WO2017166446A1 - 漏洞修复方法和装置 - Google Patents

漏洞修复方法和装置 Download PDF

Info

Publication number
WO2017166446A1
WO2017166446A1 PCT/CN2016/086410 CN2016086410W WO2017166446A1 WO 2017166446 A1 WO2017166446 A1 WO 2017166446A1 CN 2016086410 W CN2016086410 W CN 2016086410W WO 2017166446 A1 WO2017166446 A1 WO 2017166446A1
Authority
WO
WIPO (PCT)
Prior art keywords
kernel
vulnerability
code
repaired
information
Prior art date
Application number
PCT/CN2016/086410
Other languages
English (en)
French (fr)
Inventor
夏良钊
郑龙日
卢永强
包沉浮
张煜龙
韦韬
Original Assignee
百度在线网络技术（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 百度在线网络技术（北京）有限公司 filed Critical 百度在线网络技术（北京）有限公司
Publication of WO2017166446A1 publication Critical patent/WO2017166446A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security

Definitions

  • the present application relates to the field of computer technology, and in particular to the field of information security technologies, and in particular, to a vulnerability repair method and apparatus.
  • the operating system kernel is often found to have various security vulnerabilities. Due to the complexity of the security vulnerability itself, it will consume a lot of human resources to deal with it. Some vendors will delay updating or even abandon the maintenance of the old version, posing a great security risk to users. Taking the Linux kernel as an example, the kernel versions used in various Android devices are fragmented, and the differences between different cores are large, so there is a lack of good code versatility. The Linux kernel itself and the manufacturer also set some security mechanisms for code loading. limit.
  • the repair method in the prior art relies on the source code of the running system or requires the original kernel to provide corresponding functions to cooperate, and the generated patch can only be used to patch a specific kernel compiled version, which is extremely limited. Its application scenarios and compatibility.
  • the purpose of the present application is to propose an improved vulnerability repair method and apparatus to solve the technical problems mentioned in the background section above.
  • the present application provides a vulnerability repairing method, the method comprising: collecting attribute information of a kernel to be repaired, the attribute information including feature information for characterizing a code loading manner supported by the core to be repaired; Vulnerabilities that match the feature information Fixing the code; configuring the vulnerability repair code to adapt the vulnerability repair code to the kernel to be repaired based on the attribute information; and performing a vulnerability repair on the kernel to be repaired using the configured vulnerability repair code.
  • the obtaining the vulnerability repairing code that matches the feature information comprises: acquiring a vulnerability repairing code stored in the server that matches the feature information, wherein the vulnerability repair code stored by the server is real-time updated.
  • the feature information includes: information for describing whether a preset system call exists in the core to be repaired, and information for describing whether a preset physical memory device exists in the core to be repaired. And obtaining the vulnerability repair code matching the feature information, comprising: when the feature information indicates that a preset system call exists, the vulnerability repair code matched includes a kernel module type vulnerability repair code, when the feature The information indicates that the vulnerability repair code matched by the preset physical memory device includes the bug fix code of the instruction sequence type.
  • the attribute information further includes a kernel symbol check parameter; and when the acquired vulnerability repair code is a kernel module, the vulnerability repair code is configured based on the attribute information to enable the The bug fix code is adapted to the kernel to be repaired, and includes: configuring, by using the kernel symbol check parameter, a kernel symbol check parameter field in an executable file corresponding to the kernel module.
  • the attribute information further includes address information of a kernel symbol in the kernel to be repaired; and the vulnerability repair code is configured to cause the vulnerability repair code and the to-be-based based on the attribute information Repairing the kernel adaptation includes configuring the address of the kernel symbol in the sequence of instructions using the address information.
  • the method further comprises: performing a legality check on the obtained vulnerability repair code to confirm that the vulnerability repair code is not tamper.
  • the method further comprises: generating information indicating success or failure of the vulnerability repair.
  • the collecting the attribute information of the core to be repaired includes: collecting attribute information of the core to be repaired in response to a startup operation of the kernel to be repaired.
  • the method further includes: if the vulnerability repair fails, the method is to be repaired The complex kernel is restored to the state between repairs.
  • the present application provides a vulnerability repairing apparatus, where the apparatus includes: a collecting unit, configured to collect attribute information of a kernel to be repaired, where the attribute information includes a code loading manner for characterizing the kernel to be repaired. Feature information; an obtaining unit, configured to obtain a vulnerability repairing code matching the feature information; a configuration unit, configured to configure the vulnerability repairing code to enable the vulnerability repairing code to be based on the attribute information A kernel adaptation to be repaired; a repair unit for performing a vulnerability repair on the kernel to be repaired using the configured vulnerability repair code.
  • the obtaining unit is further configured to acquire vulnerability repair code stored in the server that matches the feature information, wherein the vulnerability repair code stored by the server is updated in real time.
  • the feature information includes: information for describing whether a preset system call exists in the core to be repaired, and information for describing whether a preset physical memory device exists in the core to be repaired.
  • the obtaining unit is further configured to: when the feature information indicates that the preset system call exists, the vulnerability repairing code includes a kernel module type vulnerability repairing code, where the feature information indicates a preset physical memory device;
  • the vulnerability fix code that exists when it exists includes the bug fix code of the instruction sequence type.
  • the attribute information further includes a kernel symbol check parameter; and the configuration unit is further configured to configure the kernel using the kernel symbol check parameter when the obtained vulnerability repair code is a kernel module The kernel symbol check parameter field in the executable file corresponding to the module.
  • the attribute information further includes address information of a kernel symbol in the kernel to be repaired; and the configuration unit is further configured to: configure an address of the kernel symbol in the vulnerability repair code using the address information.
  • the apparatus further includes: a verification unit, configured to perform a validity check on the obtained vulnerability repair code to confirm that the vulnerability repair code has not been tampered with.
  • the apparatus further includes a generating unit that generates information indicating success or failure of the vulnerability repair.
  • the collecting unit is further configured to: respond to the kernel to be repaired
  • the startup operation collects attribute information of the kernel to be repaired.
  • the apparatus further includes: a recovery unit, configured to restore the kernel to be repaired to a state between repairs if the vulnerability repair fails.
  • the vulnerability repairing method and device provided by the application obtains the vulnerability repairing code matching the loading mode supported by the kernel and configures the vulnerability repairing code accordingly, so that the configured vulnerability repairing code can be loaded in the kernel to implement the pairing. Kernel bug fixes.
  • This vulnerability repair method can be compatible with multiple kernel repair code loading methods. It does not depend on the kernel source code and its kernel functions.
  • the generated patches can be adapted to different kernel compiled versions to overcome the impact of Linux system fragmentation.
  • FIG. 1 is an exemplary system architecture diagram to which the present application can be applied;
  • FIG. 2 is a flow chart of one embodiment of a vulnerability repair method in accordance with the present application.
  • FIG. 3 is a flow chart of still another embodiment of a vulnerability repair method according to the present application.
  • FIG. 4 is a schematic structural view of an embodiment of a vulnerability repairing apparatus according to the present application.
  • FIG. 5 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server of an embodiment of the present application.
  • FIG. 1 illustrates an exemplary system architecture 100 in which an embodiment of a vulnerability repair method or vulnerability repair apparatus of the present application may be applied.
  • system architecture 100 can include terminal devices 101, 102, 103, network 104, and server 105.
  • the network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105.
  • Network 104 may include various types of connections, such as wired, wireless communication links, fiber optic cables, and the like.
  • the user can interact with the server 105 over the network 104 using the terminal devices 101, 102, 103 to receive or transmit messages and the like.
  • a communication client application such as security software can be installed on the terminal devices 101, 102, and 103.
  • the terminal devices 101, 102, 103 may be various electronic devices, including but not limited to smart phones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, motion picture expert compression standard audio layer 3) MP4 (Moving Picture Experts Group Audio Layer IV) player, laptop portable computer and desktop computer, etc.
  • MP3 players Moving Picture Experts Group Audio Layer III, motion picture expert compression standard audio layer 3
  • MP4 Moving Picture Experts Group Audio Layer IV
  • Server 105 may be a server that provides various services, such as a cloud server that provides data support for terminal devices 101, 102, 103.
