{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint predstavil techniku ochrany Safe-Linking, ktor\u00e1 s\u0165a\u017euje vyu\u017e\u00edvanie zranite\u013enost\u00ed.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Checkpoint predstavila<\/a><\/noindex> mechanizmus ochrany Safe-Linking, ktor\u00fd s\u0165a\u017euje vytv\u00e1ranie exploitov manipuluj\u00facich s definovan\u00edm alebo zmenou ukazovate\u013eov na vyhraden\u00e9 pam\u00e4\u0165ov\u00e9 bloky pri volan\u00ed malloc. Safe-Linking s\u00edce \u00faplne neblokuje mo\u017enos\u0165 vykoris\u0165ovania zranite\u013enost\u00ed, ale pri minim\u00e1lnych n\u00e1kladoch v\u00fdrazne s\u0165a\u017euje vytv\u00e1ranie niektor\u00fdch kateg\u00f3ri\u00ed exploitov, preto\u017ee okrem vy\u017eadovan\u00e9ho prete\u010denia bufferu je potrebn\u00e9 n\u00e1js\u0165 e\u0161te jednu zranite\u013enos\u0165, ktor\u00e1 sp\u00f4sobuje \u00fanik inform\u00e1ci\u00ed o umiestnen\u00ed hromady (heap) v pam\u00e4ti.<\/p>\n

Opravy s implement\u00e1ciou Safe-Linking s\u00fa pripraven\u00e9 pre Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) a Google TCMalloc, ako aj s\u00fa navrhnut\u00e9 na moderniz\u00e1ciu ochrany v Chromium (v
\nChromium je u\u017e od roku 2012 zabudovan\u00e1 technika ochrany MaskPtr, zameran\u00e1 na rie\u0161enie tej istej problematiky, av\u0161ak rie\u0161enie od Checkpoint ukazuje vy\u0161\u0161\u00ed v\u00fdkon).
\nNavrhnut\u00e9 opravy s\u00fa u\u017e schv\u00e1len\u00e9 na dodanie v augustom vydan\u00ed Glibc 3.32<\/a><\/noindex> a zavedenie Safe-Linking bude zahrnut\u00e9 predvolene. V uClibc-NG podpora Safe-Linking sa dostala<\/a><\/noindex> vydanie 1.0.33 a je zahrnut\u00e9 predvolene. V gperftools (star\u00fd tcmalloc) zmeny boli prijat\u00e9<\/a><\/noindex>, ale bud\u00fa navrhnut\u00e9 v jednej z bud\u00facich verzi\u00ed ako volba. <\/p>\n

V\u00fdvoj\u00e1ri TCMalloc<\/a><\/noindex> (nov\u00fd tcmalloc) odmietli prija\u0165 zmena<\/a><\/noindex>, s odkazom na v\u00fdrazn\u00e9 zn\u00ed\u017eenie v\u00fdkonnosti a potrebu pridania roz\u0161\u00edren\u00fdch testov na pravideln\u00fa kontrolu spr\u00e1vneho fungovania. Testovanie in\u017einiermi Checkpoint uk\u00e1zalo, \u017ee met\u00f3da Safe-Linking neviedla k zv\u00fd\u0161eniu spotreby pam\u00e4te, pri\u010dom priemerne sa v\u00fdkon pri oper\u00e1ci\u00e1ch s haldami zn\u00ed\u017eil len o 0,02 % a v najhor\u0161om pr\u00edpade o 1,5 % (pre porovnanie, re\u017eijn\u00e9 n\u00e1klady v met\u00f3de pou\u017eitej v Chromi s\u00fa hodnoten\u00e9 ako \u201emenej ako 2 %\u201c). Zahrnutie
\nSafe-Linking vedie k vykonaniu 2-3 dodato\u010dn\u00fdch assemblerov\u00fdch in\u0161trukci\u00ed pri ka\u017edom volan\u00ed free() a 3-4 in\u0161trukci\u00ed pri volan\u00ed malloc(). Spustenie \u0161t\u00e1di\u00ed inicializ\u00e1cie a generovania n\u00e1hodn\u00fdch hodn\u00f4t nie je potrebn\u00e9.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking sa m\u00f4\u017ee pou\u017e\u00edva\u0165 nielen na zvy\u0161ovanie bezpe\u010dnosti r\u00f4znych realiz\u00e1ci\u00ed hromady, ale aj na prid\u00e1vanie prostriedkov na kontrolu integrity do ak\u00fdchko\u013evek d\u00e1tov\u00fdch \u0161trukt\u00far, v ktor\u00fdch sa pou\u017e\u00edvaj\u00fa jednokr\u00fa\u017ekov\u00e9 zoznamy ukazovate\u013eov umiestnen\u00fdch ved\u013ea samotn\u00fdch buffrov. Met\u00f3da je ve\u013emi jednoduch\u00e1 na realiz\u00e1ciu a vy\u017eaduje iba pridanie jedn\u00e9ho makra a jeho aplik\u00e1ciu na ukazovatele na nasleduj\u00faci blok v k\u00f3de (napr\u00edklad pre Glibc men\u00ed sa<\/a><\/noindex> len nieko\u013eko riadkov v k\u00f3de). Met\u00f3da spo\u010d\u00edva v nasleduj\u00facich zmen\u00e1ch:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n \u2026<\/p>\n

