{"id":100888,"date":"2021-08-02T10:22:56","date_gmt":"2021-08-02T08:22:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemnoj-biblioteki-glibc-2-34"},"modified":"2021-08-02T10:22:56","modified_gmt":"2021-08-02T08:22:56","slug":"vypusk-sistemnoj-biblioteki-glibc-2-34","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-sistemnoj-biblioteki-glibc-2-34","title":{"rendered":"L\u00ebshimi i bibliotek\u00ebs sistemike Glibc 2.34","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Pas nj\u00eb periudh\u00eb gjasht\u00eb mujore pun\u00eb, \u00ebsht\u00eb publikuar t\u00eb lidhni versionin e bibliotek\u00ebs sistemike GNU C Library (glibc) 2.34, e cila plot\u00ebson plot\u00ebsisht k\u00ebrkesat e standardeve ISO C11 dhe POSIX.1-2017. Ky version i ri p\u00ebrfshin korrigjime nga 66 zhvillues. <\/p>\n
Nga p\u00ebrmir\u00ebsimet e zbatuara n\u00eb Glibc 2.34, mund t\u00eb theksohen: <\/p>\n
\n
Bibliotekat libpthread, libdl, libutil dhe libanl jan\u00eb integruar n\u00eb pjes\u00ebn kryesore t\u00eb libc, duke b\u00ebr\u00eb t\u00eb panevojshme lidhjen e funksionaliteteve t\u00eb tyre n\u00eb aplikacione me flag-at -lpthread, -ldl, -lutil dhe -lanl. \u00cbsht\u00eb p\u00ebrgatitur integrimi i libresolv n\u00eb libc. Integrimi do t\u00eb arrihet n\u00eb nj\u00eb proces m\u00eb t\u00eb unifikuar t\u00eb p\u00ebrdit\u00ebsimeve t\u00eb glibc dhe do t\u00eb thjeshtoj\u00ebimplementimin e runtime. P\u00ebr t\u00eb siguruar q\u00ebmbahet p\u00ebrputhje me aplikacionet e nd\u00ebrtuara me versionet e vjetra t\u00eb glibc, jan\u00eb ofruar bibliotekat mb\u00ebshtet\u00ebse. P\u00ebr shkak t\u00eb zgjerimit t\u00eb numrit t\u00eb strukturave dhe funksioneve q\u00eb ofrohen n\u00eb glibc, nuk p\u00ebrjashtohet mund\u00ebsia e shfaqjes s\u00eb problemeve n\u00eb aplikacione ku ka p\u00ebrputhje emrash me bibliotekat e reja libpthread, libdl, libutil, libresolv dhe libanl.\n
\u00cbshte ofruar mund\u00ebsia e p\u00ebrdorimit t\u00eb tipit 64-bit time_t n\u00eb konfigurimet ku tradicionalisht \u00ebsht\u00eb p\u00ebrdorur tipi 32-bit time_t. N\u00eb k\u00ebto konfigurime, p\u00ebr shembull n\u00eb sistemet x86, p\u00ebr t\u00eb p\u00ebrdorur kohe t\u00eb 32-bit, duhet t\u00eb mbajm\u00eb default, por ky q\u00ebndrim tani mund t\u00eb ndryshohet duke p\u00ebrdorur makron «_TIME_BITS». Kjo mund\u00ebsi \u00ebsht\u00eb e disponueshme vet\u00ebm n\u00eb sistemet me b\u00ebrtham\u00eb Linux me t\u00eb pakt\u00ebn versionin 5.1.\n
\u00cbsht\u00eb shtuar funksioni _Fork, nj\u00eb z\u00ebvend\u00ebsim p\u00ebr funksionin fork, i cili p\u00ebrmbush k\u00ebrkesat e «async-signal-safe», dmth. lejon thirrje t\u00eb sigurta nga trajtuesit e sinjaleve. Gjat\u00eb ekzekutimit t\u00eb _Fork, krijohet nj\u00eb ambient minimal, i mjaftuesh\u00ebm p\u00ebr t\u00eb thirrur funksionet n\u00eb trajtuesit e sinjaleve, si raise dhe execve, pa aktivizuar mund\u00ebsit\u00eb q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb ndryshimin e bllokimeve ose gjendjes s\u00eb brendshme. Thirrja e _Fork do t\u00eb p\u00ebrcaktohet n\u00eb versionin e ardhsh\u00ebm t\u00eb standardit POSIX, por p\u00ebr momentin \u00ebsht\u00eb n\u00eb mesin e zgj\u00ebrimeve GNU.\n
