Gulu la Microsoft Edge Vulnerability Research linalengeza masiku angapo apitawa kuti kuyesa ndi ntchito yatsopano mu msakatuli. Kuyesera Zimaphatikizapo kulepheretsa mwadala wopanga JIT JavaScript ndi WebAssembly, potero mumapeza kukhathamiritsa kwakukulu ndikusintha magwiridwe antchito kuti atsegule zosintha zachitetezo chamtsogolo pazomwe kampaniyo imati Edge Super Duper Safe Mode.
Kampaniyo inafotokoza izi lingaliroli ndikuchepetsa kuwonongeka kwa zochitikazo machitidwe amakono omwe amatengera zolakwika za JavaScript ndikuwonjezera kwambiri mtengo wogwirira ntchito kwa omwe akuukira.
Microsoft imanena kuti Chromium, yomwe imachokera ku injini ya JavaScript V8, injini yotseguka, imabwera ndi JIT compiler yomwe imagwira ntchito yofunikira pamasakatuli onse aposachedwa ndipo imagwira ntchito potenga JavaScript ndikuipanga kukhala makina a makina pasadakhale. yomwe ngati msakatuli akufuna khodi iyi, idzafulumizitsidwa, ngati singafune, nambala yake imachotsedwa.
Izi zati, ogulitsa asakatuli amavomereza kuti thandizo la JIT compiler mu V8 ndilovuta chifukwa ndi anthu ochepa omwe amamvetsetsa ndipo lili ndi malire olakwika.
Kutengera ndi chidziwitso cha CVE chomwe chidasonkhanitsidwa kuyambira 2019, pafupifupi zovuta za 45% zomwe zimapezeka mu injini ya JavaScript ndi WebAssembly V8 zinali zokhudzana ndi wopanga JIT, kapena zopitilira theka la zovuta zonse mu Chrome.
“Mawebusayiti safuna JavaScript, chomwe chimafunikira ndimasamba amodzi omwe ali ndi ma anti-templates ngati kupukusa kopanda malire. Mumabwezera zinthu ziwiri, duper yachangu kwambiri komanso msakatuli wotetezeka kwambiri. Mwachitsanzo, Amazon imathandizira kugwiritsa ntchito popanda JavaScript. Kuyesanso kwina ndi Stackoverflow, zinthu monga kuwonetseratu ndikuwonetsa sizigwira ntchito. Zowunikirazi zitha kuwonjezeredwa ndi nambala yam'mbali yamasamba, koma zidzawononga nthawi ya CPU, ndipo si nthawi yanu ya CPU. Kodi ndi nthawi yanu ya CPU? »Tinawerenga mu ndemanga.
Ichi ndichifukwa chake amalimbikitsidwa ndi izi, gulu la Edge likugwira ntchito pano zomwe timu yeniyeni imayitanitsa "Super Duper Njira Yabwino", kasinthidwe ka Edge komwe mumalepheretsa wopanga JIT ndikuthandizira zina zitatu zachitetezo, kuphatikiza ukadaulo wa Intel's CET (ControlFlow-Enforcing Technology) ndi Windows ACG (Arbitrary Code Guard) - zinthu ziwiri zomwe nthawi zambiri zimatha kutsutsana ndikukhazikitsa kwa JIT V8 .
"Polepheretsa wopanga makina a JIT, titha kuloleza kuchepetsa mavuto ndikupangitsa kuti zikhale zovuta kugwiritsa ntchito nsikidzi zachitetezo munthawi iliyonse yoperekera," adalemba. Kuchepetsa kwa ziwopsezo kumeneku kumapha theka la nsikidzi zomwe timaziwona muzochita zawo, ndipo kachilombo kalikonse kamatsalira kumakhala kovuta kugwiritsa ntchito. Kunena kwina, tikuchepetsa ndalama kwa ogwiritsa ntchito, koma tikuchulukitsa mtengo kwa omwe akuukira. "
Komabe, Kuyesa kwa Microsoft adapeza mitundu ya Edge Popanda wopanga JIT anali ndi kuchepetsedwa kwa 16,9% munthawi yonyamula cha tsambali ndi kuchepetsedwa kwa 2,3% pakugwiritsa ntchito kukumbukira. Koma kuyesaku kunali kungoyeserera ndipo Super Duper Safe Mode (SDSM) sikhala gawo la Microsoft Edge nthawi iliyonse posachedwa.
Komabe, ogwiritsa ntchito Microsoft Edge asanatulutsidwe (kuphatikiza Beta, Dev, ndi Canary) atha kuloleza SDSM m'mphepete: // mbendera / # m'mphepete-thandizani-wapamwamba-duper-safe-mode ndikuthandizira mawonekedwe atsopanowo.
Nkhaniyi ikubwera Microsoft Edge itangowulula zosankha zingapo zatsopano. Zosankha zokhazokha za ogwiritsa ntchito, kuphatikiza kuthekera kosintha zolowera monga chilolezo chosewerera media mu msakatuli, komanso kutha "kuzimitsa" zidziwitso zamtundu wachinsinsi patsamba lina. Zachidziwikire, mdera lino, tikuyamikira kuyesetsa kwa Microsoft kuchepetsa kuwonongeka kwa ogwiritsa ntchito omwe priori sanapemphe JavaScript yonse yomwe imatumizidwa pamasamba lero.
Mapeto ngati mukufuna kudziwa zambiri za, Mutha kuwona tsatanetsatane ulalo wotsatirawu.
Khalani oyamba kuyankha