{"id":82793,"date":"2020-05-25T07:41:55","date_gmt":"2020-05-25T05:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu"},"modified":"2020-05-25T07:41:55","modified_gmt":"2020-05-25T05:41:55","slug":"70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","title":{"rendered":"70% din problemele de securitate din Chromium sunt cauzate de erori \u00een gestionarea memoriei","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dezvoltatorii proiectului Chromium <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/memory-safety\">au analizat<\/a><\/noindex> 912 vulnerabilit\u0103\u021bi periculoase \u0219i critice, identificate \u00een versiunile stabile ale Chrome din 2015, \u0219i au concluzionat c\u0103 70% dintre ele au fost cauzate de gestionarea nesigur\u0103 a memoriei (erori \u00een gestionarea pointerelor \u00een codul C\/C++). Jum\u0103tate dintre aceste probleme (36.1%) sunt cauzate de acces\u0103rile la buffer dup\u0103 eliberarea memoriei asociate (use-after-free).<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/_\/rsrc\/1589581287612\/Home\/chromium-security\/memory-safety\/piechart.png\"><img decoding=\"async\" alt=\"70% din problemele de securitate din Chromium sunt cauzate de erori \u00een gestionarea memoriei\" src=\"\/wp-content\/uploads\/2020\/05\/31912b956dc2548e17b682d29dbab909.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>\u00cen proiectarea Chromium a fost ini\u021bial <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/guts\">preconizat<\/a><\/noindex>, c\u0103 \u00een cod pot ap\u0103rea erori, motiv pentru care s-a pus un accent mare pe aplicarea izol\u0103rii sandbox pentru a limita consecin\u021bele apari\u021biei vulnerabilit\u0103\u021bilor. \u00cen prezent, capacit\u0103\u021bile de aplicare a acestei tehnologii au atins limitele sale \u0219i fragmentarea suplimentar\u0103 pe procese nu mai este fezabil\u0103 din punct de vedere al consumului de resurse. <\/p>\n<p>Pentru a men\u021bine securitatea bazei de cod, Google aplic\u0103 de asemenea &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/chromium.googlesource.com\/chromium\/src\/+\/master\/docs\/security\/rule-of-2.md\">regula celor dou\u0103<\/a><\/noindex>&#171;, conform c\u0103ruia orice cod ad\u0103ugat trebuie s\u0103 se \u00eencadreze \u00een maximum dou\u0103 din trei condi\u021bii: lucrul cu date de intrare nesupravegheate, utilizarea unui limbaj de programare nesigur (C\/C++) \u0219i executarea cu privilegii crescute. Din aceast\u0103 regul\u0103 reiese c\u0103 codul pentru manipularea datelor externe trebuie fie redus la privilegii minime (izolat), fie scris \u00eentr-un limbaj de programare sigur.<\/p>\n<p>Pentru a \u00eent\u0103ri \u0219i mai mult securitatea bazei de cod a fost ini\u021biat un proiect de prevenire a apari\u021biei erorilor de gestionare a memoriei \u00een baza de cod. Se disting trei abord\u0103ri principale: crearea de biblioteci C++ cu func\u021bii pentru gestionarea sigur\u0103 a memoriei \u0219i extinderea domeniului de aplicare al colectorului de gunoi, aplicarea mecanismelor hardware de protec\u021bie <noindex><a rel=\"nofollow\" href=\"https:\/\/llvm.org\/devmtg\/2018-10\/slides\/Serebryany-Stepanov-Tsyrklevich-Memory-Tagging-Slides-LLVM-2018.pdf\">MTE<\/a><\/noindex> (Memory Tagging Extension) \u0219i scrierea de componente \u00een limbaje care asigur\u0103 gestionarea sigur\u0103 a memoriei (Java, Kotlin, JavaScript, Rust, Swift).