P\u00ebr platform\u00ebn Linux \u00ebsht\u00eb realizuar funksioni execveat, i cili lejon ekzekutimin e nj\u00eb skedari ekzekutiv nga nj\u00eb deshifrues i hapur t\u00eb skedar\u00ebve. Funksioni i ri gjithashtu p\u00ebrdoret n\u00eb implementimin e thirrjes fexecve q\u00eb nuk k\u00ebrkon pranin\u00eb e sistemit t\u00eb montuar pseudo-FS \/proc gjat\u00eb ekzekutimit.\n
Funksioni timespec_getres u shtua, i p\u00ebrcaktuar n\u00eb skic\u00ebn e standardit ISO C2X dhe q\u00eb plot\u00ebson funksionin timespec_get me mund\u00ebsi t\u00eb ngjashme me funksionin POSIX clock_getres.\n
Funksioni close_range() u shtua, duke i lejuar procesit t\u00eb mbyll\u00eb nj\u00eb gam\u00eb t\u00eb t\u00eb gjith\u00eb deshifruesve t\u00eb hapur t\u00eb skedar\u00ebve nj\u00ebher\u00ebsh. Funksioni \u00ebsht\u00eb i disponuesh\u00ebm n\u00eb sistemet me b\u00ebrtham\u00eb Linux, t\u00eb pakt\u00ebn versioni 5.9.\n
Funksionet closefrom dhe posix_spawn_file_actions_addclosefrom_np u shtuan, duke lejuar mbylljen e t\u00eb gjith\u00eb deshifruesve t\u00eb skedar\u00ebve, numri i t\u00eb cil\u00ebve \u00ebsht\u00eb m\u00eb i madh ose i barabart\u00eb me vler\u00ebn e caktuar.\n
N\u00eb m\u00ebnyrat «_DYNAMIC_STACK_SIZE_SOURCE» dhe «_GNU_SOURCE», vlerat PTHREAD_STACK_MIN, MINSIGSTKSZ dhe SIGSTKSZ tani nuk jan\u00eb konstante, \u00e7ka lejon mb\u00ebshtetje p\u00ebr grupe regjistrash me madh\u00ebsi dinamike, p\u00ebr shembull, q\u00eb ofrohen nga zgjatja ARM SVE.\n
N\u00eb lidh\u00ebs \u00ebsht\u00eb implementuar opsioni «—list-diagnostics» p\u00ebr t\u00eb nxjerr\u00eb informacione t\u00eb lidhura me operacionet e p\u00ebrcaktimit t\u00eb IFUNC (funksioni indirekt) dhe zgjedhjes s\u00eb ndarjes glibc-hwcaps.\n
\u00cbsht\u00eb implementuar makron __STDC_WANT_IEC_60559_EXT__, e cila \u00ebsht\u00eb e destinuar p\u00ebr t\u00eb kontrolluar ekzistenc\u00ebn e funksioneve t\u00eb p\u00ebrcaktuara n\u00eb aplikimin «F» t\u00eb specifikimit ISO C2X.\n
P\u00ebr sistemet powerpc64*, \u00ebsht\u00eb implementuar opsioni «—disable-scv», i cili lejon nd\u00ebrtimin e glibc pa mb\u00ebshtetje p\u00ebr instruksionin scv.\n
N\u00eb skedarin gconv-modules \u00ebsht\u00eb l\u00ebn\u00eb vet\u00ebm nj\u00eb grup minimal i moduleve baz\u00eb gconv, nd\u00ebrsa t\u00eb tjerat jan\u00eb zhvendosur n\u00eb nj\u00eb skedar t\u00eb jasht\u00ebm gconv-modules-extra.conf, t\u00eb vendosur n\u00eb katalogun gconv-modules.d.\n
P\u00ebr platform\u00ebn Linux \u00ebsht\u00eb implementuar parametri glibc.pthread.stack_cache_size, i cili mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb konfiguruar madh\u00ebsin\u00eb e caches s\u00eb stack-ut pthread.\n