  • the cloud server may perform processing such as analyzing the received vulnerability repair code request and the like, and feed back the processing result (for example, a preset vulnerability repair code) to the terminal devices 101, 102, and 103.
  • the vulnerability repairing method provided by the embodiment of the present application is generally performed by the terminal device 101, 102, and 103, and some steps may also be performed by the server 105. Accordingly, the vulnerability repairing device is generally disposed on the terminal device 101, 102, In 103, some units of the vulnerability repairing device may also be disposed in the server 105.
  • terminal devices, networks, and servers in Figure 1 is merely illustrative. Depending on the implementation needs, there can be any number of terminal devices, networks, and servers.
  • the method for repairing the vulnerability includes the following steps:
  • Step 201 Collect attribute information of the kernel to be repaired.
  • the electronic device (for example, the terminal device shown in FIG. 1) on which the vulnerability repair method runs may first analyze the kernel to be repaired in the electronic device, thereby collecting attribute information of the kernel.
  • the kernel to be repaired can be the kernel of various operating systems, and the corresponding operating system can be Windows, Linux, and the like.
  • the attribute information may be various information for describing kernel related attributes, such as kernel version information, kernel configuration. Information, etc.
  • the attribute information includes the feature information of the code loading mode supported by the kernel to be repaired. Different kernel compiled versions may support different code loading methods.
  • the code loading mode supported by the kernel to be repaired can be characterized by the above feature information.
  • the code description method can be various ways of the kernel to record the code, such as loading the kernel module mode, operating the memory mode, and other ways that the system may support the code loading.
  • the foregoing attribute information includes at least one of the following: system version information, information used to indicate whether a system call exists, information indicating whether a physical memory device exists, and kernel configuration information; Kernel symbol address; checksum information.
  • Step 202 Obtain a vulnerability repair code that matches the feature information.
  • the electronic device may acquire a vulnerability repair code that matches the feature information in one or more vulnerability repair codes that are preset.
  • one or more of the vulnerability fixes that are pre-configured can be various bug fixes that are fixed for repairing the kernel being repaired.
  • These pre-configured one or more vulnerability repair codes may be stored locally on the electronic device, may also be stored on the server, and may be in various forms.
  • the obtained vulnerability repairing code may be in the form of a kernel module, or may be in the form of a sequence of instructions, or may be a combination of pre-agreed instructions that can be interpreted and executed by an electronic device.
  • the kernel module form is a set of object code that can be loaded into the kernel when the kernel is running.
  • the matching relationship between the vulnerability repair code and the feature information may be preset.
  • the vulnerability repairing code matching the above characteristic information may be obtained according to the above matching relationship.
  • the matched vulnerability repair code may be a corresponding combination of instructions.
  • the step 202 may include: acquiring a vulnerability repairing code stored in the server and matching the feature information, where the vulnerability repair code stored by the server is updated in real time.
  • the electronic device may acquire the vulnerability repairing code matching the feature information from the server by using a wired connection manner or a wireless connection manner.
  • the vulnerability fix code stored in this server can be updated in real time, therefore.
  • the electronic device may send a request for the vulnerability repair code to the server, and the server may distribute the corresponding vulnerability code according to the request.
  • the electronic device may also send the corresponding attribute information to the server through the request, so that the vulnerability repair code returned by the server matches the above characteristic information.
  • the above wireless connection methods may include, but are not limited to, 3G/4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods now known or developed in the future.
  • the electronic device can obtain the real-time updated vulnerability repair code, so that the repair of the kernel vulnerability is more real-time, further ensuring the security of the kernel.
  • the vulnerability repair code is configured to adapt the vulnerability repair code to the kernel to be repaired.
  • the electronic device may configure the vulnerability repairing code accordingly, so that the vulnerability repairing code can be adapted to the kernel to be repaired. , for example, to match the version number.
  • the above attribute information may include configuration information that the code loaded by the kernel to be repaired should conform to. Therefore, based on the attribute information, the electronic device can configure the vulnerability repair code accordingly.
  • the above configuration may include adding some set symbol addresses in the vulnerability repair code, modifying some information of the vulnerability repair code, determining the address that the vulnerability repair code will be loaded in the memory, and the like.
  • Step 204 using the configured vulnerability repair code to fix the kernel to be repaired.
  • the electronic device may perform a vulnerability repair on the repaired kernel by using the configured vulnerability repair code.
  • the specific fix can be performed in the same way as the bug fix code type.
  • the vulnerability repair code is in the form of a kernel module
  • the corresponding kernel module can be loaded in the kernel to be repaired by using the set system call
  • the vulnerability repair code is in the form of an instruction sequence, it can be loaded by operating the memory
  • the repair code is a pre-agreed combination of instructions, the electronic device can directly interpret and execute.
  • the feature information in step 201 may include: information for describing whether a preset system call exists in the kernel to be repaired, and describing whether a preset exists in the kernel to be repaired.
  • the repair code includes a kernel module type vulnerability repair code, and the vulnerability repair code matched when the feature information indicates that the preset physical memory device exists includes the vulnerability repair code of the instruction sequence type.
  • the Linux operating system Take the Linux operating system as an example.
  • the feature information indicates that a preset system call exists, it means that the kernel module can support the loading of the kernel module, and when the vulnerability repair code is obtained, the kernel module type vulnerability repair code can be obtained.
  • the above preset system calls can be module loading and unloading functions, such as init_module, finite_module, delete_module, or other various system calls for loading or unloading kernel modules.
  • some kernel compiled versions have a preset physical memory device, and the preset physical memory device can be used to operate the memory to load and remove code.
  • the feature information indicates that a preset physical memory device exists, it means that the kernel supports using the physical memory device to operate the memory to load the code, and the obtained vulnerability repairing code may be a sequence of instructions that can be directly loaded and executed in the memory.
  • the above preset physical memory device can be /dev/kmem.
  • the kernel module type matches the vulnerability repair code of the instruction sequence type, and the electronic device can select any one.
  • the foregoing attribute information further includes a kernel symbol check parameter; and when the obtained vulnerability repair code is a kernel module, the step 203 further includes: configuring the kernel module by using a kernel symbol check parameter.
  • the kernel symbol check parameter field in the corresponding executable file.
  • the electronic device may configure the value of the kernel symbol check parameter field in the executable file corresponding to the kernel module as a kernel symbol check parameter, so that the kernel module is in the After the subsequent loading, the kernel is verified, so that it can be loaded smoothly.
  • the above verification parameter may be a vermagic string, a module structure, a symbol CRC or other various verification parameters for verification.
  • the foregoing attribute information further includes to be repaired.
  • the address information of the kernel symbol in the kernel, the above step 203 further includes: configuring the address of the kernel symbol in the vulnerability repair code by using the above address information.
  • the electronic device can use the above address information to configure the address of the kernel symbol in the vulnerability repair code, so that the configured vulnerability repair code can be adapted to the kernel to be repaired.
  • the method provided in the above embodiment of the present application obtains the vulnerability repair code that matches the loading mode supported by the kernel and configures the vulnerability repair code accordingly, so that the configured vulnerability repair code can be loaded in the kernel to implement the kernel.
  • This vulnerability repair method can be compatible with multiple kernel repair code loading methods. It does not depend on the kernel source code and its kernel functions.
  • the generated patches can be adapted to different kernel compiled versions to overcome the impact of Linux system fragmentation.
  • the process 300 of the vulnerability repair method includes the following steps:
  • step 301 the attribute information of the kernel to be repaired is collected.
  • step 301 the specific processing in step 301 can refer to step 201 in the corresponding embodiment of FIG. 2, and details are not described herein again.
  • the electronic device may collect attribute information of the core to be repaired in response to a startup operation of the kernel to be repaired when the kernel to be repaired is started.
  • the system configuration can be modified to enable the vulnerability repair method to run early when the system is restarted, and the system can be protected in time without user intervention.
