\u043a\u043e\u0432\u044b\u043c\u0438 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u043c\u0438 \u0446\u0435\u043b\u044b\u043c\u0438 \u0447\u0438\u0441\u043b\u0430\u043c\u0438. \u0412\u044b\u0437\u043e\u0432 memcpy() \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 ARMv7 \u0441 \u043e\u0442\u0440\u0438\u0446\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u043c\u0443 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82557,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82556","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate critic\u0103 \u00een implementarea func\u021biei memcpy pentru ARMv7 din Glibc | ProHoster","description":"Cercet\u0103torii \u00een securitate de la Cisco au dezv\u0103luit detalii","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 memcpy \u0434\u043b\u044f ARMv7 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Glibc | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cisco \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-uyazvimost-v-realizaczii-funkczii-memcpy-dlya-armv7-iz-sostava-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-22T17:41:55+00:00","article:modified_time":"2020-05-22T17:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82556","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:35:23","updated":"2022-09-28 08:25:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=82556"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82556\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/82557"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=82556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=82556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=82556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}