WO2017166448A1

WO2017166448A1 - Kernel vulnerability repair method and device

Info

Publication number: WO2017166448A1
Application number: PCT/CN2016/086412
Authority: WO
Inventors: 卢永强; 夏良钊; 郑龙日; 包沉浮; 张煜龙; 韦韬
Original assignee: 百度在线网络技术（北京）有限公司
Priority date: 2016-03-30
Filing date: 2016-06-20
Publication date: 2017-10-05
Also published as: CN105868639A

Abstract

A kernel vulnerability repair method and device. A specific embodiment of the method comprises: determining a memory address, in a kernel to be repaired, of a kernel function or variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in a memory (201); configuring, according to the memory address, the address of a kernel symbol required when the preset vulnerability repair instruction calls the kernel function or variable (202); determining a storage space used for loading a preset vulnerability repair instruction in the kernel to be repaired after configuring the address of the kernel symbol required by the preset vulnerability repair instruction (203); and loading the preset vulnerability repair instruction in the storage space (204). In the method, the address of a kernel symbol required by a vulnerability repair instruction is configured according to a determined memory address of a kernel function or variable having problems, so that when loaded in kernels of different versions, the vulnerability repair instruction can accurately jump to the kernel function corresponding to the kernel symbol or access the variable corresponding to the kernel symbol. The vulnerability repair instruction is applicable to loading in kernels of various versions, and therefore, the kernel vulnerability is repaired.

Description

Kernel vulnerability repair method and device

Cross-reference to related applications

The present application claims the priority of the Chinese Patent Application Serial No. PCT-A------

Technical field

The present application relates to the field of computers, and in particular to the field of operating systems, and in particular, to a kernel vulnerability repair method and apparatus.

Background technique

As the core of the operating system, the kernel ensures that the security of the kernel is a top priority in security protection. Therefore, when you find a vulnerability in the kernel, you need to fix the vulnerability in the kernel in time. At present, the commonly used vulnerability repair method is: for a version of the kernel, set the vulnerability repair code for the kernel of this version, use the bug fix code to find the address of the kernel kernel function in the kernel that needs to be repaired, and then it will appear Replace the kernel function of the problem with the repaired kernel function.

However, when the vulnerability is fixed in the above manner, the kernel function has different addresses in the kernel due to different kernel versions. Therefore, the code for replacing the kernel function in one version of the kernel cannot be applied to another version. On the kernel. Need to fix the bug fix code for each kernel version and increase development costs.

Summary of the invention

The present application provides a kernel vulnerability repairing method and apparatus for solving the technical problems existing in the above background art.

In a first aspect, the present application provides a kernel vulnerability repairing method, the method comprising: determining a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in a memory, in a kernel to be repaired, The vulnerability repair instruction is based on the preset leak The hole repair code is compiled and generated; based on the memory address, configure the address of the kernel symbol required by the preset vulnerability repair instruction to call the kernel function or variable; determine the kernel required to load the preset vulnerability repair instruction in the kernel to be repaired The address of the symbol is configured to reserve the storage space of the vulnerability repair instruction; the default vulnerability repair instruction is loaded in the storage space to repair the vulnerability in the repair kernel.

In a second aspect, the present application provides a kernel vulnerability repairing apparatus, the apparatus comprising: an address determining unit configured to determine a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repairing instruction to be loaded in a memory to be repaired The memory address in the kernel, the preset vulnerability repair instruction is generated based on compiling the preset vulnerability repair code; the setting unit is configured to configure the kernel symbol required for the preset vulnerability repair instruction to call the kernel function or variable based on the memory address Address; a space determining unit configured to determine a storage space of a preset vulnerability repair instruction configured to load an address of a kernel symbol required to load a preset vulnerability repair instruction in the kernel to be repaired; a loading unit configured to be used for Load the default vulnerability fix instructions in the storage space to fix the vulnerabilities in the repair kernel.

