{"id":82655,"date":"2020-05-23T19:42:11","date_gmt":"2020-05-23T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej"},"modified":"2020-05-23T19:42:11","modified_gmt":"2020-05-23T17:42:11","slug":"checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","title":{"rendered":"Checkpoint har erbjudit en skyddsteknik som kallas Safe-Linking, vilket komplicerar utnyttjandet av s\u00e5rbarheter.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

F\u00f6retaget Checkpoint har presenterat<\/a><\/noindex> Skyddsmekanismen Safe-Linking g\u00f6r det sv\u00e5rare att skapa exploateringar som manipulerar tilldelningen eller \u00e4ndringen av pekare till buffrar som allokeras vid anrop av malloc. Safe-Linking blockerar inte helt m\u00f6jligheten att utnyttja s\u00e5rbarheter, men med minimala overheadkostnader komplicerar det avsev\u00e4rt skapandet av vissa kategorier av exploateringar, eftersom f\u00f6rutom den utnyttjade buffert\u00f6verskridningen m\u00e5ste ytterligare en s\u00e5rbarhet hittas som orsakar l\u00e4ckage av information om heapens (minnes) placering.<\/p>\n

Patcher med implementering av Safe-Linking har f\u00f6rberetts f\u00f6r Glibc (ptmalloc), uClibc-NG (dlmalloc), gperftools (tcmalloc) och Google TCMalloc, och har ocks\u00e5 f\u00f6reslagits f\u00f6r att modernisera skyddet i Chromium (i
\nChromium har sedan 2012 en teknik som riktar sig mot samma problem, kallad MaskPtr, men l\u00f6sningen fr\u00e5n Checkpoint visar h\u00f6gre prestanda).
\nDe f\u00f6reslagna patcherna har redan godk\u00e4nts f\u00f6r leverans i augustiutg\u00e5van Glibc 3.32<\/a><\/noindex> och implementeringen av Safe-Linking kommer att inkluderas som standard. I uClibc-NG kommer st\u00f6d f\u00f6r Safe-Linking har g\u00e5tt<\/a><\/noindex> att ing\u00e5 i version 1.0.33 och inkluderas som standard. F\u00f6r gperftools (gamla tcmalloc) planeras \u00e4ndringar antogs<\/a><\/noindex>, men de kommer att erbjudas i en av framtida utg\u00e5vor som ett alternativ. <\/p>\n

Utvecklare TCMalloc<\/a><\/noindex> (nya tcmalloc) avb\u00f6jde att acceptera \u00e4ndring<\/a><\/noindex>, med h\u00e4nvisning till den kraftiga nedg\u00e5ngen i prestanda och behovet av att l\u00e4gga till ut\u00f6kade tester f\u00f6r att regelbundet kontrollera att allt fungerar som det ska. Tester som genomf\u00f6rts av ingenj\u00f6rerna p\u00e5 Checkpoint visade att metoden Safe-Linking inte medf\u00f6r n\u00e5gra extra minneskostnader, och prestandan vid hantering av minnesblock minskar i genomsnitt bara med 0,02 %, medan den i det v\u00e4rsta fallet minskar med 1,5 % (f\u00f6r j\u00e4mf\u00f6relse, overhead-kostnaderna i den metod som anv\u00e4nds i Chromium uppskattas till \u201dmindre \u00e4n 2 %\u201d). Inkludering
\nSafe-Linking medf\u00f6r att 2-3 ytterligare assemblerinstruktioner utf\u00f6rs vid varje anrop av free() och 3-4 instruktioner vid anrop av malloc(). Ingen initialisering eller generering av slumpv\u00e4rden kr\u00e4vs.<\/p>\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Safe-Linking kan anv\u00e4ndas inte bara f\u00f6r att \u00f6ka s\u00e4kerheten f\u00f6r olika heap-implementeringar, utan ocks\u00e5 f\u00f6r att l\u00e4gga till integritetskontroller i alla datastrukturer d\u00e4r enkelriktade pekarlistor anv\u00e4nds, placerade bredvid sj\u00e4lva buffrarna. Metoden \u00e4r mycket enkel att implementera och kr\u00e4ver endast till\u00e4gg av en makro och dess anv\u00e4ndning f\u00f6r pekarna till n\u00e4sta block i koden (till exempel f\u00f6r Glibc \u00e4ndras<\/a><\/noindex> bara n\u00e5gra rader kod). Metoden sammanfattas i f\u00f6ljande \u00e4ndringar:<\/p>\n

