{"id":107183,"date":"2023-03-10T18:48:11","date_gmt":"2023-03-10T16:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=107183"},"modified":"2023-03-13T12:06:39","modified_gmt":"2023-03-13T10:06:39","slug":"kriticheskaya-uyazvimost-v-wasmtime-runtime-dlya-webassembly-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/kriticheskaya-uyazvimost-v-wasmtime-runtime-dlya-webassembly-prilozhenij","title":{"rendered":"Kritick\u00e1 zranite\u013enos\u0165 v Wasmtime, runtime pre aplik\u00e1cie WebAssembly","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V oprav\u00e1ch aktualiz\u00e1ci\u00ed Wasmtime 6.0.1, 5.0.1 a 4.0.1 bola odstr\u00e1nen\u00e1 zranite\u013enos\u0165 (CVE-2023-26489), ktorej bol priraden\u00fd kritick\u00fd \u00farove\u0148 nebezpe\u010denstva. Zranite\u013enos\u0165 umo\u017e\u0148uje z\u00e1pis d\u00e1t do oblasti pam\u00e4te mimo hranice povolenej pre izolovan\u00fd k\u00f3d WebAssembly, \u010do m\u00f4\u017eu \u00fato\u010dn\u00edci potenci\u00e1lne vyu\u017ei\u0165 na vykonanie svojho k\u00f3du mimo izolovan\u00e9ho prostredia WASI. <\/p>\n

Wasmtime je runtime na vykon\u00e1vanie aplik\u00e1ci\u00ed WebAssembly s roz\u0161\u00edreniami WASI (WebAssembly System Interface) ako be\u017en\u00fdch oddelen\u00fdch aplik\u00e1ci\u00ed. N\u00e1stroje s\u00fa nap\u00edsan\u00e9 v programovacom jazyku Rust a zranite\u013enos\u0165 je sp\u00f4soben\u00e1 logickou chybou pri ur\u010dovan\u00ed pravidiel line\u00e1rneho adresovania pam\u00e4te v gener\u00e1tore k\u00f3du Cranelift, ktor\u00fd preklad\u00e1 nez\u00e1visl\u00e9 od hardv\u00e9rovej architekt\u00fary medzi\u010dl\u00e1nkov\u00e9 zast\u00fapenie na vykon\u00e1vac\u00ed strojov\u00fd k\u00f3d pre architekt\u00faru x86_64. <\/p>\n

Konkr\u00e9tne sa pre aplik\u00e1cie WebAssembly po\u010d\u00edtali 35-bitov\u00e9 efekt\u00edvne adresy namiesto povolen\u00fdch v WebAssembly 33-bitov\u00fdch adries, \u010do posunulo hranicu povolenej pre oper\u00e1cie \u010d\u00edtania a z\u00e1pisu virtu\u00e1lnej pam\u00e4te na 34 GB, zatia\u013e \u010do nastavenia pieskoviska poskytuj\u00fa ochranu pre 6 GB od z\u00e1kladnej adresy. Nakoniec bol rozsah virtu\u00e1lnej pam\u00e4te od 6 do 34 GB od z\u00e1kladnej adresy dostupn\u00fd na \u010d\u00edtanie a z\u00e1pis z aplik\u00e1ci\u00ed WebAssembly. V tejto pam\u00e4ti m\u00f4\u017eu by\u0165 umiestnen\u00e9 in\u00e9 prostredia WebAssembly alebo komponenty runtime WebAssembly. <\/p>\n

Ak je nemo\u017en\u00e9 aktualizova\u0165 verziu Wasmtime, ako obch\u00e1dzkov\u00e9 rie\u0161enia na blokovanie chyby sa spom\u00edna mo\u017enos\u0165 nastavenia vo\u013eby «Config::static_memory_maximum_size(0)» na aktiv\u00e1ciu povinnej samostatnej kontroly hran\u00edc pri ka\u017edom pr\u00edstupe k line\u00e1rnej pam\u00e4ti (to vedie k v\u00fdrazn\u00e9mu zn\u00ed\u017eeniu v\u00fdkonu). \u010eal\u0161ou mo\u017enos\u0165ou je pou\u017ei\u0165 nastavenie «Config::static_memory_guard_size(1 < 36)» na zv\u00fd\u0161enie po\u010dtu str\u00e1\u017enych str\u00e1nok pam\u00e4te (Guard Page, pri pr\u00edstupe sa generuje v\u00fdnimka), umiestnen\u00fdch v problematickom rozsahu virtu\u00e1lnej pam\u00e4ti (to vedie k rezervovaniu ve\u013ek\u00e9ho objemu virtu\u00e1lnej pam\u00e4ti a obmedzeniu po\u010dtu s\u00fa\u010dasne vykon\u00e1van\u00fdch aplik\u00e1ci\u00ed WebAssembly).
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 Wasmtime 6.0.1, 5.0.1 \u0438 4.0.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-26489), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043f\u0438\u0441\u044c \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043d\u0435 \u0433\u0440\u0430\u043d\u0438\u0446\u044b, \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e\u0439 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e WebAssembly-\u043a\u043e\u0434\u0430, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432\u043d\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f WASI. Wasmtime \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 runtime \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f WebAssembly-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 WASI […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107183","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritick\u00e1 zranite\u013enos\u0165 v Wasmtime, runtime pre aplik\u00e1cie WebAssembly | ProHoster","description":"V oprav\u00e1ch aktualiz\u00e1ci\u00ed Wasmtime 6.0.1, 5.0.1 a 4.0.1 bola odstr\u00e1nen\u00e1 zranite\u013enos\u0165 (CVE-2023-26489), ktorej bol priraden\u00fd kritick\u00fd \u00farove\u0148 nebezpe\u010denstva.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/kriticheskaya-uyazvimost-v-wasmtime-runtime-dlya-webassembly-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Wasmtime, runtime \u0434\u043b\u044f WebAssembly-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 Wasmtime 6.0.1, 5.0.1 \u0438 4.0.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-26489), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/kriticheskaya-uyazvimost-v-wasmtime-runtime-dlya-webassembly-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-10T16:48:11+00:00","article:modified_time":"2023-03-13T10:06:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=107183"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107183\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=107183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=107183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=107183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}