The kernel vulnerability repairing method and apparatus provided by the present application determine the memory address of the kernel function or variable indicated by the kernel symbol in the preset vulnerability repair instruction to be loaded in the memory in the kernel to be repaired; Set the address of the kernel symbol required to invoke the kernel function or variable in the bug fix command; determine the storage space in the kernel to be loaded to load the preset vulnerability fix; load the preset vulnerability fix command in the storage space. Implements the memory address of the kernel function or variable based on the identified problem, and configures the address of the kernel symbol required by the vulnerability fix instruction. When the vulnerability repair instruction is loaded in different versions of the kernel, it can accurately jump to the kernel function corresponding to the kernel symbol or access the variable corresponding to the kernel symbol, and the vulnerability repair instruction is suitable for loading in various versions of the kernel, thereby Complete the repair of the vulnerability in the kernel.

DRAWINGS

Other features, objects, and advantages of the present application will become more apparent from the detailed description of the accompanying drawings.

1 is an exemplary system architecture diagram to which the present application can be applied;

2 shows a flow of one embodiment of a kernel vulnerability repair method according to the present application. Figure

3 shows a flow chart of another embodiment of a kernel vulnerability repair method in accordance with the present application;

4 is a block diagram showing the structure of an embodiment of a kernel vulnerability repairing apparatus according to the present application;

FIG. 5 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server of an embodiment of the present application.

detailed description

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention, rather than the invention. It is also to be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings.

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings.

FIG. 1 illustrates an exemplary system architecture 100 of an embodiment of a kernel vulnerability repair method or apparatus to which the present application may be applied.

As shown in FIG. 1, system architecture 100 can include

terminal devices

101, 102, 103, network 104, and server 105. The network 104 is used to provide a medium for the transmission link between the

terminal devices

101, 102, 103 and the server 105. Network 104 may include various types of connections, such as wired, wireless transmission links, or fiber optic cables, to name a few.

The user can interact with the server 105 over the network 104 using the

terminal devices

101, 102, 103 to receive or transmit messages and the like. Various communication applications, such as an instant messaging application, a browser application, a search application, a word processing application, and the like, may be installed on the

terminal devices

101, 102, and 103.

The

terminal devices

101, 102, 103 may be various electronic devices having a display screen and supporting network communication, including but not limited to smart phones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, dynamic Image Expert compresses standard audio layer 3), MP4 (Moving Picture Experts Group Audio Layer IV, motion imaging experts compress standard audio layers 4) players, laptops and desktop computers, and more.

The server 105 can store vulnerability repair codes of a plurality of different processing architectures and different versions of the kernel. When receiving the download request sent by the

terminal devices

101, 102, and 103, the kernel applicable to the processor architecture of the terminal can be vulnerable. The repaired code is sent to the end device for feedback.

It should be understood that the number of terminal devices, networks, and servers in Figure 1 is merely illustrative. Depending on the implementation needs, there can be any number of terminal devices, networks, and servers.

Please refer to FIG. 2, which illustrates a flow 200 of one embodiment of a kernel vulnerability repair method in accordance with the present application. It should be noted that the kernel vulnerability repairing method provided by the embodiment of the present application is generally performed by the

terminal devices

101, 102, and 103 in FIG. The method includes the following steps:

Step 201: Determine a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in the memory in the kernel to be repaired.

In this embodiment, the preset vulnerability repairing instruction is generated based on compiling the preset vulnerability repairing code.

In this embodiment, the vulnerability repair code for repairing the kernel vulnerability may be preset. The bug fix code can include custom functions and variables for fixing the kernel. At the same time, the bug fix code can also contain the kernel functions and variables in the kernel that need to be called during the bug fix process. You can use the bug fix code to fix the kernel's instructions and data and complete the kernel bug fix. You can also replace the problematic function with the repaired function by modifying the system call table or function code.

In this embodiment, the kernel symbol table of the kernel may be first obtained, and then, according to the name of the kernel symbol defined in the kernel symbol table and the memory address of the kernel function or variable corresponding to the kernel symbol in the kernel, the vulnerability repair instruction may be determined. The kernel function indicated by the kernel symbol or the memory address of the variable in the kernel to be repaired.