  • Step 302 Obtain a vulnerability repair code that matches the feature information.
  • step 302 may refer to step 202 in the corresponding embodiment of FIG. 2, and details are not described herein again.
  • Step 303 Perform a validity check on the obtained vulnerability repairing code to confirm that the vulnerability repairing code has not been tampered with.
  • the electronic device can perform legality verification on the obtained vulnerability repairing code through various information to confirm that the vulnerability repairing code has not been tampered with.
  • the electronic device may preset a legal verification parameter, which may be formed by an algorithm for determining a legal vulnerability repair code, such as a CRC value and an RSA value formed by an algorithm such as CRC, RSA, or the like.
  • Electronic devices can use phase when verifying legality
  • the same verification algorithm calculates the obtained vulnerability repair code and determines whether the generated check value is consistent with the above verification parameter.
  • the specific verification algorithm is not limited to the CRC algorithm and the RSA algorithm.
  • the vulnerability repair code is configured to adapt the vulnerability repair code to the kernel to be repaired.
  • step 304 may refer to step 203 in the corresponding embodiment of FIG. 2, and details are not described herein again.
  • Step 305 using the configured vulnerability repair code to fix the kernel to be repaired.
  • step 305 can refer to step 204 in the corresponding embodiment of FIG. 2, and details are not described herein again.
  • the electronic device also generates information indicating success or failure of the vulnerability repair. This information can be used by the user to query whether the vulnerability repair is successful.
  • the electronic device may restore the kernel to be repaired to a state between repairs. In this way, the electronic device can automatically recover to the initial state before the repair after the repair fails, so as to avoid adverse effects on the system.
  • the process 300 of the vulnerability repairing method in this embodiment performs legality verification on the obtained vulnerability repairing code, and can ensure that it has not been tampered with. Further improve the security of bug fixes.
  • the present application provides an embodiment of a vulnerability repairing apparatus, and the apparatus embodiment corresponds to the method embodiment shown in FIG. Used in a variety of electronic devices.
  • the vulnerability repairing apparatus 400 described in this embodiment includes a collecting unit 401, an obtaining unit 402, a configuration unit 403, and a repairing unit 404.
  • the collecting unit 401 is configured to collect attribute information of the kernel to be repaired, and the attribute information includes feature information for characterizing the loading mode of the code supported by the kernel to be repaired;
  • the obtaining unit 402 is configured to acquire the vulnerability repairing code that matches the feature information;
  • 403 is used for attribute-based information on vulnerabilities
  • the repair code is configured to adapt the bug fix code to the kernel to be repaired; and the repair unit 404 is configured to use the configured vulnerability fix code to fix the fix kernel.
  • the specific processing of the collection unit 401, the acquisition unit 402, the configuration unit 403, and the repair unit 404 of the vulnerability repair apparatus 400 may refer to step 201, step 202, step 203, and step 204 in the corresponding embodiment of FIG. 2 .
  • the obtaining unit 402 is further configured to obtain vulnerability repair code stored in the server and matched with the feature information, where the vulnerability repair code stored by the server is updated in real time.
  • the obtaining unit 402 is further configured to obtain vulnerability repair code stored in the server and matched with the feature information, where the vulnerability repair code stored by the server is updated in real time.
  • the foregoing feature information includes: information used to describe whether a preset system call exists in the kernel to be repaired, and a description of whether a preset physical memory device exists in the kernel to be repaired.
  • the obtaining unit 402 is further configured to: when the feature information indicates that the preset system call exists, the vulnerability repairing code includes a kernel module type vulnerability repairing code, and the matching information is matched when the feature information indicates that the preset physical memory device exists.
  • the bug fix code includes bug fix code for the instruction sequence type. For specific processing, reference may be made to the corresponding implementation manner in the corresponding embodiment of FIG. 2.
  • the foregoing attribute information further includes a kernel symbol check parameter; and the configuration unit 403 is further configured to configure the kernel by using a kernel symbol check parameter when the obtained vulnerability repair code is a kernel module.
  • the kernel symbol check parameter field in the executable file corresponding to the module For specific processing, reference may be made to the corresponding implementation manner in the corresponding embodiment of FIG. 2.
  • the attribute information further includes address information of a kernel symbol in the kernel to be repaired; and the configuration unit 403 is further configured to use an address information to configure an address of a kernel symbol in the vulnerability repair code.
  • the configuration unit 403 is further configured to use an address information to configure an address of a kernel symbol in the vulnerability repair code.
  • the vulnerability repair apparatus 400 further includes: a verification unit (not shown) for performing a validity check on the obtained vulnerability repair code to confirm that the vulnerability repair code is not Was tampered with.
  • a verification unit (not shown) for performing a validity check on the obtained vulnerability repair code to confirm that the vulnerability repair code is not Was tampered with.
  • the vulnerability repairing device 400 further includes a Units (not shown) generate information that indicates the success or failure of the vulnerability fix.
  • a Units (not shown) generate information that indicates the success or failure of the vulnerability fix.
  • the collecting unit 401 is further configured to: collect attribute information of the kernel to be repaired in response to a startup operation of the kernel to be repaired. For specific processing, reference may be made to the implementation manner corresponding to FIG. 3.
  • the vulnerability repair apparatus 400 further includes: a recovery unit (not shown) for restoring the kernel to be repaired to a state between repairs if the vulnerability repair fails.
  • a recovery unit (not shown) for restoring the kernel to be repaired to a state between repairs if the vulnerability repair fails.
  • FIG. 5 there is shown a block diagram of a computer system 500 suitable for use in implementing a terminal device or server of an embodiment of the present application.
  • computer system 500 includes a central processing unit (CPU) 501 that can be loaded into a program in random access memory (RAM) 503 according to a program stored in read only memory (ROM) 502 or from storage portion 508. And perform various appropriate actions and processes.
  • RAM random access memory
  • ROM read only memory
  • RAM 503 various programs and data required for the operation of the system 500 are also stored.
  • the CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504.
  • An input/output (I/O) interface 505 is also coupled to bus 504.
  • the following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a storage portion 508 including a hard disk or the like. And a communication portion 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the Internet.
  • Driver 510 is also coupled to I/O interface 505 as needed.
  • a removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 510 as needed so that a computer program read therefrom is installed into the storage portion 508 as needed.
  • an embodiment of the present disclosure includes a computer program product comprising a computer program tangibly embodied on a machine readable medium, the computer program comprising program code for executing the method illustrated in the flowchart.
  • the computer program can be downloaded and installed from the network via the communication portion 509. And/or installed from the removable medium 511.
  • each block of the flowchart or block diagrams can represent a module, a program segment, or a portion of code that includes one or more logic for implementing the specified.
  • Functional executable instructions can also occur in a different order than that illustrated in the drawings. For example, two successively represented blocks may in fact be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved.
  • each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts can be implemented in a dedicated hardware-based system that performs the specified function or operation. Or it can be implemented by a combination of dedicated hardware and computer instructions.
  • the units involved in the embodiments of the present application may be implemented by software or by hardware.
  • the described unit may also be provided in the processor, for example, as a processor including a collection unit, an acquisition unit, a configuration unit, and a repair unit.
  • the names of these units do not constitute a limitation on the unit itself under certain circumstances.
  • the collection unit may also be described as "a unit of attribute information of a kernel to be repaired".
  • the present application further provides a non-volatile computer storage medium, which may be a non-volatile computer storage medium included in the apparatus described in the foregoing embodiments; It may be a non-volatile computer storage medium that exists alone and is not assembled into the terminal.
  • the non-volatile computer storage medium stores one or more programs, when the one or more programs are executed by a device, causing the device to: collect attribute information of a core to be repaired, the attribute information includes Characterizing the feature information of the code loading mode supported by the kernel to be repaired; acquiring a vulnerability repair code matching the feature information; and configuring the vulnerability repair code to make the vulnerability repair code and the location based on the attribute information Resolve the fix kernel fix; fix the bug in the kernel to be repaired by loading the configured bug fix code.

