Glibc inosanganisira gadziriso yekusagadzikana kwememcpy yakagadzirirwa nevagadziri veAurora OS

Vagadziri veAurora mobile operating system (forogo yeSailfish OS yakagadziriswa nekambani yeOpen Mobile Platform) vakagovera nyaya inoburitsa pachena nezvekubvisa. kukanganiswa kwakanyanya (CVE-2020-6096) muGlibc, inoonekwa chete paArMv7 papuratifomu. Ruzivo rwekusagadzikana rwakaziviswa kumashure muna Chivabvu, asi kusvika mazuva achangopfuura, zvigadziriso zvaive zvisipo, kunyangwe hazvo kusasimba. kupiwa yakakwira mwero wenjodzi uye kune inoshanda prototype yekushandiswa iyo inokutendera iwe kuronga kodhi kuuraya paunenge uchigadzira data rakarongwa neimwe nzira mune memcpy () uye memmove () mabasa. Package inogadzirisa Debian ΠΈ Ubuntu haisati yaburitswa uye kusagadzikana kwacho kunoramba kusingagadziriswe kweinenge mwedzi miviri kubva panguva yekuburitswa pachena uye mwedzi mishanu kubva panguva iyo vagadziri veGlibc vakaziviswa.

Kusagadzikana kwakazviratidza mukuitwa kwe memcpy () uye memmove () mumutauro wekusangana weARMv7 uye kwakakonzerwa nekusarongeka kwemaitiro asina kunaka eparameter inotaridza saizi yenzvimbo yakakopwa. Matambudziko nekuvandudzwa kwechigamba akatanga apo makambani suse ΠΈ Red Hat vakazivisa kuti mapuratifomu avo haana kukanganiswa nedambudziko, sezvo ivo vasingavakire 32-bit ARMv7 masisitimu, uye havana kutora chikamu mukugadzira kugadzirisa. Vagadziri vezvizhinji zvakamisikidzwa kugovera vanoita sekunge vakavimba neboka reGlibc, uye havanawo kuita basa mukugadzirira kugadzirisa.

Sarudzo chigamba Kuti avhare dambudziko, Huawei akapotsa afunga kuti yaedza kutsiva mirairo yegungano inoshanda nemaoperands akasainwa (bge uye blt) nemaanalogue asina kusaina (blo uye bhs). Vagadziri veGlibc vakagadzira seti yemiedzo yekutarisa akasiyana mamiriro ekukanganisa, mushure mezvo zvakazoitika kuti chigamba cheHuawei chaive chisina kukodzera uye hachina kugadzirisa ese angangoita musanganiswa wedata rekuisa.

Sezvo Aurora OS ine 32-bit yekuvaka yeARM, vagadziri vayo vakafunga kuvhara kusazvibata kwavo uye nekupa mhinduro kunharaunda. Chinetso chaive chekuti zvaive zvakakosha kunyora kunyatsoita mutauro wemusangano wekuita basa uye funga nezvesarudzo dzakasiyana dzenharo dzekuisa. Kuitwa kwacho kwakanyorwa patsva uchishandisa mirairo isina kusaina. Chigamba Zvakazove diki, asi dambudziko guru raive rekuchengetedza kumhanya kwekuita uye kudzivirira kushatisa kwekuita kwememcpy uye memmove mabasa, uku uchichengeta kuenderana nese kusanganiswa kwemitengo yekupinza.

Mukutanga kwaChikumi, mavhezheni maviri ekugadzirisa akagadzirwa, achipfuura bvunzo yevachengeti veGlibc uye yemukati bvunzo suite yeAurora. Musi waChikumi 3, imwe yesarudzo yakasarudzwa uye sent kune iyo Glibc mailing list. Kwapera vhiki
yakanga iri suggested chimwe chigamba chakafanana munzira, icho chakagadzirisa dambudziko mukuitwa kwemultiarch, iyo Huawei akamboedza kugadzirisa. Testing yakatora mwedzi uye kunyoresa zviri pamutemo nekuda kwekukosha kwechigamba.
Chikunguru 8 kugadzirisa zvakagamuchirwa kubazi guru rekuuya kweglibc 2.32 kuburitswa. Kuitwa kunosanganisira zvigamba zviviri - ΠΏΠ΅Ρ€Π²Ρ‹ΠΉ yekushandiswa kwemultiarch memcpy yeARMv7, uye yechipiri yemusangano mukuru wemutauro we memcpy() uye memmove() yeARM.

Dambudziko rinobata mamirioni eArMv7 zvishandiso zvinomhanya Linux, uye pasina iyo yakakodzera gadziriso, varidzi vari panjodzi kana vachivabatanidza kunetiweki (network-inopindika masevhisi uye maapplication anogamuchira data rekuisa pasina kurambidzwa saizi anogona kurwiswa). Semuenzaniso, kushandiswa kwakagadzirirwa nevatsvakurudzi vakaona kusagadzikana kunoratidza maitiro ekurwisa sevha yeHTTP yakavakirwa mumotokari yeruzivo system nekutumira chikumbiro chakakura kwazvo cheGET uye kuwana midzi yekuwana kuhurongwa.

Source: opennet.ru

Voeg