Take the Linux kernel of the Linux operating system as an example. In the Linux kernel, a kernel symbol table for recording kernel functions and variables that the kernel can use for external references is included. In the kernel symbol table, record the Linux kernel functions, the identifiers of the variables in the Linux kernel, and the kernel addresses of the Linux kernel functions and variables in the Linux kernel in the Linux kernel. able to pass The proc file system of the Linux kernel looks for the Linux kernel symbol table, and then finds the memory address of the kernel function or variable indicated by the Linux kernel symbol in the bug fix command in the kernel to be repaired.

In some optional implementation manners of the embodiment, before determining that the kernel function or the variable indicated by the kernel symbol in the preset vulnerability repair instruction to be loaded in the memory is in the memory address of the core to be repaired, the method further includes: Obtaining the attribute information of the kernel to be repaired and the memory address of the kernel function or variable in the kernel to be repaired, the attribute information includes: the architecture information of the processor on which the kernel to be repaired runs, the kernel version information; and the attribute information is stored corresponding to the memory address. .

In this embodiment, the attribute information of the target kernel can be obtained through the proc file system. The attribute information may include, but is not limited to, the architecture of the processor on which the kernel is running, and the Linux kernel version.

In this embodiment, different processor architectures, kernel symbols in kernels of different kernel versions, and addresses of variables in the kernel may be acquired in advance. For example, the proc file system in the kernel gets the memory address of a kernel function or variable in the kernel. Then, the processor architecture identifier of the processor architecture, the version identifier of the kernel version, and the memory address of the kernel function or variable in the kernel are stored. Therefore, when the kernel function or the variable indicated by the kernel symbol in the vulnerability repair instruction is required to be in the memory address of the kernel to be repaired, the architecture of the processor on which the kernel is running, the version information of the kernel, and then, The memory address of the kernel function or the variable in the kernel corresponding to the processor architecture and the kernel version information can be obtained in advance.

Step 202: Configure, based on the memory address, an address of a kernel symbol required by a preset vulnerability repair instruction to call a kernel function or a variable.

In this embodiment, after obtaining the memory function of the kernel function or variable indicated by the kernel symbol in the preset vulnerability repair instruction in the kernel to be repaired, the preset vulnerability repair instruction may be configured to call the kernel function based on the memory address or The address of the kernel symbol required for the variable.

Before describing the address of the kernel symbol in the instruction in this application, the code compilation process is first described: in order to make the vulnerability repair code loadable in memory, the vulnerability repair code needs to be compiled. After compiling the bug fix code, To generate a machine command corresponding to the vulnerability fix code. This machine instruction can be referred to as a vulnerability repair instruction. The kernel repair symbol can contain kernel symbols, which can be symbols corresponding to functions or variables. When the instruction contains a kernel symbol, it indicates that the instruction is to call the kernel function corresponding to the kernel symbol or access the variables in the kernel.

Based on the compilation process of the code described above, the process of configuring the address of the kernel symbol required to call the kernel function or variable by the preset vulnerability repair instruction based on the memory address is continued. In this embodiment, the kernel is included in the vulnerability repair instruction. When the symbol is used, the function of the instruction is to call the kernel function corresponding to the kernel symbol or access the variable in the kernel corresponding to the kernel symbol.

Due to the different kernel versions, the kernel functions indicated by the kernel symbols or the variables in the kernel have different memory addresses in the kernel. Therefore, when the vulnerability repair instruction is loaded in the kernel, it is necessary to determine the memory address of the kernel function or variable corresponding to the kernel symbol contained in the vulnerability repair instruction in the kernel. Then, based on the memory address, configure the address of the kernel symbol required by the default vulnerability repair instruction to call the kernel function or variable. For example, a part of the storage space is reserved in the corresponding storage space in the preset vulnerability repair instruction for storing the address of the kernel symbol required when the preset vulnerability repair instruction calls the kernel function or the variable, thereby completing the preset vulnerability repair instruction. The configuration of the required kernel symbol address in . Therefore, when the vulnerability repair instruction is executed, the kernel function corresponding to the kernel symbol or the address of the variable in the kernel can be correctly jumped, thereby calling a function corresponding to the kernel symbol or accessing a variable in the kernel corresponding to the kernel symbol.

