Ukuxhashazwa kwezinkomba ezingenalutho ku-Linux kernel
Muva nje kumenyezelwe ukuthi abacwaningi bethimba le-Google Project Zero basungule indlela yokusebenzisa ubuthakathaka ku-kernel ye-Linux obubangelwa ukuhoxiswa kwesikhombisi se-NULL.
Kuze kube manje, izinkinga ze-kernel ezihlobene nokususwa kwe-NULL pointer azikakatholi ukunakwa okufanele , njengoba kwakubhekwa njengokungenangqondo ukuguqula izinkinga ezinjalo zibe ukuhlaselwa okuholela ekukhuleni kwamalungelo noma ukuqaliswa kwekhodi yomuntu siqu (ukumaka izinqubo ezingenamalungelo esifundeni esingezansi sesikhala sekheli akuvunyelwe).
Njengomthetho ojwayelekile, amaphutha anjalo aholela ekudalweni kwezixwayiso ze-oops yi-kernel, ngemva kwalokho imisebenzi eyinkinga iyaqedwa futhi isimo siyabuyiselwa ngaphandle kwesidingo sokumisa uhlelo.
Indlela entsha yokuhlasela isekelwe ekuphathweni kwezimo ze-"oops" , okungabangela ukwanda kwenani le-reference counter (refcount), okungabangela ukuthi i-counter igcwale futhi ikhulule imemori ehlotshaniswa ne-refcount.
Kulesi simo, ukuxhashazwa kwehliselwa ekusetshenzisweni okujwayelekile kokuhlasela kwangemuva kokusetshenziswa (isimo siphakama lapho isibalo sereferensi sento siba nguziro, inkumbulo iyakhululwa, kodwa empeleni kunezixhumanisi ezisebenzayo ezikhomba kwinkumbulo ekhululiwe).
Njengamanje, lapho i-kernel ye-Linux ibangela i-null dereference ngaphakathi komongo wenqubo, ikhiqiza i- oops , ehlukile ku-kernel panic. Uvalo luvela lapho i-kernel inquma ukuthi ayikho indlela ephephile yokuqhubeka nokwenza ngakho-ke kufanele iyeke konke ukwenza. Kodwa-ke, i-kernel ayimisi konke ukwenza ngesikhathi se-oops; kunalokho, i-kernel izama ukubuyisa ngangokunokwenzeka futhi iqhubeke nokwenza.
Ukususa ireferensi kwesikhombi esingu-NULL kusetshenziswa lapha njengendlela yokukhiqiza isimo "eshu" ngendlela elawulwayo. Inkinga ukuthi kuthatha amakholi wesimo "eshu" angaba ngu-232 ukufinyelela ukuchichima kwe-32-bit refcount.
Ngokombono ongokoqobo, kuthatha cishe izinsuku eziyisishiyagalombili zokukhiqizwa okuqhubekayo kwezifundazwe ezingaphandle kwendawo (i-OOP) ukwenza ukuhlasela kusetshenziswa i-exploit ehlongozwayo. Uma iphumelela, i-exploit ikuvumela ukuthi usebenzise ikhodi yakho ezingeni le-kernel.
I-NULL pointer dereference esetshenziswe ekuxhashazweni yalungiswa ngo-Okthoba, kodwa njengoba izinkinga ezifanayo zingavamile futhi ngaphambili zaziphathwa njengezimbungulu, hhayi ubungozi, abathuthukisi bazokwengeza ukuvikeleka okujwayelekile ku-Linux kernel ukuvimbela ukuhlaselwa okusebenzisa isizukulwane "eshu. ."
Endabeni yomsebenzi, lokho kusho ukulahla isitaki se-kernel esikhona futhi uye ngqo ku-make_task_dead ebiza okuthi do_exit. I-kernel izophinda ithumele ku-dmesg "i-crash" log kanye nokulandela i-kernel ebonisa ukuthi i-kernel yayikusiphi isimo ngenkathi kwenzeka iphutha. Lokhu kungase kubonakale kuwukukhetha okuyinqaba lapho ukonakala kwenkumbulo kwenzeke ngokucacile; kodwa-ke, inhloso iwukwenza izimbungulu ze-kernel zibonakale kalula futhi zingene ngaphansi kwefilosofi yokuthi uhlelo olusebenzayo kulula kakhulu ukulilungisa kuneliphansi.
Ikakhulukazi , i-Kernel 6.2 ifaka izinguquko zokunciphisa inani eliphezulu le-"oops" . Ngemva kokufinyelela umkhawulo, obekwe ku-10 oops ngokuzenzakalelayo (ungashintsha lokhu usebenzisa ipharamitha ye-oops_limit uma uthanda), i-kernel izoqala ukushintshela esimweni "sokwesaba", kulandelwe ukuqala kabusha, okungeke kuvumele inani lezikhathi ezidingekayo ukusetha kabusha ukubalwa kabusha kube yi-zero.
Kuphinde kuhlelwe ukuthi ukuvinjelwa kuzodluliselwa kumagatsha e-kernel akhululwe ngaphambilini, kodwa asasekelwa, kanye namaphakheji e-kernel okusabalalisa okudumile.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe ngalokhu , ungathola imininingwane kusixhumanisi esilandelayo.