{"id":83016,"date":"2020-05-27T19:41:58","date_gmt":"2020-05-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket"},"modified":"2020-05-27T19:41:58","modified_gmt":"2020-05-27T17:41:58","slug":"25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","title":{"rendered":"25 s\u00e5rbarheter i RTOS Zephyr, inklusive de som kan utnyttjas via ICMP-paket","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskare fr\u00e5n NCC Group har publicerat<\/a><\/noindex> resultaten av en revision av det fria projektet Zephyr<\/a><\/noindex>, utvecklande<\/a><\/noindex> ett realtidsoperativsystem (RTOS) som syftar till att utrusta enheter som \u00f6verensst\u00e4mmer med konceptet «Internet of Things» (IoT, Internet of Things). Under revisionen uppt\u00e4cktes 25 s\u00e5rbarheter<\/a><\/noindex> i Zephyr och 1 s\u00e5rbarhet i MCUboot. Utvecklingen av Zephyr sker i samarbete med f\u00f6retag som Intel. <\/p>\n

Totalt uppt\u00e4cktes 6 s\u00e5rbarheter i n\u00e4tverksstacken, 4 i k\u00e4rnan, 2 i kommandotolken, 5 i hanterare av systemanrop, 5 i USB-underkapseln och 3 i mekanismen f\u00f6r firmwareuppdatering. Tv\u00e5 problem tilldelades kritisk fara, tv\u00e5 - h\u00f6g, 9 m\u00e5ttlig, 9 - l\u00e5g och 4 - f\u00f6r vidare \u00f6verv\u00e4gande. De kritiska problemen r\u00f6r IPv4-stacken och MQTT-parsern, de farliga - drivrutiner f\u00f6r USB-masslagring och USB DFU. Vid tidpunkten f\u00f6r offentligg\u00f6randet hade korrigeringar endast f\u00f6rberetts f\u00f6r de 15 mest allvarliga s\u00e5rbarheterna, medan problemen som leder till \u00f6verbelastning eller relaterade till brister i k\u00e4rnans extra skyddsmekanismer f\u00f6rblir ofixade.<\/p>\n

I IPv4-stacken p\u00e5 plattformen uppt\u00e4cktes en s\u00e5rbarhet som kan utnyttjas p\u00e5 distans och leder till minneskorruption vid behandling av s\u00e4rskilt modifierade ICMP-paket. Ett annat allvarligt problem hittades i MQTT-protokollets parser, vilket orsakas av bristen p\u00e5 korrekt l\u00e4ngdkontroll av f\u00e4lten i rubriken och kan leda till fj\u00e4rrkodexekvering. Mindre allvarliga problem som kan leda till \u00f6verbelastning har uppt\u00e4ckts i IPv6-stack och implementeringen av CoAP-protokollet.<\/p>\n

De andra problemen kan utnyttjas lokalt f\u00f6r att orsaka \u00f6verbelastning eller exekvering av kod p\u00e5 k\u00e4rnniv\u00e5. St\u00f6rsta delen av dessa s\u00e5rbarheter \u00e4r kopplade till bristen p\u00e5 ordentliga kontroller av argumenten f\u00f6r systemanrop och kan leda till skrivning och l\u00e4sning av godtyckliga k\u00e4rnomr\u00e5den. Problemen omfattar \u00e4ven sj\u00e4lva koden f\u00f6r hantering av systemanrop - att referera till ett negativt systemanropsnummer leder till heltals\u00f6verfl\u00f6d. Det har ocks\u00e5 uppt\u00e4ckts problem i k\u00e4rnan i implementeringen av ASLR-skyddet (adressrymdsrandomisering) och mekanismen f\u00f6r installation av kanariefisketiketter i stacken, vilket g\u00f6r dessa mekanismer ineffektiva. <\/p>\n

M\u00e5nga problem ber\u00f6r USB-stacken och enskilda drivrutiner. Till exempel g\u00f6r ett problem med USB mass storage det m\u00f6jligt att orsaka en buffert\u00f6verfyllning och k\u00f6ra kod p\u00e5 kernel-niv\u00e5 n\u00e4r en enhet ansluts till en USB-v\u00e4rd som kontrolleras av en angripare. En s\u00e5rbarhet i USB DFU, drivrutinen f\u00f6r att ladda ny firmware via USB, g\u00f6r det m\u00f6jligt att ladda en modifierad firmwarebild till den interna Flash-minneskontrollern utan att anv\u00e4nda n\u00e5gon kryptering och kringg\u00e5 skyddat startl\u00e4ge med komponentverifiering genom digital signatur. Dessutom har koden f\u00f6r den \u00f6ppna bootloadern studerats MCUboot<\/a><\/noindex>, d\u00e4r en ofarlig s\u00e5rbarhet har hittats,
\nsom kan leda till buffert\u00f6verfyllning vid anv\u00e4ndning av SMP-protokollet (Simple Management Protocol) via UART.<\/p>\n

Vi p\u00e5minner om att Zephyr f\u00f6r alla processer tillhandah\u00e5ller endast ett globalt delat virtuellt adressutrymme (SASOS, Single Address Space Operating System). Applikationsspecifik kod kombineras med en anpassad k\u00e4rna och bildar en monolitisk exekverbara fil f\u00f6r laddning och k\u00f6rning p\u00e5 specifik h\u00e5rdvara. Alla systemresurser definieras under kompilering, vilket minskar kodstorleken och \u00f6kar prestanda. Endast de funktioner som k\u00e4rnan kr\u00e4ver f\u00f6r att k\u00f6ra applikationen kan inkluderas i systemavbilden.<\/p>\n

Det \u00e4r notabelt att bland Zephyrs nyckelf\u00f6rdelar av medlemmar p\u00e5 Hacker News i tematiska tr\u00e5dar som ett go-to verktyg f\u00f6r benchmarking.<\/a><\/noindex> utvecklingen med fokus p\u00e5 s\u00e4kerhet. Det p\u00e5st\u00e5s<\/a><\/noindex>, att alla stadier av utvecklingen genomg\u00e5r obligatoriska s\u00e4kerhetsbekr\u00e4ftelsesteg: fuzzing-testning, statisk analys, penetrationstester, kodgranskning, analys av bakd\u00f6rrsintr\u00e4de och hotmodellering.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Zephyr, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (RTOS), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 «\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0432\u0435\u0449\u0435\u0439» (IoT, Internet of Things). \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 25 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Zephyr \u0438 1 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MCUboot. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 Zephyr \u0432\u0435\u0434\u0451\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intel. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83016","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4725 s\u00e5rbarheter i RTOS Zephyr, inklusive de som kan utnyttjas via ICMP-paket | ProHoster","description":"Forskare fr\u00e5n NCC Group har publicerat resultaten av en revision.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4725 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 RTOS Zephyr, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 ICMP-\u043f\u0430\u043a\u0435\u0442 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/25-uyazvimostej-v-rtos-zephyr-v-tom-chisle-ekspluatiruemye-cherez-icmp-paket","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T17:41:58+00:00","article:modified_time":"2020-05-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83016","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:51:14","updated":"2022-10-02 09:38:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/83016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=83016"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/83016\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=83016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=83016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=83016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}