Funksioni inet_neta nga skedari <arpa\/inet.h> \u00ebsht\u00eb shpallur i vjetruar, si dhe disa funksione t\u00eb p\u00ebrdorura rrall\u00eb nga <resolv.h> (dn_count_labels, fp_nquery, fp_query, fp_resstat, hostalias, loc_aton, loc_ntoa, p_cdname, p_cdnname, p_class, p_fqname, p_fqnname, p_option, p_query, p_rcode, p_time, p_type, putlong, putshort, res_hostalias, res_isourserver, res_nameinquery, res_queriesmatch, res_randomid, sym_ntop, sym_ntos, sym_ston) dhe <arpa\/nameser.h> (ns_datetosecs, ns_format_ttl, ns_makecanon, ns_parse_ttl, ns_samedomain, ns_samename, ns_sprintrr, ns_sprintrrf, ns_subdomain). N\u00eb vend t\u00eb k\u00ebtyre funksioneve, rekomandohet p\u00ebrdorimi i bibliotikave t\u00eb ve\u00e7anta p\u00ebr pun\u00eb me DNS.\n
Funksionet pthread_mutex_consistent_np, thread_mutexattr_getrobust_np, pthread_mutexattr_setrobust_np dhe pthread_yield jan\u00eb shpallur t\u00eb vjetra, dhe n\u00eb vend t\u00eb tyre duhet t\u00eb p\u00ebrdoren pthread_mutex_consistent, thread_mutexattr_getrobust, thread_mutexattr_setrobust dhe sched_yield.\n
P\u00ebrdorimi i lidhjeve simbolike p\u00ebr lidhjen e objekteve t\u00eb ndar\u00eb t\u00eb instaluara me versionin e Glibc \u00ebsht\u00eb ndaluar. Tani k\u00ebto objekte instalohen si ato q\u00eb jan\u00eb (p\u00ebr shembull, libc.so.6 tani \u00ebsht\u00eb nj\u00eb skedar, jo nj\u00eb lidhje me libc-2.34.so).\n
Me default jan\u00eb \u00e7aktivizuar mund\u00ebsit\u00eb e debugging n\u00eb malloc, si MALLOC_CHECK_ (glibc.malloc.check), mtrace() dhe mcheck(), t\u00eb cilat jan\u00eb kaluar n\u00eb nj\u00eb bibliotek\u00eb t\u00eb ve\u00e7ant\u00eb libc_malloc_debug.so, n\u00eb t\u00eb cil\u00ebn jan\u00eb transfertuar gjithashtu funksionet e vjetra malloc_get_state dhe malloc_set_state.\n
N\u00eb Linux, p\u00ebr t\u00eb punuar funksione si shm_open dhe sem_open, tani k\u00ebrkohet nj\u00eb pajisje \/dev\/shm.\n
Jan\u00eb eliminuar vulnerabilitetet:\n
\n
CVE-2021-27645: d\u00ebshtimi i procesit nscd (daemon p\u00ebr ruajtjen e cache-n e serverit t\u00eb emrave) p\u00ebr shkak t\u00eb thirrjes s\u00eb dyfisht\u00eb t\u00eb funksionit free gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave netgroup t\u00eb formatuara posa\u00e7\u00ebrisht.\n
CVE-2021-33574: qasja n\u00eb nj\u00eb zon\u00eb kujtese tashm\u00eb t\u00eb liruar (use-after-free) n\u00eb funksionin mq_notify kur p\u00ebrdoret lloji i njoftimeve SIGEV_THREAD me atributin e thread-it p\u00ebr t\u00eb cilin \u00ebsht\u00eb vendosur nj\u00eb mask\u00eb alternative mb\u00ebshtetjeje p\u00ebr CPU. Problemi mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebshtim, por nuk p\u00ebrjashtohen as variante t\u00eb tjera sulmi.\n
CVE-2021-35942: mbushja e tepric\u00ebs s\u00eb parametrave n\u00eb funksionin wordexp mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebshtimin e aplikacionit. <\/ul>\n<\/ul>\n