For example, the vulnerability repair instruction is an instruction that calls the kernel function A. In the vulnerability repair instruction, the kernel symbol, that is, the kernel symbol corresponding to the kernel function A, is included. When the bug fix command is loaded into the kernel, it is possible to determine the memory address of kernel function A in the kernel to be loaded by the bug fix instruction. Then, using the memory address, configure the address of the kernel symbol required by the default vulnerability repair instruction to call the kernel function or variable. Thus, when the vulnerability repair instruction is executed, it can correctly jump to the memory address of the kernel function A in the kernel, and call the kernel function A.

Step 203: Determine a storage space of the preset vulnerability repairing instruction in the kernel to be repaired for loading the address of the kernel symbol required for the preset vulnerability repairing instruction.

In this embodiment, in the bug fix command, the kernel symbol is in the kernel to be repaired. After the address is set, the storage space of the preset vulnerability repair instruction for loading the address corresponding to the kernel symbol in the kernel to be repaired can be determined. For example, storage space for loading bug fix instructions can be pre-set for different versions of the kernel.

Step 204: Load a preset vulnerability repair instruction in the storage space.

In this embodiment, after determining the storage space of the preset vulnerability repairing instruction for loading the address corresponding to the kernel symbol in the kernel to be repaired, the preset vulnerability repairing instruction may be loaded in the storage space to repair the kernel. The vulnerability in the fix was fixed.

In some optional implementation manners of the embodiment, loading the preset vulnerability repairing instruction in the storage space to repair the vulnerability in the repairing kernel includes: obtaining a memory address of the kernel function to be repaired in the kernel to be repaired; The memory address in the system call table in the kernel to be repaired is replaced with the preset memory address.

In this embodiment, the preset vulnerability repair instruction loaded in the kernel may repair the vulnerability in the kernel in the following manner: for example, the kernel function that has a problem in the kernel to be repaired is repaired, and the proc of the Linux kernel can be used. File system, get the kernel symbol table. Then, in the kernel symbol table, you can find the memory address of the kernel function in question. After looking up the memory address of the kernel function in question, you can replace the memory address of the kernel function in the system call table in the kernel to be repaired with the default memory address.

In some optional implementation manners of the embodiment, loading the preset vulnerability repairing instruction in the storage space to repair the vulnerability in the repairing kernel includes: obtaining a storage space corresponding to the kernel function to be repaired in the kernel to be repaired; Copy the repaired kernel function to the storage space.

In this embodiment, the preset vulnerability repair command loaded in the kernel may also repair the vulnerability in the kernel in the following manner: for example, the kernel function that has a problem in the kernel to be repaired is repaired, and the linux kernel may be used. The proc file system gets the kernel symbol table. Then, in the kernel symbol table, look for the storage space of the kernel function in question. Then, copy the repaired kernel function to the storage space. Thus, the storage space of the kernel function in the kernel stores the repaired kernel function, and the repair of the problem function in the kernel to be repaired.

Please refer to FIG. 3, which illustrates another method of kernel vulnerability repairing method according to the present application. Flowchart 300 of an embodiment. It should be noted that the method provided by the embodiment of the present application is generally performed by the

terminal devices

101, 102, and 103 in FIG. 1, and the method includes the following steps:

Step 301: Determine a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in the memory in the kernel to be repaired.

Step 302: Configure, based on the memory address, an address of a kernel symbol required by a preset vulnerability repair instruction to call a kernel function or a variable.

Step 303: The selected storage space or the allocated storage space is used as a storage space for loading a preset vulnerability repair instruction.

In this embodiment, the storage space for loading the preset vulnerability repair instruction in the kernel to be repaired may be determined by using the preset storage space in the kernel to be repaired as required for loading the preset vulnerability repair instruction. The storage space of the default vulnerability repair instruction after the address of the kernel symbol is configured. For example, the preset storage space may be a storage space having executable permissions.

In this embodiment, the storage space for loading the preset vulnerability repair instruction in the kernel to be repaired may be determined by using the corresponding kernel function in the kernel to be repaired as a preset vulnerability repair instruction. Storage space.

