[ °ø Áö ] ¸®´ª½º Ä¿³Î ·ÎÄà ±ÇÇÑ »ó½Â Ãë¾àÁ¡ º¸¾È ¾÷µ¥ÀÌÆ® ±Ç°í 2016-12-12

¾È³çÇϽʴϱî. È£½ºÆ®¸ÕÆ®ÀÔ´Ï´Ù.

¸ÕÀú È£½ºÆ®¸ÕÆ®¸¦ ¾Æ²¸ÁÖ½Ã°í »ç¶ûÇØ Áֽô °í°´ ¿©·¯ºÐ²²  Áø½ÉÀ¸·Î °¨»çµå¸®¸ç

¸®´ª½º Ä¿³Î ·ÎÄà ±ÇÇÑ »ó½Â Ãë¾àÁ¡ º¸¾È ¾÷µ¥ÀÌÆ® ±Ç°í°¡ ÀÖ¾î À̸¦ ¾Ë·Áµå¸®°íÀÚ ÇÕ´Ï´Ù.

---------------------------------------------------------------------------

¡à °³¿ä
o ¸®´ª½º Ä¿³ÎÀÇ af_packet¿¡¼­ Race conditionÀ» ¾Ç¿ëÇØ ±ÇÇÑÀÌ ¾ø´Â ·ÎÄà »ç¿ëÀÚ°¡ ·çÆ® ±ÇÇÑÀ» ¾òµµ·Ï Çã¿ëÇÏ´Â Ãë¾àÁ¡
    (CVE-2016-8655)¹ß°ß[1]
  o ÇØ´ç Ãë¾àÁ¡¿¡ ¿µÇâÀ» ¹Þ´Â ¹öÀü »ç¿ëÀÚ´Â Àΰ¡µÇÁö ¾ÊÀº »ç¿ëÀÚ°¡ ·çÆ® ±ÇÇÑÀ» ȹµæÇÒ ¼ö ÀÖÀ¸¹Ç·Î ÇØ°á¹æ¾È¿¡ µû¶ó ÃֽŹöÀüÀ¸·Î
    ¾÷µ¥ÀÌÆ® ±Ç°í

¡à ÇØ´ç ½Ã½ºÅÛ
o ¿µÇâÀ» ¹Þ´Â ¼ÒÇÁÆ®¿þ¾î
  - Linux Kernel 4.8.12 ÀÌÀü ¹öÀüÀ» »ç¿ëÇÏ´Â ½Ã½ºÅÛ

¡à ÇØ°á ¹æ¾È
o ÇØ´ç Ãë¾àÁ¡¿¡ ÇØ´çµÇ´Â Ä¿³Î ¹öÀü »ç¿ëÀÚ´Â ÃֽŠ¹öÀüÀ¸·Î ¾÷µ¥ÀÌÆ® ¼öÇà [2]
  o º¸¾È ¾÷µ¥ÀÌÆ®°¡ °ø°³µÈ ¿î¿µÃ¼Á¦¸¦ ¿î¿µÇÏ°í ÀÖÀ» °æ¿ì, Âü°í »çÀÌÆ®ÀÇ ³»¿ëÀ» ÂüÁ¶ÇÏ¿© º¸¾È ¾÷µ¥ÀÌÆ® ¼öÇà
  - Debian [3]
   - Ubuntu [4]
   - Red Hat [5]
   - SUSE/openSUSE [6]
   - Fedora [7]
   - CoreOS [8]
  
¡à ¿ë¾î Á¤¸®
o ·¹À̽º ÄÁµð¼Ç(Race Condition) : ÇÁ·Î¼¼½ºµéÀÌ ¿©·¯ ¹ø ½ÇÇàµÇ´Â °úÁ¤¿¡¼­ ½ÇÇà ¼ø¼­°¡ µÚ¹Ù²î¾î °ø°ÝÀÚ°¡ ¿øÇÏ´Â °á°ú¸¦ ¾ò¾î³»´Â °ø°Ý ±â¹ý

¡à ±âŸ ¹®ÀÇ»çÇ×
o Çѱ¹ÀÎÅͳÝÁøÈï¿ø ÀÎÅͳÝħÇØ´ëÀÀ¼¾ÅÍ: ±¹¹ø¾øÀÌ 118

[Âü°í»çÀÌÆ®]
[1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8655
[2] https://www.kernel.org/
[3] https://security-tracker.debian.org/tracker/CVE-2016-8655
[4] https://www.ubuntu.com/usn/usn-3152-2/
[5] https://access.redhat.com/security/cve/CVE-2016-8655
[6] https://www.suse.com/security/cve/CVE-2016-8655.html
[7] https://bugzilla.redhat.com/show_bug.cgi?id=1401820
[8] https://coreos.com/releases/


°¨»çÇÕ´Ï´Ù.

---------------------------------------------------------------------------

                    Áñ°Å¿òÀÌ Àִ ȣ½ºÆà ¼­ºñ½º  [ È£½ºÆ®¸ÕÆ® ]