{"id":99808,"date":"2021-04-15T10:22:45","date_gmt":"2021-04-15T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah"},"modified":"2021-04-15T10:22:45","modified_gmt":"2021-04-15T08:22:45","slug":"predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","title":{"rendered":"Predstaven\u00e9 opravy pre randomiz\u00e1ciu adries z\u00e1sobn\u00edka jadra Linux pri syst\u00e9mov\u00fdch volaniach","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kees Cook, b\u00fdval\u00fd hlavn\u00fd syst\u00e9mov\u00fd administr\u00e1tor kernel.org a l\u00edder Ubuntu Security Team, aktu\u00e1lne pracuj\u00faci v spolo\u010dnosti Google na zabezpe\u010den\u00ed Android a ChromeOS, zverejnil mno\u017estvo opr\u00e1v s realiz\u00e1ciou n\u00e1hodn\u00e9ho posunu v z\u00e1sobn\u00edku jadra pri spracovan\u00ed syst\u00e9mov\u00fdch volan\u00ed. Opravy zvy\u0161uj\u00fa bezpe\u010dnos\u0165 jadra zmenou usporiadania z\u00e1sobn\u00edka, \u010do rob\u00ed \u00fatoky na z\u00e1sobn\u00edk ove\u013ea zlo\u017eit\u011bj\u0161\u00edmi a menej \u00faspe\u0161n\u00fdmi. Po\u010diato\u010dn\u00e1 implement\u00e1cia podporuje procesory ARM64 a x86\/x86_64. <\/p>\n

P\u00f4vodn\u00e1 my\u0161lienka tohto patchu patr\u00ed projektu PaX RANDKSTACK. V roku 2019 sa Elena Re\u0161etovov\u00e1, in\u017einierka z firmy Intel, pok\u00fasila vytvori\u0165 implement\u00e1ciu tejto my\u0161lienky vhodn\u00fa na za\u010dlenenie do hlavn\u00e9ho jadra Linuxu. N\u00e1sledne iniciat\u00edvu prevzal Kys Kuk, ktor\u00fd predstavil implement\u00e1ciu vhodn\u00fa pre hlavn\u00fd variant jadra. Patchy sa pl\u00e1nuj\u00fa zahrn\u00fa\u0165 do vydania 5.13. Re\u017eim bude predvolene vypnut\u00fd. Na jeho zapnutie s\u00fa navrhnut\u00e9 parametre pr\u00edkazov\u00e9ho riadka jadra \"randomize_kstack_offset=on\/off\" a nastavenie CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT. N\u00e1klady na zapnutie re\u017eimu sa odhaduj\u00fa na pribli\u017ene 1% straty v\u00fdkonu. <\/p>\n

Podstata navrhovanej ochrany spo\u010d\u00edva vo vo\u013ebe n\u00e1hodn\u00e9ho posunu z\u00e1sobn\u00edka pri ka\u017edom syst\u00e9movom volan\u00ed, \u010do s\u0165a\u017euje ur\u010denie usporiadania z\u00e1sobn\u00edka v pam\u00e4ti, aj ke\u010f s\u00fa dostupn\u00e9 \u00fadaje o adres\u00e1ch, preto\u017ee pri nasleduj\u00facom syst\u00e9movom volan\u00ed sa zmen\u00ed z\u00e1kladn\u00e1 adresa z\u00e1sobn\u00edka. Na rozdiel od realiz\u00e1cie PaX RANDKSTACK, v navrhnut\u00fdch oprav\u00e1ch pre u\u017e\u00edvanie v jadre sa n\u00e1hodnos\u0165 vykon\u00e1va nie na po\u010diato\u010dnej f\u00e1ze (cpu_current_top_of_stack), ale po nastaven\u00ed \u0161trukt\u00fary pt_regs, \u010do znemo\u017e\u0148uje pou\u017eitie met\u00f3d zalo\u017een\u00fdch na ptrace na ur\u010denie n\u00e1hodne posunut\u00e9ho adresy v priebehu dlh\u0161ieho vykon\u00e1vania syst\u00e9mov\u00e9ho volania.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0441 \u041a\u0443\u043a (Kees Cook), \u0431\u044b\u0432\u0448\u0438\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0441\u0438\u0441\u0430\u0434\u043c\u0438\u043d kernel.org \u0438 \u043b\u0438\u0434\u0435\u0440 Ubuntu Security Team, \u043d\u044b\u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043d\u0430\u0434 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b Android \u0438 ChromeOS, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u0439 \u0432 \u0441\u0442\u044d\u043a\u0435 \u044f\u0434\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432. \u041f\u0430\u0442\u0447\u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u044f\u0434\u0440\u0430 \u043f\u0443\u0442\u0451\u043c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0441\u0442\u0435\u043a\u0430, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0442\u0435\u043a \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99808","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Predstaven\u00e9 opravy pre n\u00e1hodn\u00e9 adresy z\u00e1sobn\u00edka jadra Linuxu pri syst\u00e9mov\u00fdch volaniach | ProHoster","description":"Kees Cook, b\u00fdval\u00fd hlavn\u00fd syst\u00e9mov\u00fd administr\u00e1tor kernel.org a l\u00edder Ubuntu Security Team, aktu\u00e1lne pracuj\u00faci v spolo\u010dnosti Google na zabezpe\u010den\u00ed Android a ChromeOS, zverejnil mno\u017estvo opr\u00e1v s realiz\u00e1ciou n\u00e1hodn\u00e9ho posunu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u0430\u0445 | ProHoster","og:description":"\u041a\u0438\u0441 \u041a\u0443\u043a (Kees Cook), \u0431\u044b\u0432\u0448\u0438\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0441\u0438\u0441\u0430\u0434\u043c\u0438\u043d kernel.org \u0438 \u043b\u0438\u0434\u0435\u0440 Ubuntu Security Team, \u043d\u044b\u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043d\u0430\u0434 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b Android \u0438 ChromeOS, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-15T08:22:45+00:00","article:modified_time":"2021-04-15T08:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99808","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-15 08:37:16","updated":"2022-09-29 02:14:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=99808"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99808\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=99808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=99808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=99808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}