I-Checkpoint ihlongoza indlela yokuvikela ye-Safe-Linking, okwenza kube nzima kakhulu ukuxhaphaza ubungozi

Inkampani yokuhlola kwethulwe Indlela yokuvikela i-Safe-Linking, eyenza kube nzima ukudala ukuxhashazwa okushintsha incazelo noma ukuguqulwa kwezikhombisi kumabhafa abiwe lapho kusetshenziswa ikholi ye-malloc. I-Safe-Linking ayivimbeli ngokuphelele amathuba okuxhaphaza ubungozi, kodwa ngokuphezulu okuncane kwenza kube nzima kakhulu ukwakhiwa kwezigaba ezithile zokuxhashazwa, njengoba ngaphezu kokuchichima kwebuffer esebenzisekayo, kuyadingeka ukuthola okunye ubungozi obudala ukuvuza kolwazi mayelana ukubekwa kwenqwaba enkumbulweni.

Amapheshana asebenzisa i-Safe-Linking alungiselwe i-Glibc (ptmalloc), iClibc-NG (dlmalloc), i-gperftools (tcmalloc) ne-Google TCMalloc, futhi ahlongozwa ukuthi athuthukiswe ukuvikelwa ku-Chromium (ku-
Kusukela ngo-2012, i-Chromium isivele yakha ngendlela yokuvikela ye-MaskPtr okuhloswe ngayo ukuxazulula inkinga efanayo, kodwa isisombululo esivela ku-Checkpoint sibonisa ukusebenza okuphezulu).
Iziqephu eziphakanyisiwe sezivele zigunyaziwe ukuthi zilethwe ngo-Agasti I-Glibc 3.32 futhi i-Safe-Linking izonikwa amandla ngokuzenzakalela. I-uClibc-NG isekela i-Safe-Linking wangena ifakwe ekukhululweni 1.0.33 futhi inikwe amandla ngokuzenzakalela. Izinguquko ku-gperftools (i-tcmalloc endala) kwamukelwe, kodwa izonikezwa njengenketho ekukhishweni okuzayo.

Abathuthukisi I-TCMalloc (i-tcmalloc entsha) yenqabile ukwamukela shintsha, icaphuna ukuwohloka kokusebenza okunzima kanye nesidingo sokwengeza izivivinyo ezibanzi ukuze kuhlolwe njalo ukuthi yonke into isebenza njengoba bekulindelekile. Ukuhlolwa konjiniyela be-Checkpoint kubonise ukuthi indlela ye-Safe-Linking ayiholeli ekusetshenzisweni kwenkumbulo okwengeziwe, futhi ukusebenza lapho kwenziwa imisebenzi yenqwaba yehliswa ngokwesilinganiso ngo-0.02% kuphela, futhi esimweni esibi kakhulu ngo-1.5% (uma kuqhathaniswa, i-overhead in indlela esetshenziswe ku-Chromium ilinganiselwa “njengengaphansi kuka-2%). Ukufakwa
I-Safe-Linking iphumela emiyalweni eyengeziwe engu-2-3 yomhlangano esetshenziswa isikhathi ngasinye lapho kubizwa mahhala(), kanye nemiyalo engu-3-4 isikhathi ngasinye lapho kubizwa khona i-malloc(). Ukuqalisa izigaba zokukhiqiza nenani elingahleliwe akudingekile.

I-Safe-Linking ingase isetshenziselwe hhayi nje ukuthuthukisa ukuvikeleka kokusetshenziswa kwenqwaba ehlukahlukene, kodwa futhi nokwengeza izilawuli zobuqotho kunoma yiziphi izakhiwo zedatha ezisebenzisa uhlu oluxhumeke olulodwa lwezinkomba ezibekwe eduze kwamabhafa ngokwawo. Indlela ilula kakhulu ukuyisebenzisa futhi idinga kuphela ukwengeza i-macro eyodwa futhi isetshenziswe ezikhombi ebhulokhini elilandelayo kukhodi (ngokwesibonelo, ye-Glibc uyashintsha imigqa embalwa yekhodi). Indlela incike kulezi zinguquko ezilandelayo:

+#chaza PROTECT_PTR(pos, ptr) \
+ ((__typeof (ptr)) (((((size_t) pos) >> 12) ^ ((size_t) ptr)))

+#chaza REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)

- nextp = p->fd;
+ nextp = REVEAL_PTR (p->fd);
...

Umongo wendlela ukusebenzisa idatha engahleliwe evela kumshini we-ASLR we-randomization (mmap_base) ukuze kuvikelwe izinhlu ezixhumeke zodwa ezifana ne-Fast-Bins ne-TCache. Ngaphambi kokuthi inani lisetshenziswe kusikhombisi sento elandelayo ohlwini, lenza ukuguqulwa kwemaski futhi lihlole ukuqondana kwekhasi. Isikhombi sithathelwa indawo umphumela wokusebenza "(L >> PAGE_SHIFT) XOR (P)", lapho u-P eyinani lesikhombi futhi u-L indawo yenkumbulo lapho iphoyinti ligcinwa khona.

Lapho isetshenziswa ohlelweni I-ASLR (I-Address Space Layout Randomization) ingxenye ye-L bits enekheli lenqwaba iqukethe amanani angahleliwe asetshenziswa njengokhiye wokufaka ikhodi engu-P (ekhishwe ngokusebenza kokushintshwa kwe-12-bit kumakhasi angu-4096-byte). Lokhu kukhohlisa kunciphisa ubungozi bokudunwa kwezikhombisi ekuxhashazweni, njengoba isikhombisi asigcinwa ngendlela yaso yasekuqaleni futhi ukusishintsha kudinga ulwazi lokwabiwa kwenqwaba. Ngaphezu kwalokho, ikhodi yesichibi iqukethe isheke elengeziwe lokuqondanisa kwebhulokhi, elingavumeli umhlaseli ukuthi athathele isikhombisi ngenani elingaqondile futhi edinga ulwazi lwenani lamabhithi aqondanisiwe, okuthi kumasistimu angama-64-bit avumele futhi ukuvinjwa. Imizamo engu-15 kweyi-16 yokuhlasela engakunaki ukuqondanisa .

Indlela iyasebenza ekuvikeleni ekuhlaselweni okusebenzisa ukuphinda kubhalwe ngokwengxenye yesikhombi (ukushintsha amabhayithi aphansi), ukubhala kabusha kwesikhombi esiphelele (ukuqondisa kabusha kukhodi yomhlaseli) nokushintsha indawo yohlu ekhelini elingaqondile. Njengesibonelo, kuboniswa ukuthi ukusetshenziswa kwe-Safe-Linking ku-malloc kuzovumela ukuvimbela ukuxhashazwa kamuva nje. ikhonjiwe ngabacwaningi abasengozini efanayo I-CVE-2020-6007 ekukhanyeni okuhlakaniphile kwe-Philips Hue Bridge, okubangelwa ukuchichima kwebhafa futhi okukuvumela ukuthi uthole ukulawula idivayisi.

Source: opennet.ru