Abstract

漏洞修复方法和装置，所述方法包括：收集待修复内核的属性信息（201），所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；获取与所述特征信息匹配的漏洞修复代码（202）；基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配（203）；使用已配置的漏洞修复代码对所述待修复内核进行漏洞修复（204）。该方法兼容于多个内核修复代码加载方法。

Description

漏洞修复方法和装置
相关申请的交叉引用
本申请要求于2016年3月30日提交的中国专利申请号为“201610193039.9”的优先权，其全部内容作为整体并入本申请中。
技术领域
本申请涉及计算机技术领域，具体涉及信息安全技术领域，尤其涉及漏洞修复方法和装置。
背景技术
操作系统内核经常被发现各种安全漏洞，由于安全漏洞本身原理的复杂性，会消耗大量人力资源来应对。有些厂商会延迟更新甚至放弃了旧版本的维护，给用户带来了极大的安全风险。以Linux内核为例，各种安卓设备中使用的内核版本呈现碎片化特征，不同内核之间差异较大，所以缺乏良好的代码通用性，Linux内核本身和厂商还设置一些安全机制对代码加载进行限制。
由于上述原因，现有技术中的修复方法依赖于运行系统的源代码或者需要原始内核提供相应的机能进行配合才能使用，生成的补丁也只能用于修补特定的内核编译版本，极大的限制了其应用场景和兼容性。
发明内容
本申请的目的在于提出一种改进的漏洞修复方法和装置，来解决以上背景技术部分提到的技术问题。
第一方面，本申请提供了一种漏洞修复方法，所述方法包括：收集待修复内核的属性信息，所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；获取与所述特征信息匹配的漏洞 修复代码；基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配；使用已配置的漏洞修复代码对所述待修复内核进行漏洞修复。
在一些实施例中，所述获取与所述特征信息匹配的漏洞修复代码，包括：获取服务器中存储的、与所述特征信息匹配的漏洞修复代码，其中所述服务器存储的漏洞修复代码是实时更新的。
在一些实施例中，所述特征信息包括：用于描述所述待修复内核中是否存在预设的系统调用的信息以及用于描述所述待修复内核中是否存在预设的物理内存设备的信息；以及所述获取与所述特征信息匹配的漏洞修复代码，包括：当所述特征信息指示预设的系统调用存在时所匹配的漏洞修复代码包括内核模块类型的漏洞修复代码，当所述特征信息指示预设的物理内存设备存在时所匹配的漏洞修复代码包括指令序列类型的漏洞修复代码。
在一些实施例中，所述属性信息还包括内核符号校验参数；以及当所获取的漏洞修复代码为内核模块时，所述基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配，包括：使用所述内核符号校验参数配置所述内核模块对应的可执行文件中的内核符号校验参数字段。
在一些实施例中，所述属性信息还包括待修复内核中内核符号的地址信息；以及所述基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配包括：使用所述地址信息配置所述指令序列中的内核符号的地址。
在一些实施例中，在所述获取与所述特征信息匹配的漏洞修复代码之后，所述方法还包括：对所获取的漏洞修复代码进行合法性校验，以确认所述漏洞修复代码未被篡改。
在一些实施例中，所述方法还包括：生成用于表示漏洞修复成功或失败的信息。
在一些实施例中，所述收集待修复内核的属性信息，包括：响应于待修复内核的启动操作，收集所述待修复内核的属性信息。
在一些实施例中，所述方法还包括：若漏洞修复失败，则将待修 复内核恢复至修复之间的状态。
第二方面，本申请提供了一种漏洞修复装置，所述装置包括：收集单元，用于收集待修复内核的属性信息，所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；获取单元，用于获取与所述特征信息匹配的漏洞修复代码；配置单元，用于基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配；修复单元，用于使用已配置的漏洞修复代码对所述待修复内核进行漏洞修复。
在一些实施例中，所述获取单元进一步用于获取服务器中存储的、与所述特征信息匹配的漏洞修复代码，其中所述服务器存储的漏洞修复代码是实时更新的。
在一些实施例中，所述特征信息包括：用于描述所述待修复内核中是否存在预设的系统调用的信息以及用于描述所述待修复内核中是否存在预设的物理内存设备的信息；以及所述获取单元进一步用于：当所述特征信息指示预设的系统调用存在时所匹配的漏洞修复代码包括内核模块类型的漏洞修复代码，当所述特征信息指示预设的物理内存设备存在时所匹配的漏洞修复代码包括指令序列类型的漏洞修复代码。
在一些实施例中，所述属性信息还包括内核符号校验参数；以及所述配置单元进一步用于：当所获取的漏洞修复代码为内核模块时，使用所述内核符号校验参数配置所述内核模块对应的可执行文件中的内核符号校验参数字段。
在一些实施例中，所述属性信息还包括待修复内核中内核符号的地址信息；以及所述配置单元进一步用于：使用所述地址信息配置所述漏洞修复代码中的内核符号的地址。
在一些实施例中，所述装置还包括：校验单元，用于对所获取的漏洞修复代码进行合法性校验，以确认所述漏洞修复代码未被篡改。
在一些实施例中，所述装置还包括生成单元：生成用于表示漏洞修复成功或失败的信息。
在一些实施例中，所述收集单元进一步用于：响应于待修复内核 的启动操作，收集所述待修复内核的属性信息。
在一些实施例中，所述装置还包括：恢复单元，用于若漏洞修复失败，则将待修复内核恢复至修复之间的状态。
本申请提供的漏洞修复方法和装置，获取到与内核所支持的加载方式匹配的漏洞修复代码并对该漏洞修复代码进行相应的配置，使得配置后的漏洞修复代码可以在内核中加载以实现对内核的漏洞修复。这种漏洞修复方法可以兼容于多个内核修复代码加载方法，不依赖于内核源码及其内核功能，生成的补丁可自适配不同的内核编译版本，克服了Linux系统碎片化的影响。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1是本申请可以应用于其中的示例性系统架构图；
图2是根据本申请的漏洞修复方法的一个实施例的流程图；
图3是根据本申请的漏洞修复方法的又一个实施例的流程图；
图4是根据本申请的漏洞修复装置的一个实施例的结构示意图；
图5是适于用来实现本申请实施例的终端设备或服务器的计算机系统的结构示意图。
具体实施方式
下面结合附图和实施例对本申请作进一步的详细说明。可以理解的是，此处所描述的具体实施例仅仅用于解释相关发明，而非对该发明的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与有关发明相关的部分。
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本申请。
图1示出了可以应用本申请的漏洞修复方法或漏洞修复装置的实施例的示例性系统架构100。
如图1所示，系统架构100可以包括终端设备101、102、103，网络104和服务器105。网络104用以在终端设备101、102、103和服务器105之间提供通信链路的介质。网络104可以包括各种连接类型，例如有线、无线通信链路或者光纤电缆等等。
用户可以使用终端设备101、102、103通过网络104与服务器105交互，以接收或发送消息等。终端设备101、102、103上可以安装有安全软件等通讯客户端应用。
终端设备101、102、103可以是各种电子设备，包括但不限于智能手机、平板电脑、电子书阅读器、MP3播放器(Moving Picture Experts Group Audio Layer III，动态影像专家压缩标准音频层面3)、MP4(Moving Picture Experts Group Audio Layer IV，动态影像专家压缩标准音频层面4)播放器、膝上型便携计算机和台式计算机等等。