<\/p>\n<p>Se a\u0219teapt\u0103 ca lucr\u0103rile s\u0103 se concentreze \u00een dou\u0103 direc\u021bii: <\/p>\n<ul>\n<li class=\"l\"> Schimb\u0103ri semnificative \u00een procesul de dezvoltare \u00een C++, care nu exclud influen\u021ba negativ\u0103 asupra performan\u021bei (verific\u0103ri suplimentare de limite \u0219i colectare de gunoi). \u00cen loc de pointeri raw, se propune utilizarea \u00een cod a tipului <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/document\/d\/1pnnOAIz_DMWDI4oIOFoMAqLnf_MZ2GsrJNb_dbQ3ZBg\/edit#heading=h.jx7cpliyfer\">MiraclePtr<\/a><\/noindex>, care permite reducerea erorilor exploatabile de tip use-after-free la blocaje care nu reprezint\u0103 o amenin\u021bare pentru securitate, f\u0103r\u0103 un impact negativ semnificativ asupra performan\u021bei, consumului de memorie \u0219i stabilit\u0103\u021bii.\n<li class=\"l\"> Utilizarea limbajelor concepute pentru a efectua verific\u0103ri de siguran\u021b\u0103 \u00een gestionarea memoriei \u00een timpul compil\u0103rii (va exclude impactul negativ asupra performan\u021bei, specific acestor verific\u0103ri \u00een timpul execu\u021biei codului, dar va duce la costuri suplimentare pentru organizarea interac\u021biunii codului \u00een noul limbaj cu codul C++).\n<\/ul>\n<p>Folosirea bibliotecilor pentru gestionarea sigur\u0103 a memoriei este cea mai simpl\u0103, dar \u0219i cea mai pu\u021bin eficient\u0103 metod\u0103. Rescrierea codului \u00een Rust este considerat\u0103 cea mai eficient\u0103, dar \u0219i o cale foarte costisitoare.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/a77db9aa-a-7b23c8ea-s-sites.googlegroups.com\/a\/chromium.org\/dev\/Home\/chromium-security\/memory-safety\/sat3CHOc8lXZbGicChW6w5Q.png?attachauth=ANoY7cqyfZiTko5osYGVMP1ewI31nrE7lTP8m8fXIDsqh42vdzKk9CPyjYMd54R7RUD3QviaGPZKpgWTOFblPaSIGPePPGlMbi9rN1ZbO4lhXjP7mfoJCt5i_m7cFFFesGuNIVU0hjjc7M-FTXLyjc_YqMxC7-NUPaFMZe_83_IuUY6frEvOHBZ-6AxVa-PU49aLScaDVt6z3SSF1krIhvKgjaZjUeI0hhgKDayLg13AFRHUidIJd5wnbvomNQyzuH3wD6DxMfh2lrQ6EK3hK7RTMw-eMeWAEw%3D%3D&#038;attredirects=0\"><img decoding=\"async\" alt=\"70% din problemele de securitate din Chromium sunt cauzate de erori \u00een gestionarea memoriei\" src=\"\/wp-content\/uploads\/2020\/05\/48aac9ae5a251323dddebf73dfa73286.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53019\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Chrome \u0441 2015 \u0433\u043e\u0434\u0430, \u0438 \u043f\u0440\u0438\u0448\u043b\u0438 \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e 70% \u0438\u0437 \u043d\u0438\u0445 \u0431\u044b\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e (\u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043d\u0430 C\/C++). \u041f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0438\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c (36.1%) \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0443\u0444\u0435\u0440\u0443 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u043f\u0430\u043c\u044f\u0442\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82794,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82793","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 70% dintre problemele de securitate din Chromium sunt cauzate de erori \u00een gestionarea memoriei | ProHoster","description":"Dezvoltatorii proiectului Chromium au analizat 912 vulnerabilit\u0103\u021bi periculoase \u0219i critice descoperite \u00een.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-25T05:41:55+00:00","article:modified_time":"2020-05-25T05:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82793","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:31:26","updated":"2022-09-30 17:34:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=82793"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82793\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/82794"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=82793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=82793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=82793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}