{"id":83016,"date":"2020-05-27T19:41:58","date_gmt":"2020-05-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket"},"modified":"2020-05-27T19:41:58","modified_gmt":"2020-05-27T17:41:58","slug":"25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","title":{"rendered":"25 de vulnerabilit\u0103\u021bi \u00een RTOS Zephyr, inclusiv exploatate prin pachet ICMP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la compania NCC Group au publicat<\/a><\/noindex> rezultatele auditului proiectului liber Zephyr<\/a><\/noindex>, \u00een dezvoltare<\/a><\/noindex> un sistem de operare \u00een timp real (RTOS) destinat echip\u0103rii dispozitivelor conform conceptului de \u201eInternet al Lucrurilor\u201d (IoT, Internet of Things). \u00cen urma auditului, au fost identificate 25 de vulnerabilit\u0103\u021bi<\/a><\/noindex> \u00een Zephyr \u0219i 1 vulnerabilitate \u00een MCUboot. Dezvoltarea Zephyr se desf\u0103\u0219oar\u0103 cu implicarea companiilor Intel. <\/p>\n

\u00cen total, au fost depistate 6 vulnerabilit\u0103\u021bi \u00een stiva de re\u021bea, 4 - \u00een nucleu, 2 - \u00een shell-ul de comand\u0103, 5 \u00een gestionarea apelurilor de sistem, 5 \u00een subsistemul USB \u0219i 3 \u00een mecanismul de actualizare a firmware-ului. Dou\u0103 probleme au fost clasificate cu nivel critic de pericol, dou\u0103 - ridicat, 9 moderat, 9 - sc\u0103zut \u0219i 4 - pentru a fi luate \u00een considerare. Problemele critice afecteaz\u0103 stiva IPv4 \u0219i parser-ul MQTT, cele periculoase - driver-ele USB mass storage \u0219i USB DFU. La momentul divulg\u0103rii informa\u021biilor, solu\u021biile au fost preg\u0103tite doar pentru 15 vulnerabilit\u0103\u021bi cele mai periculoase, problemele care conduc la refuzul serviciului sau care sunt legate de neajunsuri \u00een mecanismele suplimentare de protec\u021bie ale nucleului r\u0103m\u00e2n nesolu\u021bionate.<\/p>\n

\u00cen stiva IPv4 a platformei a fost identificat\u0103 o vulnerabilitate exploatabil\u0103 de la distan\u021b\u0103, care duce la coruperea memoriei \u00een urma proces\u0103rii unui anumit tip de pachete ICMP modificate. O alt\u0103 problem\u0103 serioas\u0103 a fost g\u0103sit\u0103 \u00een parserul protocolului MQTT, care este cauzat\u0103 de absen\u021ba unei verific\u0103ri adecvate a lungimii c\u00e2mpurilor din antet \u0219i poate duce la executarea de cod de la distan\u021b\u0103. Probleme mai pu\u021bin periculoase, care duc la refuzul serviciului, au fost identificate \u00een stiva IPv6 \u0219i \u00een implementarea protocolului CoAP.<\/p>\n

Restul problemelor pot fi exploatate local pentru a provoca un refuz de serviciu sau pentru a executa cod la nivel de nucleu. Majoritatea acestor vulnerabilit\u0103\u021bi sunt legate de absen\u021ba verific\u0103rilor adecvate ale argumentelor apelurilor de sistem, ceea ce poate duce la scrierea \u0219i citirea unor zone arbirare de memorie \u00een nucleu. Problemele acoper\u0103 inclusiv codul de gestionare a apelurilor de sistem - accesarea unui num\u0103r negativ al apelului de sistem duce la o dep\u0103\u0219ire a capacit\u0103\u021bii \u00eentregului. De asemenea, \u00een nucleu au fost identificate probleme \u00een implementarea protec\u021biei ASLR (randomizarea spa\u021biului de adresare) \u0219i a mecanismului de instalare a etichetelor de tip canarie \u00een stiv\u0103, f\u0103c\u00e2nd aceste mecanisme ineficiente. <\/p>\n

Multe probleme afecteaz\u0103 stiva USB \u0219i driverele individuale. De exemplu, o problem\u0103 cu stocarea \u00een mas\u0103 USB permite generarea unui overflow de buffer \u0219i executarea de cod la nivel de kernel atunci c\u00e2nd un dispozitiv este conectat la un gazd\u0103 USB controlat de un atacator. O vulnerabilitate \u00een USB DFU, driver-ul pentru \u00eenc\u0103rcarea unei noi firme, permite \u00eenc\u0103rcarea unei imagini modificate a firmware-ului \u00een Flash-ul intern al microcontrolerului f\u0103r\u0103 criptare \u0219i ocolind modul de boot protejat cu verificarea componentelor prin semn\u0103tura digital\u0103. De asemenea, a fost studiat codul bootloader-ului deschis. MCUboot<\/a><\/noindex>, \u00een care a fost g\u0103sit\u0103 o vulnerabilitate nepericuloas\u0103,
\ncare poate duce la overflow de buffer atunci c\u00e2nd se utilizeaz\u0103 protocolul SMP (Simple Management Protocol) prin UART.<\/p>\n

Amintim c\u0103, \u00een Zephyr, toate procesele au la dispozi\u021bie un singur spa\u021biu de adresare virtual global partajat (SASOS, Single Address Space Operating System). Codul specific aplica\u021biilor este combinat cu un kernel adaptat pentru aplica\u021bia specific\u0103 \u0219i formeaz\u0103 un fi\u0219ier executabil monolitic pentru a fi \u00eenc\u0103rcat \u0219i rulat pe hardware specific. Toate resursele sistemului sunt definite \u00een timpul compil\u0103rii, ceea ce reduce dimensiunea codului \u0219i cre\u0219te performan\u021ba. Sistemul de imagine poate include doar acele func\u021bionalit\u0103\u021bi ale kernel-ului necesare pentru executarea aplica\u021biei.<\/p>\n

Este demn de remarcat c\u0103 printre principalele avantaje ale Zephyr men\u021bionat<\/a><\/noindex> se afl\u0103 dezvoltarea av\u00e2nd \u00een vedere securitatea. Se sus\u021bine<\/a><\/noindex>, astfel \u00eenc\u00e2t toate etapele de dezvoltare trec prin etape obligatorii de validare a securit\u0103\u021bii codului: testare de fuzzing, analiz\u0103 static\u0103, teste de penetrare, revizuirea codului, analiza inser\u021biei de backdoor-uri \u0219i modelarea amenin\u021b\u0103rilor.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Zephyr, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (RTOS), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 «\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0432\u0435\u0449\u0435\u0439» (IoT, Internet of Things). \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 25 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Zephyr \u0438 1 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MCUboot. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 Zephyr \u0432\u0435\u0434\u0451\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intel. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83016","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 25 de vulnerabilit\u0103\u021bi \u00een RTOS Zephyr, inclusiv exploatabile prin pachet ICMP | ProHoster","description":"Cercet\u0103torii de la NCC Group au publicat rezultatele auditului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4725 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 RTOS Zephyr, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 ICMP-\u043f\u0430\u043a\u0435\u0442 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T17:41:58+00:00","article:modified_time":"2020-05-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83016","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:51:14","updated":"2022-10-02 09:38:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=83016"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83016\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=83016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=83016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=83016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}