服务器105可以是提供各种服务的服务器，例如对终端设备101、102、103提供数据支持的云端服务器。云端服务器可以对接收到的漏洞修复代码请求等数据进行分析等处理，并将处理结果(例如预设的漏洞修复代码)反馈给终端设备101、102、103。
需要说明的是，本申请实施例所提供的漏洞修复方法一般由终端设备101、102、103执行，一些步骤也可以由服务器105执行；相应地，漏洞修复装置一般设置于终端设备101、102、103中，漏洞修复装置的一些单元也可以设置在服务器105中。
应该理解，图1中的终端设备、网络和服务器的数目仅仅是示意性的。根据实现需要，可以具有任意数目的终端设备、网络和服务器。
继续参考图2，示出了根据本申请的漏洞修复方法的一个实施例的流程200。所述的漏洞修复方法，包括以下步骤：
步骤201，收集待修复内核的属性信息。
在本实施例中，漏洞修复方法运行于其上的电子设备(例如图1所示的终端设备)可以首先对该电子设备中待修复内核进行分析，从而收集该内核的属性信息。待修复内核可以是各种操作系统的内核，相应的操作系统可以是Windows、Linux等。其中，该属性信息可以是各种用于描述内核相关属性的信息，例如内核版本信息、内核配置 信息等。其中，该属性信息中包括待修复内核所支持代码加载方式的特征信息。不同的内核编译版本，其支持的代码加载方式可能不同，待修复内核所支持的代码加载方式即可以通过上述特征信息进行表征。其中代码记载方式可以是内核记载代码的各种方式，例如加载内核模块方式、操作内存方式以及其他系统可能支持的代码加载方式。
在本实施例的一些可选实现方式中，上述属性信息包括以下至少一项：系统版本信息；用于指示系统调用是否存在的信息；用于指示物理内存设备是否存在的信息；内核配置信息；内核符号地址；校验和信息。
步骤202，获取与上述特征信息匹配的漏洞修复代码。
在本实施例中，电子设备可以在预先设置的一个或多个漏洞修复代码中，获取与上述特征信息匹配的漏洞修复代码。通常，预先设置的一个或多个漏洞修复代码可以是与用于对待修复内核进行修复的各种漏洞修复代码。这些预先设置的一个或多个漏洞修复代码可以是存储在电子设备本地，也可以存储在服务器上，且可以是各种形式的。其中，所获取的漏洞修复代码可以是内核模块形式，也可以是指令序列形式，还可以是预先约定的、且可被电子设备解释与执行的指令组合。内核模块形式是指可在内核运行时加载到内核的一组目标代码，在重构和使用可装载模块时并不需要重新编译内核。漏洞修复代码与特征信息之间的匹配关系可以是预先设置的。电子设备在获取漏洞修复代码时，即可以根据上述匹配关系获取到与上述特征信息匹配的漏洞修复代码。例如，当特征信息指示内核支持以预先约定的指令组合加载代码时，所匹配的漏洞修复代码可以是相应的指令组合形式。
在本实施例的一些可选实现方式中，步骤202可以具体包括：获取服务器中存储的、与上述特征信息匹配的漏洞修复代码，其中服务器存储的漏洞修复代码是实时更新的。在本实施例中，电子设备可以通过有线连接方式或者无线连接方式从服务器中获取与上述特征信息匹配的漏洞修复代码。该服务器中存储的漏洞修复代码可以是实时更新的，因此。在具体获取时，电子设备可以向服务器发送对漏洞修复代码的请求，服务器可以根据该请求向分发相应的漏洞代码。可选的， 电子设备还可以将相应的属性信息通过请求发送至服务器，使服务器返回的漏洞修复代码与上述特征信息匹配。上述无线连接方式可以包括但不限于3G/4G连接、WiFi连接、蓝牙连接、WiMAX连接、Zigbee连接、UWB(ultra wideband)连接、以及其他现在已知或将来开发的无线连接方式。通过这种方式，电子设备可以获取到实时更新的漏洞修复代码，使得对内核漏洞的修复具有更强的实时性，进一步保证内核的安全性。
步骤203，对漏洞修复代码进行配置以使该漏洞修复代码与待修复内核适配。
在本实施例中，基于步骤202获取到与上述特征信息匹配的漏洞修复代码后，上述电子设备可以对该漏洞修复代码进行相应地配置，以使该漏洞修复代码可以与上述待修复内核适配，例如使版本号匹配。上述属性信息中可以包括待修复内核所加载的代码应当符合的配置信息。因此，基于该属性信息，电子设备可以对漏洞修复代码进行相应的配置。上述配置可以是在漏洞修复代码中加入一些设定的符号地址、对漏洞修复代码的某些信息进行修改、确定漏洞修复代码将加载在内存中的地址等。
步骤204，使用已配置的漏洞修复代码对待修复内核进行漏洞修复。
在本实施例中，基于步骤203中配置好的漏洞修复代码，上述电子设备可以使用已配置的漏洞修复代码对待修复内核进行漏洞修复。具体的修复可以与漏洞修复代码类型对应的方式执行。例如，当漏洞修复代码是内核模块形式时，可以使用设定的系统调用在待修复内核中加载相应的内核模块；当漏洞修复代码是指令序列形式，可以通过操作内存的方式进行加载；当漏洞修复代码是预先约定的指令组合时，电子设备可以直接解释并执行。
在本实施例的一些可选实现方式中，步骤201中的特征信息可以包括：用于描述待修复内核中是否存在预设的系统调用的信息以及用于描述待修复内核中是否存在预设的物理内存设备的信息；以及步骤202包括：当上述特征信息指示预设的系统调用存在时所匹配的漏洞 修复代码包括内核模块类型的漏洞修复代码，当特征信息指示预设的物理内存设备存在时所匹配的漏洞修复代码包括指令序列类型的漏洞修复代码。
以Linux操作系统为例进行说明。例如，有的内核编译版本中存在预设的系统调用，该预设的系统调用可用于加载内核模块。当特征信息指示预设的系统调用存在时，意味着该内核模块可以支持内核模块的加载，则在获取漏洞修复代码时，可以获取内核模块类型的漏洞修复代码。上述预设的系统调用可以是模块加载与卸载函数，例如init_module、finite_module、delete_module，也可以是其他各种用于加载或卸载内核模块的系统调用。
又例如，有的内核编译版本中存在预设的物理内存设备，该预设的物理内存设备可用于对内存进行操作来加载和移除代码。当特征信息指示预设的物理内存设备存在时，意味着内核支持使用该物理内存设备进行操作内存以加载代码，则所获取的漏洞修复代码可以是可在内存中直接加载执行的指令序列。上述预设的物理内存设备可以是/dev/kmem。
可选的，当特征信息指示预设的系统调用与预设的物理内存设备均存在时，内核模块类型与指令序列类型的漏洞修复代码均匹配，电子设备可以选择任意一项。
在本实施例的一些可选实现方式中，上述属性信息还包括内核符号校验参数；以及当所获取的漏洞修复代码为内核模块时，上述步骤203还包括：使用内核符号校验参数配置内核模块对应的可执行文件中的内核符号校验参数字段。通常，内核在加载内核模块时，会利用各种内核符号校验参数对内核模块进行校验。因此，电子设备在获取到内核模块形式的漏洞修复代码后，可以将该内核模块对应的可执行文件中的内核符号校验参数字段的数值配置为内核符号校验参数，以使该内核模块在后续加载时通过内核的校验，从而得以顺利加载。上述校验参数可以是vermagic字符串、module结构体、符号CRC或者其他各种用于验证的校验参数。
在本实施例的一些可选实现方式中，上述属性信息还包括待修复 内核中内核符号的地址信息，上述步骤203还包括：使用上述地址信息配置漏洞修复代码中的内核符号的地址。在该实现方式中，电子设备可以使用上述地址信息对漏洞修复代码中的内核符号的地址进行配置，使得配置后的漏洞修复代码可以与待修复内核适配。
本申请的上述实施例提供的方法获取到与内核所支持的加载方式匹配的漏洞修复代码并对该漏洞修复代码进行相应的配置，使得配置后的漏洞修复代码可以在内核中加载以实现对内核的漏洞修复。这种漏洞修复方法可以兼容于多个内核修复代码加载方法，不依赖于内核源码及其内核功能，生成的补丁可自适配不同的内核编译版本，克服了Linux系统碎片化的影响。
进一步参考图3，其示出了漏洞修复方法的又一个实施例的流程300。该漏洞修复方法的流程300，包括以下步骤：
步骤301，收集待修复内核的属性信息。
在本实施例中，步骤301中的具体处理可以参考图2对应实施例中的步骤201，这里不再赘述。
在本实施例的一些可选实现方式中，电子设备可以在待修复内核启动时响应于待修复内核的启动操作，收集待修复内核的属性信息。该实现方式中，可以通过修改系统配置，使该漏洞修复方法在系统重新启动时及早运行，无需用户再次介入，即可及时保护系统。
