Vakaona kushushikana muiyo kernel iyo inogona kubvumira kubiwa kweruzivo

Cisco Talos vaongorori vakaburitswa Mazuva mashoma apfuura kunetseka muLinux kernel iyo inogona kushandiswa kubira data uye zvakare inoshanda senzira yekukwidziridza ropafadzo uye kukanganisa maitiro.

Kunetseka inotsanangurwa se 'ruzivo rwekuzivisa kushomeka iyo inogona kubvumidza anorwisa kuti aone ndangariro yeiyo kernel stack. '

CVE-2020-28588 ndiko kunetseka uko yakawanikwa mune ARM zvishandiso proc / pid / syscall mashandiro 32-bit zvishandiso zvinomhanya iyo yekushandisa system. Sekureva kwaCisco Talos, dambudziko rakatanga kuwanikwa pane mudziyo unomhanya Azure Sphere.

Ruzivo rwekuzivisa kushushikana ruripo mune / proc / pid / syscall mashandiro eLinux Kernel 5.1 Yakagadzikana uye 5.4.66. Zvikurukuru, iyi nyaya yakaunzwa muv5.1-rc4 (inoita 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) uye ichiripo muv5.10-rc4, saka ese epakati shanduro dzinogona kunge dzichikanganiswa. Anorwisa anogona kuverenga / proc / pid / syscall kuti amise kunetseka uku, zvichikonzera kernel kurasikirwa nechirangaridzo.

Proc inyanzvi pseudo-fileystem pane Unix-senge anoshanda masystem ayo yaishandiswa pakuita zvine simba kuita data data yakawanikwa mune tsanga. Inopa ruzivo ruzivo uye rumwe ruzivo rwehurongwa mune yakasarudzika, faira-senge chimiro.

Semuenzaniso, ine zvinyorwa zvidiki / proc / [pid], imwe neimwe iine mafaera uye madhairekitori anofumura ruzivo nezve mamwe maitiro, anoverengwa nekushandisa inoenderana nzira ID. Muchiitiko cheiyo "syscall" faira, iri yepamutemo Linux inoshanda system faira iyo ine matanda eiyo system mafoni anoshandiswa nekernel.

Kambani, lHackers vanogona kushandisa kukanganisa uye kuwana iyo inoshanda sisitimu uye syscall faira kuburikidza nesisitimu inoshandiswa kudyidzana pakati peiyo kernel dhata zvimiro, Proc. Iyo syscall procfs yekupinda inogona kushandiswa kana vabiridzi vakaburitsa mirairo kuti vagadzire makumi maviri nemana mabheti eininitialized murwi ndangariro, zvichitungamira pakudarika kwekernel kero nzvimbo yekumisikidza randomization (KASLR).

Tichitarisa pane iri basa chairo, zvese zvinotaridzika zvakanaka, asi zvakakosha kuti uzive kuti iyo argspass paramende yakabva proc_pid_syscallbasa uye seizvo chaizvo zviri zvemhando __u64 args. Mune yeArm system, dudziro yebasa inoshandura saizi yeiyo argronga mune mana-byte zvinhu kubva masere mabheti (kubvira unsigned longmuARM iri mana mabheti), izvo zvinoguma izvo mune memcpyinoteedzerwa mumakumi maviri emabheti (uyezve mana e args[0]).

Saizvozvo, zve i386, kupi unsigned longi4 mabheti, chete argsekutanga makumi maviri nemaviri mabheti enharo akanyorwa, achisiya makumi maviri nemasere mabheti akasimba.

Muzviitiko zvese izvi, kana tikatarisa kumashure ku proc_pid_syscallbasa.

Ipo mu32-bit ARM uye i386 isu tinongoteedzera makumi maviri nemana mabheti mu argskurongeka, fomati tambo inopedzisira yaverenga makumi mana makumi mana ema argsmatrix, kubva iyo %llxFomati tambo ndeye masere mabheti pane 32-bit uye 64-bit masisitimu. Saka makumi maviri nemana ematanhatu eisina kuvhurwa murwi ndangariro inopedzisira yawana kuburitsa, izvo zvinogona kutungamira kune KASLR yekupfuura.

Vatsvakurudzi vanotaura izvozvo kurwisa uku "hazvigoneke kuona kure pane network" nekuti iri kuverenga iri pamutemo faira kubva kuLinux inoshanda sisitimu. "Kana ikashandiswa nemazvo, mubiridzi anogona kutora mukana wekuburitsa ruzivo urwu kuti abudirire kushandisa kumwe kunetsekana kweLinux kusati kwatumwa," anodaro Cisco.

Panyaya iyi, Google ichangoti:

“Kukanganisa kwekuchengetedza ndangariro kunowanzotyisidzira kuchengetedzwa kwemidziyo, kunyanya mashandisirwo nemaitiro ekushandisa. Semuenzaniso, mune yeApple mobile operating system zvakare inotsigirwa neLinux kernel, Google inoti yakawana kuti inopfuura hafu yekusagadzikana kwekuchengetedzwa kwakataurwa mu2019 yaive mhedzisiro yekuchengetedza memory bugs.

Kugumisira asi kusiri kupedzisira Inokurudzirwa kugadzirisa shanduro 5.10-rc4, 5.4.66, 5.9.8 yeLinux kernel, kubvira Uku kunetseka kwakaedzwa uye kwakasimbiswa kuti kuve nekugona kushandisa zvinotevera vhezheni yeLinux kernel.

Finalmente kana iwe uchifarira kuziva zvakawanda nezvazvo Nezve iyo posvo, iwe unogona kutarisa izvo zvinyorwa mu inotevera chinongedzo.