{"id":82793,"date":"2020-05-25T07:41:55","date_gmt":"2020-05-25T05:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu"},"modified":"2020-05-25T07:41:55","modified_gmt":"2020-05-25T05:41:55","slug":"70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","title":{"rendered":"70% problema sa bezbedno\u0161\u0107u u Chromium-u uzrokuju gre\u0161ke u radu sa memorijom","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Razvijalci projekta Chromium <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/memory-safety\">so analizirali<\/a><\/noindex> 912 nevarnih in kriti\u010dnih ranljivosti, odkritih v stabilnih izdajah Chromov od leta 2015, in pri\u0161li so do zaklju\u010dka, da je 70% od njih povzro\u010dilo negotovo ravnanje s spominom (napake pri obravnavanju kazalcev v C\/C++). Polovica teh te\u017eav (36,1%) izhaja iz dostopov do pomnilnika po njegovem sprostitvi (use-after-free).<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/_\/rsrc\/1589581287612\/Home\/chromium-security\/memory-safety\/piechart.png\"><img decoding=\"async\" alt=\"70% problema sa bezbedno\u0161\u0107u u Chromium-u uzrokuju gre\u0161ke u radu sa memorijom\" src=\"\/wp-content\/uploads\/2020\/05\/31912b956dc2548e17b682d29dbab909.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>Pri na\u010drtovanju Chromiuma je bilo izhodi\u0161\u010dno <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/guts\">predvideno<\/a><\/noindex>, da v kodi niso izklju\u010dene napake, zato se je velik poudarek dajal uporabi peskovnika za omejevanje posledic rabe ranljivosti. Danes so mo\u017enosti uporabe te tehnologije dosegle svoje meje in nadaljnje razbijanje na procese ni smiselno z vidika porabe virov. <\/p>\n<p>Za zagotavljanje varnosti kodne baze Google prav tako uporablja \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/chromium.googlesource.com\/chromium\/src\/+\/master\/docs\/security\/rule-of-2.md\">pravilo dveh<\/a><\/noindex>\u201e, v skladu s katerim mora vsak dodani kodni del izpolnjevati najve\u010d dva pogoja od treh: delo z nepreverjenimi vhodnimi podatki, uporaba nevarnega programsko jezik (C\/C++) in izvajanje z vi\u0161jimi privilegiji. Iz tega pravila sledi, da mora biti koda za obdelavo zunanjih podatkov bodisi omejena na minimalne privilegije (izolirana) bodisi napisana v varnem programskem jeziku.<\/p>\n<p>Za nadaljnje krepitev varnosti kode je bil zagnan projekt za prepre\u010devanje napak pri ravnanju s spominom v kodi. Izpostavljajo se tri osnovne pristope: ustvarjanje knji\u017enic C++ s funkcijami za varno delo s spominom in raz\u0161iritev uporabe zbiralnika smeti, uporaba strojnih za\u0161\u010ditnih mehanizmov <noindex><a rel=\"nofollow\" href=\"https:\/\/llvm.org\/devmtg\/2018-10\/slides\/Serebryany-Stepanov-Tsyrklevich-Memory-Tagging-Slides-LLVM-2018.pdf\">MTE<\/a><\/noindex> (Memory Tagging Extension) in pisanje komponent v jezikih, ki zagotavljajo varno delo s spominom (Java, Kotlin, JavaScript, Rust, Swift).<\/p>\n<p>Pri\u010dakuje se, da se bo delo osredoto\u010dilo na dve usmeritvi: <\/p>\n<ul>\n<li class=\"l\"> Znatna sprememba procesa razvoja v C++, ki ne izklju\u010duje negativnega vpliva na zmogljivost (dodatne omejitve in zbiranje smeti). Namesto surovih kazalcev se predlaga uporaba tipa <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/document\/d\/1pnnOAIz_DMWDI4oIOFoMAqLnf_MZ2GsrJNb_dbQ3ZBg\/edit#heading=h.jx7cpliyfer\">MiraclePtr<\/a><\/noindex>, ki omogo\u010da, da se izkori\u0161\u010dene napake razreda use-after-free zmanj\u0161ajo na ne\u0161kodljive zru\u0161itve, brez o\u010ditnega negativnega vpliva na zmogljivost, porabo pomnilnika in stabilnost.\n<li class=\"l\"> Uporaba jezika, zasnovanih na preverjanju varnosti dela s pomnilnikom med prevajanjem (kar bo odpravilo negativne vplive na uspe\u0161nost, zna\u010dilne za tak\u0161na preverjanja med izvajanjem kode, a bo privedlo do dodatnih stro\u0161kov za organizacijo medsebojnega delovanja kode v novem jeziku s kodo v C++).\n<\/ul>\n<p>Uporaba knji\u017enic za varno delo s pomnilnikom je najbolj preprost, a manj u\u010dinkovit pristop. Prepisovanje kode v Rust pa se ocenjuje kot naju\u010dinkovitej\u0161i, a zelo drag postopek.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/a77db9aa-a-7b23c8ea-s-sites.googlegroups.com\/a\/chromium.org\/dev\/Home\/chromium-security\/memory-safety\/sat3CHOc8lXZbGicChW6w5Q.png?attachauth=ANoY7cqyfZiTko5osYGVMP1ewI31nrE7lTP8m8fXIDsqh42vdzKk9CPyjYMd54R7RUD3QviaGPZKpgWTOFblPaSIGPePPGlMbi9rN1ZbO4lhXjP7mfoJCt5i_m7cFFFesGuNIVU0hjjc7M-FTXLyjc_YqMxC7-NUPaFMZe_83_IuUY6frEvOHBZ-6AxVa-PU49aLScaDVt6z3SSF1krIhvKgjaZjUeI0hhgKDayLg13AFRHUidIJd5wnbvomNQyzuH3wD6DxMfh2lrQ6EK3hK7RTMw-eMeWAEw%3D%3D&#038;attredirects=0\"><img decoding=\"async\" alt=\"70% problema sa bezbedno\u0161\u0107u u Chromium-u uzrokuju gre\u0161ke u radu sa memorijom\" src=\"\/wp-content\/uploads\/2020\/05\/48aac9ae5a251323dddebf73dfa73286.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53019\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Chrome \u0441 2015 \u0433\u043e\u0434\u0430, \u0438 \u043f\u0440\u0438\u0448\u043b\u0438 \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e 70% \u0438\u0437 \u043d\u0438\u0445 \u0431\u044b\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e (\u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043d\u0430 C\/C++). \u041f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0438\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c (36.1%) \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0443\u0444\u0435\u0440\u0443 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u043f\u0430\u043c\u044f\u0442\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82794,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82793","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-25T05:41:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4770% varnostnih te\u017eav v Chromu povzro\u010da napake pri delu s pomnilnikom | ProHoster","description":"Razvijalci projekta Chromium so analizirali 912 nevarnih in kriti\u010dnih ranljivosti, ki so bile odkrite v.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4770% \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Chromium \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 912 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/70-problem-s-bezopasnostyu-v-chromium-vyzvany-oshibkami-pri-rabote-s-pamyatyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-25T05:41:55+00:00","article:modified_time":"2020-05-25T05:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82793","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:31:26","updated":"2022-09-30 17:34:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/82793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=82793"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/82793\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/82794"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=82793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=82793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=82793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}