步骤302，获取与特征信息匹配的漏洞修复代码。
在本实施例中，步骤302中的具体处理可以参考图2对应实施例中的步骤202，这里不再赘述。
步骤303，对所获取的漏洞修复代码进行合法性校验，以确认漏洞修复代码未被篡改。
在本实施例中，电子设备可以通过各种信息对所获取的漏洞修复代码进行合法性校验，以确认漏洞修复代码未被篡改。通常，电子设备可以预先设定合法的验证参数，该验证参数可以对确定合法的漏洞修复代码进行设定的算法所形成的，例如通过CRC，RSA等算法所形成的CRC值、RSA值。在进行合法性验证时，电子设备可以使用相 同的校验算法对获取到的漏洞修复代码进行计算，并对所生成的校验值与上述验证参数是否一致。具体的校验算法时，不限于CRC算法、RSA算法。
步骤304，对漏洞修复代码进行配置以使该漏洞修复代码与待修复内核适配。
在本实施例中，步骤304中的具体处理可以参考图2对应实施例中的步骤203，这里不再赘述。
步骤305，使用已配置的漏洞修复代码对待修复内核进行漏洞修复。
在本实施例中，步骤305中的具体处理可以参考图2对应实施例中的步骤204，这里不再赘述。
在本实施例的一些可选实现方式中，电子设备还生成用于表示漏洞修复成功或失败的信息。该信息可以供用户对漏洞修复是否成功进行查询。
在本实施例的一些可选实现方式中，若漏洞修复失败，电子设备可以将待修复内核恢复至修复之间的状态。通过这种方式，电子设备可以在修复失败后自动恢复至修复前的初始状态，以免对系统产生无不良影响。
从图3中可以看出，与图2对应的实施例相比，本实施例中的漏洞修复方法的流程300对所获取的漏洞修复代码进行了合法性校验，可以保证未被篡改，从而进一步提高漏洞修复的安全性。
进一步参考图4，作为对上述各图所示方法的实现，本申请提供了一种漏洞修复装置的一个实施例，该装置实施例与图2所示的方法实施例相对应，该装置具体可以应用于各种电子设备中。
如图4所示，本实施例所述的漏洞修复装置400包括：收集单元401、获取单元402、配置单元403和修复单元404。其中，收集单元401用于收集待修复内核的属性信息，属性信息包括用于表征待修复内核所支持代码加载方式的特征信息；获取单元402用于获取与特征信息匹配的漏洞修复代码；配置单元403用于基于属性信息，对漏洞 修复代码进行配置以使漏洞修复代码与待修复内核适配；而修复单元404用于使用已配置的漏洞修复代码对待修复内核进行漏洞修复。
在本实施例中，漏洞修复装置400的收集单元401、获取单元402、配置单元403和修复单元404的具体处理可以参考图2对应实施例中的步骤201、步骤202、步骤203、步骤204。
在本实施例的一些可选实现方式中，上述获取单元402进一步用于获取服务器中存储的、与特征信息匹配的漏洞修复代码，其中服务器存储的漏洞修复代码是实时更新的。具体处理可以参考图2对应实施例中相应的处理步骤。
在本实施例的一些可选实现方式中，上述特征信息包括：用于描述待修复内核中是否存在预设的系统调用的信息以及用于描述待修复内核中是否存在预设的物理内存设备的信息；以及上述获取单元402进一步用于当特征信息指示预设的系统调用存在时所匹配的漏洞修复代码包括内核模块类型的漏洞修复代码，当特征信息指示预设的物理内存设备存在时所匹配的漏洞修复代码包括指令序列类型的漏洞修复代码。具体处理可以参考图2对应实施例中相应的实现方式。
在本实施例的一些可选实现方式中，上述属性信息还包括内核符号校验参数；以及上述配置单元403进一步用于当所获取的漏洞修复代码为内核模块时，使用内核符号校验参数配置内核模块对应的可执行文件中的内核符号校验参数字段。具体处理可以参考图2对应实施例中相应的实现方式。
在本实施例的一些可选实现方式中，上述属性信息还包括待修复内核中内核符号的地址信息；以及配置单元403进一步用于使用地址信息配置漏洞修复代码中的内核符号的地址。具体处理可以参考图2对应实施例中相应的实现方式。
在本实施例的一些可选实现方式中，上述漏洞修复装置400还包括：校验单元(未示出)，用于对所获取的漏洞修复代码进行合法性校验，以确认漏洞修复代码未被篡改。具体处理可以参考图3对应实施例中的步骤303。
在本实施例的一些可选实现方式中，漏洞修复装置400还包括生 成单元(未示出)，生成用于表示漏洞修复成功或失败的信息。具体处理可以参考图3对应的实现方式。
在本实施例的一些可选实现方式中，收集单元401进一步用于：响应于待修复内核的启动操作，收集待修复内核的属性信息。具体处理可以参考图3对应的实现方式。
在本实施例的一些可选实现方式中，漏洞修复装置400还包括：恢复单元(未示出)，用于若漏洞修复失败，则将待修复内核恢复至修复之间的状态。具体处理可以参考图3对应的实现方式。
下面参考图5，其示出了适于用来实现本申请实施例的终端设备或服务器的计算机系统500的结构示意图。
如图5所示，计算机系统500包括中央处理单元(CPU)501，其可以根据存储在只读存储器(ROM)502中的程序或者从存储部分508加载到随机访问存储器(RAM)503中的程序而执行各种适当的动作和处理。在RAM 503中，还存储有系统500操作所需的各种程序和数据。CPU 501、ROM 502以及RAM 503通过总线504彼此相连。输入/输出(I/O)接口505也连接至总线504。
以下部件连接至I/O接口505：包括键盘、鼠标等的输入部分506；包括诸如阴极射线管(CRT)、液晶显示器(LCD)等以及扬声器等的输出部分507；包括硬盘等的存储部分508；以及包括诸如LAN卡、调制解调器等的网络接口卡的通信部分509。通信部分509经由诸如因特网的网络执行通信处理。驱动器510也根据需要连接至I/O接口505。可拆卸介质511，诸如磁盘、光盘、磁光盘、半导体存储器等等，根据需要安装在驱动器510上，以便于从其上读出的计算机程序根据需要被安装入存储部分508。
特别地，根据本公开的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括有形地包含在机器可读介质上的计算机程序，所述计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信部分509从网络上被下载和安装， 和/或从可拆卸介质511被安装。
附图中的流程图和框图，图示了按照本申请各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，所述模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本申请实施例中所涉及到的单元可以通过软件的方式实现，也可以通过硬件的方式来实现。所描述的单元也可以设置在处理器中，例如，可以描述为：一种处理器包括收集单元、获取单元、配置单元和修复单元。其中，这些单元的名称在某种情况下并不构成对该单元本身的限定，例如，收集单元还可以被描述为“待修复内核的属性信息的单元”。
作为另一方面，本申请还提供了一种非易失性计算机存储介质，该非易失性计算机存储介质可以是上述实施例中所述装置中所包含的非易失性计算机存储介质；也可以是单独存在，未装配入终端中的非易失性计算机存储介质。上述非易失性计算机存储介质存储有一个或者多个程序，当所述一个或者多个程序被一个设备执行时，使得所述设备：收集待修复内核的属性信息，所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；获取与所述特征信息匹配的漏洞修复代码；基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配；将已配置的漏洞修复代码加载值所述待修复内核中进行漏洞修复。
以上描述仅为本申请的较佳实施例以及对所运用技术原理的说明。本领域技术人员应当理解，本申请中所涉及的发明范围，并不限 于上述技术特征的特定组合而成的技术方案，同时也应涵盖在不脱离所述发明构思的情况下，由上述技术特征或其等同特征进行任意组合而形成的其它技术方案。例如上述特征与本申请中公开的(但不限于)具有类似功能的技术特征进行互相替换而形成的技术方案。

