Ubuthathaka abathathu bachongwa kwinkqubo-yeendaba

Kuchongwe ubuthathaka obuthathu obuvumela umhlaseli ongenalungelo lokuphakamisa amalungelo abo kwinkqubo kwaye usebenze ikhowudi njengengcambu kwi-systemd-journald ejongene nokungena kwi-systemd.

Ukuba sesichengeni bonisa kulo lonke ulwabiwo olusebenzisa inkqubo, Ngaphandle kwe-SUSE Linux Enterprise 15, vulaSUSE Leap 15.0, kunye neFedora 28/29, apho iinkqubo zenkqubo yesistim zihlanganisene kunye nokubandakanywa kwe "-fstack-clash-protection".

Buyintoni ubungozi?

Ukuba sesichengeni sele ebhalisiwe I-CVE-2018-16864 y I-CVE-2018-16865 ikuvumela ukuba wenze iimeko zokubhala idatha ngaphandle kwemida yebhloko yenkumbulo eyabelweyo, ngelixa ubungozi I-CVE-2018-16866 ikuvumela ukuba ufunde umxholo weendawo zememori zangaphandle.

Abaphandi balungiselele uhlobo olusebenzayo lokuxhaphaza leyo, kusetyenziswa ubungozi be-CVE-2018-16865 kunye ne-CVE-2018-16866.

Yintoni eneenkcukacha malunga nobuthathaka abaphandi Bayasixelela ukuba oku kuyakuvumela ukuba ufumane amalungelo engcambu emva kwemizuzu eli-10 yokuhlaselwa kweenkqubo zokwakha i386 kunye nemizuzu engama-70 kwiinkqubo ze-amd64.

Oluxhaphazo luvavanywe kwi-Debian 9.5.

Bachaza nokuba:

Xa ukuxhaphaza kubhaliwe, Inkqubo yeStack Сlash isetyenzisiwe, eyona nto iphambili kuyo kukwenza iimeko xa imixholo yemfumba ephuphumayo ikwindawo yokubeka okanye, ngokuchaseneyo, isitaki sinokuphinda siyibhale kwakhona le mfumba.

Ezibonakalisa kwiimeko apho isitaki kunye nemfumba ibekwe ecaleni komnye nomnye (indawo yokugcina ngokukhawuleza ilandela imemori eyabelwe imfumba).

Ukuxhaphaza okucetywayo kuqinisekisa ukucinga ukuba ukukhuselwa kuhlaselo lweklasi lweStack Сlash kwinqanaba le-Linux kernel akwanelanga.

Kwangelo xesha, uhlaselo luthintelwe ngempumelelo xa kusakhiwa i-GCC ngenketho "-fstack-clash-clash-protection" enikwe amandla.

Malunga nokuba semngciphekweni

Ukuba sesichengeni I-CVE-2018-16864 yafunyanwa emva kokuhlalutya imeko apho kugqithiswa khona izicelo ezigcina idatha kwilog ngokusebenzisa umnxeba kwi-syslog (), Inani elikhulu lempikiswano yomgca wokuyalela (iimegabyte ezininzi) ikhokelela kwingozi yenkqubo-yejenali.

Uhlalutyo lubonise ukuba ngokukhohlisa umtya onempikiswano yomgca wokuyalela, umgca wokugcina isitaki ungabekwa ekuqaleni kwesitaki.

Kodwa kuhlaselo oluyimpumelelo, kuyadingeka ukuba kugqithwe kwindlela yokukhusela iphepha lokukhusela isitaki elisetyenziswe kwikheneli., obuntu bayo ikukufaka endaweni yememori yamaphepha ememori. ukuphakamisa ngaphandle (isiphoso sephepha).

Ukugqithisa olu khuselo kwi-systemd-journalism eqala "kwimeko yomdyarho", Ukuvumela ixesha lokufaka inkqubo yolawulo yokuwa ngenxa yokungena kwememori kwiphepha, funda-kuphela.

Kwinkqubo yokufunda ukuba sesichengeni kokuqala, kwavela ezinye iingxaki ezimbini.

Ubungozi besibini I-CVE-2018-16865 ikuvumela ukuba wenze imeko yeStack Сlash ngokufanayo ngokubhala umyalezo omkhulu kakhulu kwifayile run / systemd / journal / socket.

Ubungozi besithathu I-CVE-2018-16866 ibonakalisa ukuba uthumela umyalezo we-syslog kunye nomlingisi wokugqibela ":".

Ngenxa yempazamo ekucazululeni umtya, umtya wokupheliswa '\ 0' emva kokuba ulahliwe kwaye irekhodi liza kuba nenxalenye yesikhuseli ngaphandle kwe '\ 0', ekuvumela ukuba ufumane iidilesi zesitaki kunye nemephu.

• Ubungozi be-CVE-2018-16864 buye babonakala ukusukela ngo-Epreli 2013 (yavela kwinkqubo 203), kodwa ilungele ukusebenza kuphela emva kotshintsho kwinkqubo ye-230 ngoFebruwari 2016.
• Ubungozi be-CVE-2018-16865 buye babonakala ukusukela ngoDisemba 2011 (systemd 38) kwaye iyafumaneka ukuba isebenze ukusukela ngo-Epreli 2013 (inkqubod 201).
• Imiba ye-CVE-2018-16864 kunye ne-CVE-2018-16865 yalungiswa kwiiyure ezimbalwa ezidlulileyo kwisebe eliyintloko le-systemd.

Ubungozi be-CVE-2018-16866 babonakala ngoJuni 2015 (systemd 221) kwaye yagqitywa ngo-Agasti 2018 (engabonisi kwinkqubo ye-240).

Ukukhutshwa kokuxhaphaza okusebenzayo kuye kwahlehliswa kude kube kukhutshwe ii-patches ngokusasazwa.

Okwangoku, ulwabiwo lobuthathaka alukabikho patches zezona zidumileyo njengeDebian, Ubuntu, RHEL, Fedora, SUSE, kunye neziphumo zazo.