Podstata met\u00f3dy spo\u010d\u00edva v pou\u017eit\u00ed n\u00e1hodn\u00fdch \u00fadajov z mechanizmu n\u00e1hodn\u00e9ho adresovania ASLR (mmap_base) na ochranu jednokru\u017eenov\u00fdch zoznamov, ako s\u00fa Fast-Bins a TCache. Pred aplikovan\u00edm na hodnotu ukazovate\u013ea na nasleduj\u00faci prvok v zozname sa vykon\u00e1va transform\u00e1cia pomocou masky a kontrola zarovnania na hranici str\u00e1nky pam\u00e4te. Ukazovate\u013e sa nahr\u00e1dza v\u00fdsledkom oper\u00e1cie \u201e(L >> PAGE_SHIFT) XOR (P)\u201c, kde P je hodnota ukazovate\u013ea a L je umiestnenie v pam\u00e4ti, kde sa tento ukazovate\u013e nach\u00e1dza.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Pri pou\u017eit\u00ed v syst\u00e9me ASLR<\/a><\/noindex> (Address Space Layout Randomization) \u010das\u0165 bitov L s z\u00e1kladnou adresou hromady obsahuje n\u00e1hodn\u00e9 hodnoty, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa ako k\u013e\u00fa\u010d na k\u00f3dovanie P (vy\u0165ahuj\u00fa sa oper\u00e1ciou posunu o 12 bitov pre 4096-bajtov\u00e9 str\u00e1nky). Tak\u00e1to manipul\u00e1cia zni\u017euje riziko zachytenia ukazovate\u013ea v exploite, preto\u017ee ukazovate\u013e sa neuchov\u00e1va v p\u00f4vodnej podobe a na jeho nahradenie je potrebn\u00e9 pozna\u0165 inform\u00e1cie o umiestnen\u00ed hromady. Navy\u0161e, v k\u00f3de z\u00e1platy sa nach\u00e1dza aj dodato\u010dn\u00e1 kontrola zarovnania bloku, ktor\u00e1 neumo\u017e\u0148uje \u00fato\u010dn\u00edkovi nahradi\u0165 ukazovate\u013e na nezarovnan\u00fa hodnotu a vy\u017eaduje vedomos\u0165 o po\u010dte bitov, o ktor\u00e9 bolo zarovnanie vykonan\u00e9, \u010do na 64-bitov\u00fdch syst\u00e9moch \u010falej umo\u017e\u0148uje zablokova\u0165 15 z 16 pokusov o \u00fatoky, nezoh\u013ead\u0148uj\u00face zarovnanie.<\/p>\n

Met\u00f3da je \u00fa\u010dinn\u00e1 na ochranu pred \u00fatokmi, v ktor\u00fdch sa pou\u017e\u00edvaj\u00fa \u010diasto\u010dn\u00e9 prep\u00edsania ukazovate\u013eov (zmena ni\u017e\u0161\u00edch bajtov), \u00fapln\u00e9 prep\u00edsanie ukazovate\u013eov (presmerovanie na k\u00f3d \u00fato\u010dn\u00edka) a zmena poz\u00edcie zoznamu na nezarovnan\u00fa adresu. Ako pr\u00edklad sa ukazuje, \u017ee aplik\u00e1cia Safe-Linking v malloc by mohla zablokova\u0165 exploat\u00e1ciu ned\u00e1vno zisten\u00e9<\/a><\/noindex> t\u00fdmi ist\u00fdmi v\u00fdskumn\u00edkmi zranite\u013enosti CVE-2020-6007<\/a><\/noindex> v inteligentnom osvetlen\u00ed Philips Hue Bridge, sp\u00f4soben\u00fa preplnen\u00edm vyrovn\u00e1vacej pam\u00e4te a umo\u017e\u0148uj\u00facou z\u00edska\u0165 kontrolu nad zariaden\u00edm.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint navrhol techniku ochrany Safe-Linking, ktor\u00e1 s\u0165a\u017euje zneu\u017e\u00edvanie zranite\u013enost\u00ed | ProHoster","description":"Spolo\u010dnos\u0165 Checkpoint predstavila mechanizmus ochrany Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}