Ho ba kotsing ea matsatsi a 0 ho Chrome ho bonts'itsoe ka tlhahlobo ea liphetoho enjeneng ea V8

Bafuputsi ba Exodus Intelligence li bontšitse ntlha e fokolang ts'ebetsong ea ho lokisa bofokoli ho Chrome/Chromium codebase. Bothata bo bakoa ke taba ea hore Google e senola hore liphetoho tse entsoeng li amana le litaba tsa ts'ireletso feela ka mor'a ho lokolloa, empa
e eketsa khoutu sebakeng sa polokelo ho lokisa bothata ba enjene ea V8 pele o phatlalatsa tokollo. Ka nako e itseng, litokiso li lekoa 'me fensetere e hlaha nakong eo ho senyeha ho fetohang ho tsitsitseng motheong oa khoutu' me e fumaneha bakeng sa tlhahlobo, empa ts'oaetso e lula e sa tsejoe ho litsamaiso tsa basebelisi.

Ha ba ntse ba ithuta ka liphetoho tse entsoeng sebakeng sa polokelo, bafuputsi ba ile ba hlokomela ho hong ho ekelitsoeng ka la 19 Hlakubele khalemelo mme ka matsatsi a mararo ba ne ba kgona ho lokisa qhekella, e amang litokollo tsa hajoale tsa Chrome (ts'ebetso e phatlalalitsoeng e ne e sa kenyelletse likarolo tsa ho tlola karohano ea sandbox). Google hang-hang lokollotsoe Ntlafatso ea Chrome 80.0.3987.122, e lokisa tšebeliso e reriloeng bofokodi (CVE-2020-6418). Bofokoli bo ile ba tsejoa qalong ke lienjiniere tsa Google 'me bo bakoa ke bothata ba ho sebetsana le mofuta oa mosebetsi oa JSCreate, o ka sebelisoang ka mokhoa oa Array.pop kapa Array.prototype.pop. Hoa hlokomeleha hore ho ne ho e-na le bothata bo tšoanang tsitsitseng ho Firefox lehlabuleng le fetileng.

Bafuputsi ba ile ba boela ba hlokomela boiketlo ba ho bōpa lintho tse sebelisoang ka lebaka la ho kenyelletsoa ha Chrome 80 mochine phuthelo ya matshwao (ho e-na le ho boloka boleng bo felletseng ba 64-bit, ho bolokoa likaroloana tse ikhethang tse tlase tsa pointer, tse ka fokotsang ts'ebeliso ea mohopolo oa qubu haholo). Mohlala, likarolo tse ling tsa mantlha tsa data tse kang tafole ea ts'ebetso e hahelletsoeng ka hare, lintho tsa tlhaho, le ntho tsa motso batho ba bokellang lithōle joale ba abetsoe liaterese tse pakiloeng tse ka lebelloang le tse ngoloang.

Hoa thahasellisa hore hoo e ka bang selemo se fetileng Exodus Intelligence e ne e etsoa pontšo e ts'oanang ea monyetla oa ho theha ts'ebetso e thehiloeng ho ithuteng tlaleho ea sechaba ea litokiso ho V8, empa, ka ho hlakileng, liqeto tse nepahetseng ha lia ka tsa lateloa. Sebakeng sa bafuputsi
Exodus Intelligence e ka ba bahlaseli kapa mekhatlo ea bohlale bao, ha ba theha tlhekefetso, ba ka bang le monyetla oa ho sebelisa monyetla oa ho ba kotsing ka sekhukhu matsatsi kapa libeke pele ho lokolloa ha Chrome e latelang.

Source: opennet.ru