In this embodiment, the storage space for loading the preset vulnerability repair instruction in the kernel to be repaired may be determined in the following manner: corresponding to the preset kernel function in the kernel to be repaired The storage space loads a preset storage space allocation instruction, and generates a storage space of a preset size; the generated storage space is used as a storage space for loading a preset vulnerability repair instruction.

In this embodiment, the code having the memory allocation function can be implemented by modifying the kernel function, such as the code of the uname function. Then, after compiling the code, a memory allocation instruction is generated. After the memory allocation instruction is loaded, a piece of storage space allocated in the Linux kernel can be returned, and the preset vulnerability repair instruction can be loaded into the storage space.

Step 304: Load a preset vulnerability repair instruction in the storage space.

It can be seen from FIG. 3 that, unlike the embodiment corresponding to FIG. 2, the process 300 of the method in this embodiment highlights step 303, that is, loading a preset vulnerability in the selected storage space or the allocated storage space. Repair instructions. The solution described in this embodiment may further select a storage space for loading a vulnerability repair instruction for different versions of the kernel, and load a vulnerability repair instruction in the storage space. The vulnerability repair instructions can be found in different versions of the kernel, so that other kernel programs in the kernel can communicate with the vulnerability repair code during the vulnerability repair process, for example, passing parameters, further enhancing the vulnerability repair instruction pair. Applicability of different versions of the kernel.

The following is a problem with the kernel function A in the kernel. The vulnerability repair command is loaded in a version of the kernel as an example to illustrate the kernel vulnerability repair method in this application: the vulnerability repair code can be generated first. The bug fix code contains code for modifying the problem kernel function A to the repaired kernel function A1, which is called in kernel repair function B. After compiling the vulnerability repair code, the obtained vulnerability repair instruction includes a vulnerability repair instruction for calling kernel function B and a vulnerability instruction for modifying kernel function A to the repaired kernel function A1.

First, determine the memory address of the kernel function A and the kernel function B in the kernel of the version, and then configure the kernel address of the kernel function B in the kernel of the kernel to be the kernel symbol required for the kernel repair function to call the kernel function B. The address of the kernel symbol corresponding to kernel function B.

The bug fix command can then be loaded into the storage space in the selected kernel. When the bug fix instruction is executed, the kernel function B can be called by correctly jumping to the address of the kernel function B in the version of the kernel. At the same time, the code of the repaired kernel function A1 can be copied to the memory space of the kernel function A in the kernel, thereby repairing the kernel function A in question.

The following describes the difference between the kernel vulnerability repair method in the present application and the prior art based on the kernel vulnerability repair method described in the above embodiment:

For example, in the prior art, the bug fix code needs to find the address of the kernel function in the kernel that needs to be repaired, and then replace the kernel function with the problem with the repaired kernel function. Because of the different kernel versions, the kernel functions have different addresses in the kernel. Therefore, code that replaces kernel functions in one version of the kernel cannot be applied to another version of the kernel. Need to fix the bug fix code for each kernel version and increase development costs.

In this application, it is equivalent to a template in which the bug fix code is created in advance. The bug fix code includes code to replace the problem function with the repaired kernel function. After the bug fix code is compiled, a bug fix command can be generated. When it is necessary to repair a kernel function that has a problem in the kernel, the kernel function indicated by the kernel symbol in the vulnerability repair instruction that fixes the kernel function in the kernel can be repaired in the memory of the kernel to be repaired. Address, configures the address of the kernel symbol required by the vulnerability fix instruction to call the kernel function. When the vulnerability repair instruction is loaded in different versions of the kernel, it can accurately jump to the kernel function corresponding to the kernel symbol or access the variable corresponding to the kernel symbol. The vulnerability repair instruction is applicable to loading in various versions of the kernel, and the pair is completed. The repair of kernel functions that have problems in the kernel, that is, the repair of the vulnerability in the kernel.

