Ukuba sengozini okubalulekile ekusetshenzisweni komsebenzi we-memcpy we-ARMv7 kusuka ku-Glibc

Cisco Security Abacwaningi kungamboziwe imininingwane ubuthakathaka (I-CVE-2020-6096) ekusetshenzisweni komsebenzi we-memcpy() onikezwe yi-Glibc wengxenyekazi engu-32-bit ARMv7. Inkinga ibangelwa ukuphathwa okungalungile kwamanani angalungile wepharamitha enquma usayizi wendawo ekopishiwe, ngenxa yokusetshenziswa kokulungiswa komhlangano okushintsha izinombolo ezisayiniwe ezingu-32-bit. Ukushayela i-memcpy() kumasistimu we-ARMv7 anosayizi ongemuhle kuphumela ekuqhathanisweni okungalungile kwamanani futhi kubhala endaweni engaphandle kwemingcele yebhafa eshiwo.

Ukuba sengozini kungase kusetshenziswe ukuze kufakwe ikhodi esimweni lapho umhlaseli engakwazi ukuhlela ukwakheka kwevelu engalungile yokuhluka okudluliswa ngakho usayizi wedatha ekopishiwe (ngokwesibonelo, kuzoba kubi uma kudluliselwa ngaphezu kuka-2 GB we idatha, kodwa ngesikhathi sokuhlasela, ukuze weqe imikhawulo ye-buffer, udinga ukudlulisa okungenani i-4GB). Umsebenzi we-memcpy () usetshenziswa kakhulu ezinhlelweni zokusebenza, futhi ama-ARMv7 processors ajwayelekile ezinhlelweni zezimoto, iselula, izimboni, abathengi, ukuxhumana kanye namadivayisi ashumekiwe, okungenzeka angaphansi kokuhlaselwa kusetshenziswa i-Bluetooth, HD Radio/DAB, USB, CAN ibhasi, I-Wi-Fi Fi neminye imithombo yedatha yangaphandle (isibonelo, amasevisi nezinhlelo zokusebenza ezifinyeleleka ngenethiwekhi eyamukela idatha yokufaka ngaphandle kwemikhawulo yosayizi ingahlaselwa).

Isibonelo ukwakhiwa kokusebenza kokuhlasela iseva ye-HTTP eyakhelwe kumasistimu olwazi lwezimoto, okufinyeleleka ngenethiwekhi yemoto ye-Wi-Fi. Umhlaseli ongaphandle angasebenzisa ukuba sengozini kwe-memcpy kule seva ngokuthumela isicelo esikhulu kakhulu se-GET futhi athole ukufinyelela kwezimpande kusistimu.

Ukuba sengozini okubalulekile ekusetshenzisweni komsebenzi we-memcpy we-ARMv7 kusuka ku-Glibc

Kuzinhlelo ze-32-bit x86, inkinga ayiveli, njengoba ukuqaliswa kwe-memcpy kwalesi sakhiwo kuhumusha kahle ukuhluka kosayizi njengenani eliyinombolo engasayiniwe lohlobo lukasayizi_t (ngolimi lomhlangano. ukuqaliswa ku-ARMv7 ithathwa njengenombolo ephelele esayiniwe esikhundleni sikasayizi_t). Ukulungiswa okwamanje kutholakala njenge isichibi, ezofakwa kusibuyekezo sika-Agasti Glibc 2.32.
Ukulungisa kubilisa ekushintsheni ukusetshenziswa kwemiyalelo yokuhlanganisa esebenza emisebenzini esayiniwe (i-bge ne-blt) ngozakwabo abangabhalisiwe (i-blo kanye nama-bhs).

Inkinga ayikaxazululwa I-Debian 9 kanye ne-10 (ayibonakali ku-Debian 8), Fedora, Ubuntu, OpenEmbedded, Tizen (esetshenziswa yi-glibc). RHEL ΠΈ SUSE Inkinga ayithinteki ngoba abasekeli amasistimu we-ARMv32 we-7-bit. I-Android ayithinteki ukuba sengozini ngoba isebenzisa ukufakwa kwayo kwe-libc (Bionic). IN I-OpenWRT Ngokuzenzakalelayo, abakhi abaningi basebenzisa i-Musl, kodwa i-glibc iyatholakala futhi endaweni yokugcina.

Source: opennet.ru

Engeza amazwana