{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint a propus tehnica de protec\u021bie Safe-Linking, care complic\u0103 exploatarea vulnerabilit\u0103\u021bilor.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Checkpoint a prezentat<\/a><\/noindex> un mecanism de protec\u021bie Safe-Linking, care complic\u0103 crearea de exploate ce manipuleaz\u0103 defini\u021bia sau modificarea indicatoarelor c\u0103tre buffer-ele alocate \u00een timpul apelului malloc. Safe-Linking nu blocheaz\u0103 complet posibilitatea exploat\u0103rii vulnerabilit\u0103\u021bilor, dar cu un cost minimal complic\u0103 semnificativ crearea unor categorii de exploate, deoarece, pe l\u00e2ng\u0103 exploatarea supra\u00eenc\u0103rc\u0103rii buffer-ului, este necesar s\u0103 se g\u0103seasc\u0103 \u00eenc\u0103 o vulnerabilitate care s\u0103 provoace o scurgere de informa\u021bii despre plasarea heap-ului \u00een memorie.<\/p>\n

Patch-urile cu implementarea Safe-Linking sunt preg\u0103tite pentru Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) \u0219i Google TCMalloc, \u0219i de asemenea au fost propuse pentru modernizarea protec\u021biei \u00een Chromium (\u00een
\nChromium din 2012 este deja integrat\u0103 o tehnic\u0103 de protec\u021bie MaskPtr, care vizeaz\u0103 solu\u021bionarea acelea\u0219i probleme, dar solu\u021bia de la Checkpoint demonstreaz\u0103 o performan\u021b\u0103 mai ridicat\u0103).
\nPatch-urile propuse sunt deja aprobate pentru livrare \u00een versiunea din august Glibc 3.32<\/a><\/noindex> \u0219i utilizarea Safe-Linking va fi inclus\u0103 implicit. \u00cen uClibc-NG, suportul pentru Safe-Linking a intrat<\/a><\/noindex> face parte din versiunea 1.0.33 \u0219i este inclus implicit. \u00cen gperftools (vechiul tcmalloc) modific\u0103rile acceptate<\/a><\/noindex>, dar vor fi propuse \u00eentr-una din viitoarele versiuni ca op\u021biune. <\/p>\n

Dezvoltatori TCMalloc<\/a><\/noindex> (noul tcmalloc) a refuzat s\u0103 fie acceptat modificare<\/a><\/noindex>, f\u0103c\u00e2nd referire la sc\u0103derea semnificativ\u0103 a performan\u021bei \u0219i necesitatea ad\u0103ug\u0103rii testelor extinse pentru verificarea regulat\u0103 a func\u021bion\u0103rii corecte. Testele efectuate de inginerii Checkpoint au ar\u0103tat c\u0103 metoda Safe-Linking nu duce la un consum suplimentar de memorie, iar performan\u021ba la executarea opera\u021biunilor cu heap-ul scade \u00een medie cu doar 0.02%, iar \u00een cele mai nefavorabile circumstan\u021be cu 1.5% (pentru compara\u021bie, cheltuielile \u00een metoda utilizat\u0103 \u00een Chromium sunt estimate ca fiind \u201emai pu\u021bin de 2%\u201d). Activarea
\nSafe-Linking duce la executarea a 2-3 instruc\u021biuni assembly suplimentare la fiecare apel free() \u0219i 3-4 instruc\u021biuni la apelul malloc(). Rularea stadiilor de ini\u021bializare \u0219i generare de valori aleatorii nu este necesar\u0103.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking poate fi utilizat nu doar pentru a spori securitatea diverselor implement\u0103ri ale heap-ului, ci \u0219i pentru a ad\u0103uga mecanisme de control al integrit\u0103\u021bii \u00een orice structuri de date care folosesc liste simple de pointeri, plasate l\u00e2ng\u0103 buffer-urile \u00een sine. Metoda este foarte simpl\u0103 de implementat \u0219i necesit\u0103 doar ad\u0103ugarea unei macrocomenzi \u0219i aplicarea acesteia pe pointerii c\u0103tre urm\u0103torul bloc din cod (de exemplu, pentru Glibc se modific\u0103<\/a><\/noindex> doar c\u00e2teva linii \u00een cod). Metoda const\u0103 \u00een urm\u0103toarele modific\u0103ri:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n \u2026<\/p>\n

Esenta metodei este utilizarea datelor aleatorii din mecanismul de randomizare a adreselor ASLR (mmap_base) pentru a proteja listele simple, cum ar fi Fast-Bins \u0219i TCache. \u00cenainte de a aplica schimbarea la valoarea pointer-ului c\u0103tre urm\u0103torul element din list\u0103, se efectueaz\u0103 o conversie prin masc\u0103 \u0219i o verificare a aliniamentului pe limita paginii de memorie. Pointer-ul este \u00eenlocuit cu rezultatul opera\u021biei \u201e(L >> PAGE_SHIFT) XOR (P)\u201d, unde P este valoarea pointer-ului, iar L este loca\u021bia din memorie unde este stocat acest pointer.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

C\u00e2nd este utilizat \u00een sistem ASLR<\/a><\/noindex> (Address Space Layout Randomization) o parte din bi\u021bii L cu adresa de baz\u0103 a heap-ului con\u021bin valori aleatoare, care sunt utilizate ca o cheie pentru codificarea P (sunt extrase prin opera\u021bia de deplasare cu 12 bi\u021bi pentru paginile de 4096 de bytes). O astfel de manipulare reduce riscul captur\u0103rii pointerului \u00een exploit-uri, deoarece pointerul nu este stocat \u00een forma sa original\u0103 \u0219i pentru a-l \u00eenlocui este necesar s\u0103 se cunoasc\u0103 informa\u021biile despre alocarea heap-ului. \u00cen plus, \u00een codul patch-ului exist\u0103, de asemenea, o verificare suplimentar\u0103 a aliniamentului blocului, care nu permite atacatorului s\u0103 \u00eenlocuiasc\u0103 pointerul cu o valoare nealiniat\u0103 \u0219i necesit\u0103 cunoa\u0219terea num\u0103rului de bi\u021bi cu care s-a efectuat alinierea, ceea ce pe sistemele pe 64 de bi\u021bi blocheaz\u0103 suplimentar 15 din 16 \u00eencerc\u0103ri de atac, ne\u021bin\u00e2nd cont de aliniere.<\/p>\n

Metoda este eficient\u0103 pentru a proteja \u00eempotriva atacurilor care utilizeaz\u0103 redefinirea par\u021bial\u0103 a pointerilor (modificarea bi\u021bilor inferiori), rescrierea complet\u0103 a pointerilor (redirijarea c\u0103tre codul atacatorului) \u0219i schimbarea pozi\u021biei listei la o adres\u0103 nealiniat\u0103. Ca exemplu, s-a ar\u0103tat c\u0103 aplicarea Safe-Linking \u00een malloc ar bloca exploatarea recent\u0103. identificat\u0103<\/a><\/noindex> de c\u0103tre aceia\u0219i cercet\u0103tori vulnerabilit\u0103\u021bi CVE-2020-6007<\/a><\/noindex> \u00een iluminarea inteligent\u0103 Philips Hue Bridge, cauzat\u0103 de un overflow de buffer care permite preluarea controlului asupra dispozitivului.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint a propus tehnica de protec\u021bie Safe-Linking, care complic\u0103 exploatarea vulnerabilit\u0103\u021bilor | ProHoster","description":"Compania Checkpoint a prezentat mecanismul de protec\u021bie Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}