Please refer to FIG. 4, which shows a schematic structural diagram of an embodiment of a kernel vulnerability repairing apparatus according to the present application. The kernel vulnerability repairing apparatus 400 includes an address determining unit 401, a setting unit 402, a space determining unit 403, and a loading unit 404. The address determining unit 401 is configured to determine a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repairing instruction to be loaded in the memory, and the preset vulnerability repairing instruction is based on the preset The vulnerability repair code is compiled and generated; the setting unit 402 is configured to configure a preset vulnerability repair instruction to call a kernel function or a variable based on the memory address. The address of the required kernel symbol; the space determining unit 403 is configured to determine a storage space of the preset vulnerability repairing instruction for configuring the address of the kernel symbol required for loading the preset vulnerability repairing instruction in the kernel to be repaired; The 404 configuration is used to load a preset vulnerability fix instruction in the storage space to fix the vulnerability in the repair kernel.

In some optional implementation manners of the embodiment, the space determining unit 403 includes: a first storage space configuration subunit (not shown) configured to use a preset storage space in the kernel to be repaired as a loading pair. The storage space of the preset vulnerability repair instruction after the address of the kernel symbol required by the preset vulnerability repair instruction is configured, and the preset storage space includes: a storage space with executable authority.

In some optional implementation manners of the embodiment, the space determining unit 403 includes: a second storage space configuration subunit (not shown) configured to use a preset kernel function in a corresponding storage space in the kernel to be repaired. A storage space for a preset vulnerability repair instruction configured to load an address of a kernel symbol required for a preset vulnerability repair instruction.

In some optional implementation manners of the embodiment, the space determining unit 403 includes: a storage space allocation subunit (not shown) configured to load a preset in a corresponding storage space in a kernel to be repaired by a preset kernel function. a storage space allocation instruction, and a storage space of a preset size; a third storage space configuration subunit (not shown) configured to use the generated storage space as a kernel symbol required for loading a preset vulnerability repair instruction The storage address of the preset vulnerability repair instruction after the address is configured.

In some optional implementation manners of the embodiment, the loading unit 404 includes: a memory address obtaining subunit (not shown) configured to acquire a memory address of a kernel function to be repaired in the kernel to be repaired; (not shown), configured to replace the memory address in the system call table in the kernel to be repaired with the preset memory address.

In some optional implementation manners of the embodiment, the loading unit 404 includes: a storage space acquisition subunit (not shown) configured to acquire a storage space corresponding to the kernel function to be repaired in the kernel to be repaired; A unit (not shown) configured to copy the repaired kernel function to the storage space.

In some optional implementation manners of the embodiment, the apparatus 400 further includes: an information acquiring unit (not shown) configured to acquire attribute information of the kernel to be repaired and the kernel to be repaired The memory address of the kernel function or variable in the attribute information includes: architecture information of the processor on which the kernel to be repaired runs, kernel version information; a storage unit (not shown) configured to store the attribute information and the memory address correspondingly .

FIG. 5 is a block diagram showing the structure of a computer system suitable for implementing the terminal device or server of the embodiment of the present application.

As shown in FIG. 5, computer system 500 includes a central processing unit (CPU) 501 that can be loaded into a program in random access memory (RAM) 503 according to a program stored in read only memory (ROM) 502 or from storage portion 508. And perform various appropriate actions and processes. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input/output (I/O) interface 505 is also coupled to bus 504.

The following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a storage portion 508 including a hard disk or the like. And a communication portion 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the Internet. Driver 510 is also coupled to I/O interface 505 as needed. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 510 as needed so that a computer program read therefrom is installed into the storage portion 508 as needed.

In particular, the processes described above with reference to the flowcharts may be implemented as a computer software program in accordance with an embodiment of the present disclosure. For example, an embodiment of the present disclosure includes a computer program product comprising a computer program tangibly embodied on a machine readable medium, the computer program comprising program code for executing the method illustrated in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication portion 509, and/or installed from the removable medium 511.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality and operation of possible implementations of systems, methods and computer program products in accordance with various embodiments of the present application. In this regard, each block of the flowchart or block diagrams can represent a module, a program segment, or a portion of code that includes one or more logic for implementing the specified. Functional executable instructions. It should also be noted that in some cases as a replacement In the implementation, the functions noted in the blocks may also occur in a different order than that illustrated in the drawings. For example, two successively represented blocks may in fact be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts, can be implemented in a dedicated hardware-based system that performs the specified function or operation. Or it can be implemented by a combination of dedicated hardware and computer instructions.