Claims (14)

  1. 一种漏洞修复方法，其特征在于，所述方法包括：
    收集待修复内核的属性信息，所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；
    获取与所述特征信息匹配的漏洞修复代码；
    基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配；
    使用已配置的漏洞修复代码对所述待修复内核进行漏洞修复。
  2. 根据权利要求1所述的方法，其特征在于，所述获取与所述特征信息匹配的漏洞修复代码，包括：
    获取服务器中存储的、与所述特征信息匹配的漏洞修复代码，其中所述服务器存储的漏洞修复代码是实时更新的。
  3. 根据权利要求1所述的方法，其特征在于，所述特征信息包括：用于描述所述待修复内核中是否存在预设的系统调用的信息以及用于描述所述待修复内核中是否存在预设的物理内存设备的信息；以及
    所述获取与所述特征信息匹配的漏洞修复代码，包括：
    当所述特征信息指示预设的系统调用存在时所匹配的漏洞修复代码包括内核模块类型的漏洞修复代码，当所述特征信息指示预设的物理内存设备存在时所匹配的漏洞修复代码包括指令序列类型的漏洞修复代码。
  4. 根据权利要求3所述的方法，其特征在于，所述属性信息还包括内核符号校验参数；以及
    当所获取的漏洞修复代码为内核模块时，所述基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配，包括：
    使用所述内核符号校验参数配置所述内核模块对应的可执行文件 中的内核符号校验参数字段。
  5. 根据权利要求1所述的方法，其特征在于，所述属性信息还包括待修复内核中内核符号的地址信息；以及
    所述基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配包括：
    使用所述地址信息配置所述漏洞修复代码中的内核符号的地址。
  6. 根据权利要求1所述的方法，其特征在于，在所述获取与所述特征信息匹配的漏洞修复代码之后，所述方法还包括：
    对所获取的漏洞修复代码进行合法性校验，以确认所述漏洞修复代码未被篡改。
  7. 一种漏洞修复装置，其特征在于，所述装置包括：
    收集单元，用于收集待修复内核的属性信息，所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；
    获取单元，用于获取与所述特征信息匹配的漏洞修复代码；
    配置单元，用于基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配；
    修复单元，用于使用已配置的漏洞修复代码对所述待修复内核进行漏洞修复。
  8. 根据权利要求7所述的装置，其特征在于，所述获取单元进一步用于获取服务器中存储的、与所述特征信息匹配的漏洞修复代码，其中所述服务器存储的漏洞修复代码是实时更新的。
  9. 根据权利要求7所述的装置，其特征在于，所述特征信息包括：用于描述所述待修复内核中是否存在预设的系统调用的信息以及用于描述所述待修复内核中是否存在预设的物理内存设备的信息；以及
    所述获取单元进一步用于：当所述特征信息指示预设的系统调用 存在时所匹配的漏洞修复代码包括内核模块类型的漏洞修复代码，当所述特征信息指示预设的物理内存设备存在时所匹配的漏洞修复代码包括指令序列类型的漏洞修复代码。
  10. 根据权利要求9所述的装置，其特征在于，所述属性信息还包括内核符号校验参数；以及
    所述配置单元进一步用于：当所获取的漏洞修复代码为内核模块时，使用所述内核符号校验参数配置所述内核模块对应的可执行文件中的内核符号校验参数字段。
  11. 根据权利要求7所述的装置，其特征在于，所述属性信息还包括待修复内核中内核符号的地址信息；以及
    所述配置单元进一步用于：使用所述地址信息配置所述漏洞修复代码中的内核符号的地址。
  12. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    校验单元，用于对所获取的漏洞修复代码进行合法性校验，以确认所述漏洞修复代码未被篡改。
  13. 一种设备，包括：
    处理器；和
    存储器，
    所述存储器中存储有能够被所述处理器执行的计算机可读指令，在所述计算机可读指令被执行时，所述处理器执行漏洞修复方法，所述方法包括：
    收集待修复内核的属性信息，所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；
    获取与所述特征信息匹配的漏洞修复代码；
    基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配；
    使用已配置的漏洞修复代码对所述待修复内核进行漏洞修复。
  14. 一种非易失性计算机存储介质，所述计算机存储介质存储有能够被处理器执行的计算机可读指令，当所述计算机可读指令被处理器执行时，所述处理器执行漏洞修复方法，所述方法包括：
    收集待修复内核的属性信息，所述属性信息包括用于表征所述待修复内核所支持代码加载方式的特征信息；
    获取与所述特征信息匹配的漏洞修复代码；
    基于所述属性信息，对所述漏洞修复代码进行配置以使所述漏洞修复代码与所述待修复内核适配；
    使用已配置的漏洞修复代码对所述待修复内核进行漏洞修复。
PCT/CN2016/086410 2016-03-30 2016-06-20 漏洞修复方法和装置 WO2017166446A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610193039.9A CN105893850B (zh) 2016-03-30 2016-03-30 漏洞修复方法和装置
CN201610193039.9 2016-03-30

Publications (1)

Publication Number Publication Date
WO2017166446A1 true WO2017166446A1 (zh) 2017-10-05

Family

ID=57014745

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/086410 WO2017166446A1 (zh) 2016-03-30 2016-06-20 漏洞修复方法和装置

