TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Notes on OpenSSL remote memory corruption by Guido Vranken

85 点作者 pentestercrab将近 3 年前

3 条评论

kevingadd将近 3 年前
The kicker:<p>&quot;the reduction function is called with num set to the bit size, where it should be number of BN_ULONG elements (which are always 8 bytes large, because that is the size of an unsigned long on x64 systems, which is the only architecture which can have AVX512 support). So with the input sizes being 1024 bits, 8192 bytes are accessed (read from or written to) instead of 128.&quot;<p>Really unfortunate that a performance optimization like this introduced RCE. Feels like something you would hope would be caught via the use of something like asan&#x2F;msan or valgrind, at least it was caught relatively quickly after release via fuzzing.<p>A good bit of news is that since this requires AVX512 many CPUs won&#x27;t hit it, including new Intel chips: <a href="https:&#x2F;&#x2F;www.pcgamer.com&#x2F;intel-kills-alder-lake-avx-512-support-for-good&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.pcgamer.com&#x2F;intel-kills-alder-lake-avx-512-suppo...</a>
评论 #31892252 未加载
评论 #31892658 未加载
评论 #31892431 未加载
rurcliped将近 3 年前
The post says &quot;the vulnerability has only existed for a week.&quot; Many Linux systems don&#x27;t yet have a 3.0.4 package available, but apparently Homebrew is already installing the affected version:<p><a href="https:&#x2F;&#x2F;formulae.brew.sh&#x2F;formula&#x2F;openssl@3" rel="nofollow">https:&#x2F;&#x2F;formulae.brew.sh&#x2F;formula&#x2F;openssl@3</a> <a href="https:&#x2F;&#x2F;docs.brew.sh&#x2F;FAQ#why-does-brew-upgrade-formula-or-brew-install-formula-also-upgrade-a-bunch-of-other-stuff" rel="nofollow">https:&#x2F;&#x2F;docs.brew.sh&#x2F;FAQ#why-does-brew-upgrade-formula-or-br...</a>
评论 #31897838 未加载
jamal-kumar将近 3 年前
I&#x27;ve been replacing my OpenSSL installations with LibreSSL [1] where possible. I manage a lot of machines and it&#x27;s just way nicer to not have to do patching whenever these things come up, with the peace of mind that there&#x27;s not some little-used internal script or feature which ends in privilege escalation or whatever when it&#x27;s supposed to be a SECURITY product first and foremost. Besides this bug I subscribe to Debian&#x27;s security announcements list and CVE-2022-2068 was something that came up yesterday for patching [2]<p>I&#x27;ve heard some people moan that &quot;it&#x27;s not exactly a drop-in replacement&quot; but I&#x27;ve yet to find in my own work a case where this is true.<p>The only off-putting thing to me is the fact that these OpenBSD projects love giving puffy lips for some reason.<p>[1] <a href="https:&#x2F;&#x2F;www.libressl.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.libressl.org&#x2F;</a><p>[2] <a href="https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;CVE-2022-2068" rel="nofollow">https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;CVE-2022-2068</a>