In another aspect, the present application further provides a non-volatile computer storage medium, which may be a non-volatile computer storage medium included in the apparatus described in the foregoing embodiments; It may be a non-volatile computer storage medium that exists alone and is not assembled into the terminal. The non-volatile computer storage medium stores one or more programs, when the one or more programs are executed by a device, causing the device to: determine a kernel in a preset vulnerability repair instruction to be loaded in the memory The memory function of the kernel function or variable indicated by the symbol in the kernel to be repaired, the preset vulnerability repairing instruction is generated based on compiling the preset vulnerability repairing code; based on the memory address, configuring the preset vulnerability repairing instruction to call the kernel function or The address of the kernel symbol required for the variable; the storage space of the preset vulnerability repair instruction configured to configure the address of the kernel symbol required to load the preset vulnerability repair instruction in the kernel to be repaired; loading in the storage space The preset vulnerability repairing instruction repairs the vulnerability in the kernel to be repaired.

The above description is only a preferred embodiment of the present application and a description of the principles of the applied technology. It should be understood by those skilled in the art that the scope of the invention referred to in the present application is not limited to the specific combination of the above technical features, and should also be covered by the above technical features without departing from the inventive concept. Other technical solutions formed by any combination of their equivalent features. For example, the above features are combined with the technical features disclosed in the present application, but are not limited to the technical features having similar functions.

Claims

A kernel vulnerability repair method, characterized in that the method comprises:

Determining a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in the memory in the kernel to be repaired, the preset vulnerability repair instruction being generated based on compiling the preset vulnerability repair code ;

Based on the memory address, configure the address of the kernel symbol required by the default vulnerability repair instruction to call the kernel function or variable;

Determining a storage space of a preset vulnerability repair instruction configured to load an address of a kernel symbol required for a preset vulnerability repair instruction in the kernel to be repaired;

Loading the preset vulnerability repair instruction in the storage space to repair the vulnerability in the repair kernel.
The method according to claim 1, wherein the storage space of the preset vulnerability repairing instruction for configuring the address of the kernel symbol required to load the preset vulnerability repairing instruction in the kernel to be repaired comprises:

The preset storage space in the kernel to be repaired is used as a storage space of a preset vulnerability repair instruction configured to load an address of a kernel symbol required for a preset vulnerability repair instruction, and the preset storage space includes: The storage space for the execution permission.
The method according to claim 1, wherein the storage space of the preset vulnerability repairing instruction for configuring the address of the kernel symbol required to load the preset vulnerability repairing instruction in the kernel to be repaired comprises:

The storage space of the preset vulnerability repair instruction after the corresponding kernel function in the kernel to be repaired is configured as an address for loading the kernel symbol required for the preset vulnerability repair instruction.
The method according to claim 1, wherein the storage space of the preset vulnerability repairing instruction for configuring the address of the kernel symbol required to load the preset vulnerability repairing instruction in the kernel to be repaired comprises:

The preset kernel function loads a preset storage space allocation instruction in a corresponding storage space in the kernel to be repaired, and generates a storage space of a preset size;

The generated storage space is used as a storage space for the preset vulnerability repair instruction configured to load the address of the kernel symbol required for the preset vulnerability repair instruction.
The method according to any one of claims 1 to 4, wherein loading the preset vulnerability repairing instruction in the storage space to repair a vulnerability in the repair kernel includes:

Obtaining the memory address of the kernel function to be repaired in the kernel to be repaired;

Replace the memory address in the system call table in the kernel to be repaired with the preset memory address.
The method according to any one of claims 1 to 4, wherein loading the preset vulnerability repairing instruction in the storage space to repair a vulnerability in the repair kernel includes:

Obtaining a storage space corresponding to the kernel function to be repaired in the kernel to be repaired;

Copy the repaired kernel function to the storage space.
The method according to claim 1, wherein the method determines a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in a memory before a memory address in a core to be repaired Also includes:

Obtaining the attribute information of the kernel to be repaired and the memory address of the kernel function or variable in the kernel to be repaired, where the attribute information includes: architecture information of the processor on which the kernel to be repaired runs, and kernel version information;