+#define PROTECT_PTR(pos, ptr) \\
\n + ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))<\/p>\n

+#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)<\/p>\n

\u2014 nextp = p->fd;
\n + nextp = REVEAL_PTR (p->fd);
\n …<\/p>\n

K\u00e4rnan i metoden \u00e4r att anv\u00e4nda slumpdata fr\u00e5n adresseringsrandomiseringsmekanismen ASLR (mmap_base) f\u00f6r att skydda l\u00e4nkade listor, s\u00e5som Fast-Bins och TCache. Innan till\u00e4mpning p\u00e5 v\u00e4rdet av pekaren till n\u00e4sta element i listan utf\u00f6rs en maskering och en justering f\u00f6r att kontrollera sidgr\u00e4nsen i minnet. Pekaren ers\u00e4tts med resultatet av operationen \u201d(L >> PAGE_SHIFT) XOR (P)\u201d, d\u00e4r P \u00e4r pekarens v\u00e4rde och L \u00e4r platsen i minnet d\u00e4r pekaren lagras.
\n

\"Checkpoint<\/a><\/noindex><\/center><\/p>\n

Vid anv\u00e4ndning i systemet ASLR<\/a><\/noindex> (Address Space Layout Randomization) inneh\u00e5ller en del av bitarna L med den grundl\u00e4ggande heap-adressen slumpm\u00e4ssiga v\u00e4rden, som anv\u00e4nds som nyckel f\u00f6r att koda P (utdragen med en 12-bitars skiftning f\u00f6r 4096-bytes sidor). S\u00e5dan manipulation minskar risken f\u00f6r att en pekare f\u00e5ngas i ett exploit, eftersom pekaren inte lagras i sitt ursprungliga format och f\u00f6r att ers\u00e4tta den kr\u00e4vs kunskap om heapens placering. Dessutom finns det en extra justeringskontroll i patchkoden som hindrar en angripare fr\u00e5n att ers\u00e4tta pekaren med ett ojusterat v\u00e4rde och kr\u00e4ver kunskap om antalet bitar som justeringen utf\u00f6rts p\u00e5, vilket p\u00e5 64-bitars system dessutom blockerar 15 av 16 attacker som inte tar h\u00e4nsyn till justering.<\/p>\n

Metoden \u00e4r effektiv f\u00f6r att skydda mot attacker d\u00e4r delvis \u00f6verskrivning av pekare (\u00e4ndring av de l\u00e4gsta bytes) anv\u00e4nds, fullst\u00e4ndig \u00f6verskrivning av pekare (omdirigering till angriparens kod) och byte av listpositionen vid en ojusterad adress. Som exempel visas att anv\u00e4ndningen av Safe-Linking i malloc skulle blockera exploatering av nyligen identifierad<\/a><\/noindex> de samma forskarna s\u00e5rbarheter CVE-2020-6007<\/a><\/noindex> i den smarta belysningen Philips Hue Bridge, orsakad av en buffert\u00f6verfl\u00f6dning som m\u00f6jligg\u00f6r kontroll \u00f6ver enheten.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440\u044b, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0432\u044b\u0437\u043e\u0432\u0430 malloc. Safe-Linking \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u043f\u0440\u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u0430\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u043c\u0438\u043c\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Checkpoint har erbjudit en skyddsteknik Safe-Linking som f\u00f6rsv\u00e5rar exploatering av s\u00e5rbarheter | ProHoster","description":"F\u00f6retaget Checkpoint har presenterat skyddsmekanismen Safe-Linking.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Checkpoint \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking, \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u044e\u0449\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Checkpoint \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b Safe-Linking.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/checkpoint-predlozhil-tehniku-zashhity-safe-linking-uslozhnyayushhuyu-ekspluatacziyu-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-23T17:42:11+00:00","article:modified_time":"2020-05-23T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:33:26","updated":"2022-10-01 05:37:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/82655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=82655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/82655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/82656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=82655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=82655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=82655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}