{"id":71652,"date":"2020-02-27T08:51:34","date_gmt":"2020-02-27T05:51:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8"},"modified":"2020-03-03T16:10:40","modified_gmt":"2020-03-03T13:10:40","slug":"0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","title":{"rendered":"0-dag s\u00e5rbarhet i Chrome, identifierad genom analys av f\u00f6r\u00e4ndringar i V8-motorn","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskare fr\u00e5n f\u00f6retaget Exodus Intelligence demonstrerade<\/a><\/noindex> har identifierat en svaghet i processen f\u00f6r att \u00e5tg\u00e4rda s\u00e5rbarheter i kodbasen f\u00f6r Chrome\/Chromium. Problemet \u00e4r kopplat till att Google avsl\u00f6jar information om att de \u00e5tg\u00e4rdade s\u00e5rbarheterna r\u00f6r s\u00e4kerhetsfr\u00e5gor f\u00f6rst efter att versionen har sl\u00e4ppts, men
\nl\u00e4gger till kod i arkivet f\u00f6r att \u00e5tg\u00e4rda s\u00e5rbarheten i V8-motorn f\u00f6re lanseringen. Under en tid genomg\u00e5r fixarna tester och det skapas ett f\u00f6nster d\u00e4r s\u00e5rbarheten \u00e4r \u00e5tg\u00e4rdad i kodbasen och tillg\u00e4nglig f\u00f6r analys, men s\u00e5rbarheten f\u00f6rblir o\u00e5tg\u00e4rdad p\u00e5 anv\u00e4ndarsystem. <\/p>\n

Genom att studera \u00e4ndringarna i arkivet lade forskarna m\u00e4rke till att det lagts till den 19 februari fix<\/a><\/noindex> och lyckades p\u00e5 tre dagar f\u00f6rbereda exploit<\/a><\/noindex>, en exploit som p\u00e5verkar aktuella Chrome-versioner (den publicerade exploiten inkluderade inte komponenter f\u00f6r att kringg\u00e5 sandbox-isoleringen). Google reagerade snabbt med har sl\u00e4ppt<\/a><\/noindex> uppdateringen Chrome 80.0.3987.122, som \u00e5tg\u00e4rdade relaterade s\u00e5rbarheter kopplade till den f\u00f6reslagna exploiten s\u00e5rbarhet<\/a><\/noindex> (CVE-2020-6418). S\u00e5rbarheten uppt\u00e4cktes f\u00f6rst av Googles ingenj\u00f6rer och orsakades av ett problem med typbehandling i JSCreate-operationen, vilket kan utnyttjas via metoden Array.pop eller Array.prototype.pop. Intressant nog fanns en liknande fr\u00e5ga fixad<\/a><\/noindex> i Firefox sommaren f\u00f6rra \u00e5ret.<\/p>\n

Forskare upplyste ocks\u00e5 om att det underl\u00e4ttas att skapa exploits p\u00e5 grund av inf\u00f6randet av Chrome 80<\/a><\/noindex> pekarmekanismen som g\u00f6r att endast unika l\u00e4gre bitar av pekaren lagras (ist\u00e4llet f\u00f6r hela 64-bitarsv\u00e4rdet), vilket signifikant minskar minnesanv\u00e4ndningen i heapen. Till exempel placeras vissa datakonstruktioner i b\u00f6rjan av heapen, s\u00e5som tabeller \u00f6ver inbyggda funktioner, \"native context\"-objekt och<\/a><\/noindex> (ist\u00e4llet f\u00f6r hela 64-bitarsv\u00e4rdet lagras endast de unika l\u00e5ga bitarna av pekaren, vilket g\u00f6r att minnesanv\u00e4ndningen i heapen kan minskas avsev\u00e4rt). Till exempel, vissa data strukturer som ligger i b\u00f6rjan av heapen, s\u00e5som tabellen f\u00f6r inbyggda funktioner, objekt «native context» och samlare, nu p\u00e5 f\u00f6ruts\u00e4gbara och skrivbara packade adresser.<\/a><\/noindex> Intressant \u00e4r att f\u00f6r n\u00e4stan ett \u00e5r sedan gjorde Exodus Intelligence<\/p>\n

en liknande demonstration av m\u00f6jligheten att skapa en exploit baserat p\u00e5 studier av den offentliga loggen f\u00f6r \u00e5tg\u00e4rder i V8, men tycks inte ha dragits n\u00e5gra slutsatser. P\u00e5 forskarnas plats kunde det ha funnits angripare eller underr\u00e4ttelsetj\u00e4nster som, n\u00e4r de skapade exploiten, skulle ha m\u00f6jlighet att i dagar eller till och med veckor utnyttja s\u00e5rbarheten dolt innan en ny version av Chrome sl\u00e4pptes.<\/a><\/noindex> en liknande demonstration av m\u00f6jligheten att skapa en exploatering baserad p\u00e5 studiet av den offentliga loggen f\u00f6r korrigeringar inom V8, men det verkar som om inga adekvata slutsatser drogs. P\u00e5 forskarnas plats
\nExodus Intelligence skulle kunna ha passerats av angripare eller underr\u00e4ttelsetj\u00e4nster, som vid skapandet av en exploatering skulle ha m\u00f6jlighet att d\u00f6lja utnyttjandet av s\u00e5rbarheten i dagar eller till och med veckor innan n\u00e4sta version av Chrome sl\u00e4pptes. <\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Exodus Intelligence \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043b\u0430\u0431\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 Chrome\/Chromium. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e Google \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u0432\u043d\u0435\u0441\u0451\u043d\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u044e\u0442 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0440\u0435\u043b\u0438\u0437\u0430, \u043d\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 V8 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u0430. \u041a\u0430\u043a\u043e\u0435-\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71652","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd470-dag s\u00e5rbarhet i Chrome, avsl\u00f6jad genom analys av \u00e4ndringar i V8-motorn | ProHoster","description":"Forskare fr\u00e5n f\u00f6retaget Exodus Intelligence har visat en svag punkt i processen f\u00f6r \u00e5tg\u00e4rder.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd470-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Chrome, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u0430\u043d\u0430\u043b\u0438\u0437 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 V8 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Exodus Intelligence \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043b\u0430\u0431\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/0-day-uyazvimost-v-chrome-vyyavlennaya-cherez-analiz-izmenenij-v-dvizhke-v8","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-27T05:51:34+00:00","article:modified_time":"2020-03-03T13:10:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:58:25","updated":"2022-10-01 14:35:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/71652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=71652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/71652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=71652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=71652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=71652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}