The attribute information is stored corresponding to the memory address.
A kernel vulnerability repairing device, characterized in that the device comprises:

An address determining unit configured to determine a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repairing instruction to be loaded in the memory, wherein the preset vulnerability repairing instruction is based on a preset The bug fix code is compiled and generated;

a setting unit configured to configure, based on a memory address, an address of a kernel symbol required to invoke a kernel function or variable by a preset vulnerability repair instruction;

a space determining unit configured to determine a storage space of a preset vulnerability repairing instruction configured to load an address of a kernel symbol required for a preset vulnerability repairing instruction in the kernel to be repaired;

And a loading unit configured to load the preset vulnerability repairing instruction in the storage space to repair a vulnerability in the repairing kernel.
The apparatus according to claim 8, wherein the space determining unit comprises:

a first storage space configuration sub-unit configured to store a preset space in the kernel to be repaired as a storage space of a preset vulnerability repair instruction configured to load an address of a kernel symbol required for a preset vulnerability repair instruction The preset storage space includes: a storage space having executable permissions.
The apparatus according to claim 8, wherein the space determining unit comprises:

a second storage space configuration sub-unit configured to pre-configure the default kernel function in the corresponding storage space in the kernel to be repaired as a preset vulnerability repair for loading an address of a kernel symbol required for the preset vulnerability repair instruction The storage space for the instruction.
The apparatus according to claim 8, wherein the space determining unit comprises:

a storage space allocation sub-unit configured to load a preset storage space allocation instruction in a corresponding storage space of the preset kernel function in the kernel to be repaired, and generate a storage space of a preset size;

The third storage space configuration subunit is configured to use the generated storage space as a storage space of a preset vulnerability repair instruction configured to load an address of a kernel symbol required for the preset vulnerability repair instruction.
The device according to any one of claims 8-11, wherein the loading unit comprises:

a memory address obtaining subunit configured to obtain a memory address of a kernel function to be repaired in the kernel to be repaired;

The replacement subunit is configured to replace the memory address in the system call table in the kernel to be repaired with a preset memory address.
The device according to any one of claims 8-11, wherein the loading unit comprises:

The storage space acquisition subunit is configured to obtain a storage space corresponding to the kernel function to be repaired in the kernel to be repaired;

A copy subunit configured to copy the repaired kernel function to the storage space.
The device according to claim 7, wherein the device further comprises:

The information obtaining unit is configured to obtain attribute information of the kernel to be repaired and a memory address of a kernel function or a variable in the kernel to be repaired, where the attribute information includes: architecture information of the processor on which the kernel to be repaired is running, and kernel version information. ;

And a storage unit configured to store the attribute information corresponding to the memory address.
A device that includes:

Processor; and

Memory,

The memory stores computer readable instructions executable by the processor, the processor executing a kernel vulnerability repair method when the computer readable instructions are executed, the method comprising:

Determining a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in the memory in the kernel to be repaired, the preset vulnerability repair instruction being generated based on compiling the preset vulnerability repair code ;

Based on the memory address, configure the address of the kernel symbol required by the default vulnerability repair instruction to call the kernel function or variable;

Determining a storage space of a preset vulnerability repair instruction configured to load an address of a kernel symbol required for a preset vulnerability repair instruction in the kernel to be repaired;

Loading the preset vulnerability repair instruction in the storage space to repair the vulnerability in the repair kernel.
A non-volatile computer storage medium storing computer readable instructions executable by a processor, the processor executing a kernel vulnerability repair method when the computer readable instructions are executed by a processor , the method includes:

Determining a memory function of a kernel function or a variable indicated by a kernel symbol in a preset vulnerability repair instruction to be loaded in the memory in the kernel to be repaired, the preset vulnerability repair instruction being generated based on compiling the preset vulnerability repair code ;

Based on the memory address, configure the address of the kernel symbol required by the default vulnerability repair instruction to call the kernel function or variable;

Determining a storage space of a preset vulnerability repair instruction configured to load an address of a kernel symbol required for a preset vulnerability repair instruction in the kernel to be repaired;

Loading the preset vulnerability repair instruction in the storage space to repair the vulnerability in the repair kernel.