Country Status (2)

Country Link
CN (1) CN105893850B (zh)
WO (1) WO2017166446A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021003982A1 (zh) * 2019-07-05 2021-01-14 深圳壹账通智能科技有限公司 业务系统漏洞处理方法、装置、计算机设备和存储介质
CN112818355A (zh) * 2021-03-02 2021-05-18 福州汇思博信息技术有限公司 一种漏洞管理方法及终端
CN113672929A (zh) * 2020-05-14 2021-11-19 阿波罗智联(北京)科技有限公司 漏洞特征获取方法、装置及电子设备
CN114143110A (zh) * 2021-12-08 2022-03-04 湖北天融信网络安全技术有限公司 一种拟态设备的漏洞处理方法、装置及系统
CN114143110B (zh) * 2021-12-08 2024-04-26 湖北天融信网络安全技术有限公司 一种拟态设备的漏洞处理方法、装置及系统

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108376061B (zh) * 2016-10-13 2019-12-10 北京百度网讯科技有限公司 用于开发无人驾驶车辆应用的方法和装置
CN109117169B (zh) * 2016-12-12 2022-06-07 百度在线网络技术（北京）有限公司 用于修复内核漏洞的方法和装置
CN107273750B (zh) * 2017-05-31 2021-03-16 上海交通大学 Android设备内核漏洞的修补系统及方法
CN107562560A (zh) * 2017-08-31 2018-01-09 青岛海信移动通信技术股份有限公司 异常问题处理方法及装置
CN109858252B (zh) * 2017-11-30 2023-04-25 中标软件有限公司 自制系统的漏洞分析修复方法
CN108073411A (zh) * 2017-12-11 2018-05-25 北京奇虎科技有限公司 一种补丁的内核加载方法及装置
CN108415840A (zh) * 2018-03-14 2018-08-17 百度在线网络技术（北京）有限公司 修复函数缺陷的方法、装置及服务器
CN109472148B (zh) * 2018-11-15 2021-04-02 百度在线网络技术（北京）有限公司 加载热补丁的方法、装置和存储介质
CN109409096B (zh) * 2018-11-15 2021-02-26 百度在线网络技术（北京）有限公司 内核漏洞修复方法、装置、服务器及系统
CN110321710A (zh) * 2019-07-05 2019-10-11 深信服科技股份有限公司 一种终端漏洞修复方法、系统及相关组件
CN110457909A (zh) * 2019-08-15 2019-11-15 腾讯科技（深圳）有限公司 虚拟机内存的漏洞修复方法、装置及计算机设备
CN111010391A (zh) * 2019-12-12 2020-04-14 杭州安恒信息技术股份有限公司 一种漏洞修复方法、装置及其相关设备
CN112511571B (zh) * 2021-02-07 2021-06-22 连连（杭州）信息技术有限公司 一种Web漏洞扫描方法、装置、系统、设备及存储介质
CN113486362B (zh) * 2021-08-17 2023-10-03 湖北溢丰数字科技股份有限公司 服务器的漏洞修复方法、装置和计算机设备
CN114978629A (zh) * 2022-05-12 2022-08-30 北京神州慧安科技有限公司 一种基于工业互联网安全监测、预警、应急处置系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103309768A (zh) * 2012-03-16 2013-09-18 腾讯科技（深圳）有限公司 系统文件修复方法和装置
CN103324494A (zh) * 2012-03-22 2013-09-25 金蝶软件（中国）有限公司 自动制作补丁的方法、服务器及系统
CN103678032A (zh) * 2012-09-17 2014-03-26 腾讯科技（深圳）有限公司 系统文件的修复方法及装置
CN104679532A (zh) * 2013-11-27 2015-06-03 腾讯科技（深圳）有限公司 内核模块加载方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8286238B2 (en) * 2006-09-29 2012-10-09 Intel Corporation Method and apparatus for run-time in-memory patching of code from a service processor
CN101799763B (zh) * 2009-02-10 2013-01-30 华为技术有限公司 内核在线补丁的方法、装置和系统
CN101937340B (zh) * 2009-06-29 2014-11-05 中兴通讯股份有限公司 使用补丁对软件进行动态升级与控制的方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103309768A (zh) * 2012-03-16 2013-09-18 腾讯科技（深圳）有限公司 系统文件修复方法和装置
CN103324494A (zh) * 2012-03-22 2013-09-25 金蝶软件（中国）有限公司 自动制作补丁的方法、服务器及系统
CN103678032A (zh) * 2012-09-17 2014-03-26 腾讯科技（深圳）有限公司 系统文件的修复方法及装置
CN104679532A (zh) * 2013-11-27 2015-06-03 腾讯科技（深圳）有限公司 内核模块加载方法和装置

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021003982A1 (zh) * 2019-07-05 2021-01-14 深圳壹账通智能科技有限公司 业务系统漏洞处理方法、装置、计算机设备和存储介质
CN113672929A (zh) * 2020-05-14 2021-11-19 阿波罗智联(北京)科技有限公司 漏洞特征获取方法、装置及电子设备
CN112818355A (zh) * 2021-03-02 2021-05-18 福州汇思博信息技术有限公司 一种漏洞管理方法及终端
CN114143110A (zh) * 2021-12-08 2022-03-04 湖北天融信网络安全技术有限公司 一种拟态设备的漏洞处理方法、装置及系统
CN114143110B (zh) * 2021-12-08 2024-04-26 湖北天融信网络安全技术有限公司 一种拟态设备的漏洞处理方法、装置及系统

Also Published As

Publication number Publication date
CN105893850B (zh) 2017-12-15
CN105893850A (zh) 2016-08-24

Similar Documents

Publication Publication Date Title
WO2017166446A1 (zh) 漏洞修复方法和装置
US10528742B2 (en) Method and apparatus for repairing kernel vulnerability
US10127057B2 (en) Method and apparatus for dynamically implementing application function
US10929117B2 (en) Container image building using shared resources
US9325506B2 (en) Cryptographically enforcing strict separation of environments
US10754708B2 (en) Orchestrator and console agnostic method to deploy infrastructure through self-describing deployment templates
WO2021072861A1 (zh) 应用服务处理方法、装置、终端及存储介质
CN108351923B (zh) 与统一可扩展固件接口系统可执行的脚本有关的阈值
US11886886B2 (en) System and method for runtime synchronization and authentication of pre-boot device drivers for a rescue operating system
WO2018032757A1 (zh) 组件升级的方法及装置
US20180210720A1 (en) Method and device for generating image file
CN107844306B (zh) 应用程序的修复方法、装置、存储介质及终端
US11816458B2 (en) Method and system for packaging infrastructure as code
WO2021121407A1 (zh) 一种虚拟机的容量更改方法及装置
CN111078262A (zh) 应用的热修复方法和装置
CN112434278A (zh) 一种裸机认证方法、装置、设备及介质
CN111459524A (zh) 软件的升级方法、装置、系统
CN110727575B (zh) 一种信息处理方法、系统、装置、以及存储介质
WO2021231686A1 (en) Controlled scope of authentication key for software update
US11520891B1 (en) Secure boot of an integrated circuit
US10776132B1 (en) System and method for preboot device driver provisioning for remotely-staged operating system
CN108920936A (zh) 一种基于Purley平台实现vmware认证的方法和装置
CN113553110A (zh) 一种服务器的硬件基线自动化修正方法、装置及系统
US10970058B2 (en) Software package installations with proximity tags
CN116339761B (zh) 一种自动化构建镜像模板的方法、系统、存储介质、设备

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16896219

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16896219

Country of ref document: EP

Kind code of ref document: A1