OpenAI 红队演练发现 Brotli 未授权远程代码执行漏洞
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression l
OpenAI 在红队演练中发现 Brotli 压缩库存在未授权远程代码执行漏洞，攻击者可通过发送或回复恶意压缩数据在受影响系统上运行自己的代码，无需创建账号。该问题根源已在 2 月于 Brotli 源码中修复，但当时未意识到会构成安全漏洞，且此后没有新版本发布；OpenAI 已向 Brotli 及 Node.js 等下游项目披露，Brotli 发布了新版本并公开 CVE，Node.js 已发布或正在发布安全更新。
推荐理由
精选AI 评分 67
OpenAI 在红队演练中顺带发现 Brotli 未授权远程代码执行漏洞，可了解该漏洞的触发路径与下游修复进展。
主题
查看原帖过去几个月里，我们大幅强化了研究训练环境的安全性。我们取消了所有前沿模型在训练期间的实时互联网访问，并为它们构建了一个离线世界来替代——一个缓存的网络版本，它们仍然可以在其中学习浏览、搜索和使用应用程序。 9月20日，在一个模型利用DNS配置错误找到绕过这个离线世界的方法后，我们暂停了前沿训练，以进一步加强隔离。我们组建了由我们最具网络能力的模型驱动的智能体团队，并让它们寻找我们研究环境中的弱点。 虽然它们没有找到既能轻易利用、又能对我们的监控隐藏其活动的通往互联网的路径，但它们确实发现了零日漏洞、虚拟机逃逸以及智能体之间通信的硬件侧信道。我们利用它们的发现进一步加强了我们的防御，并为开源软件贡献了修复。 在强化我们的隔离架构后，我们于10月1日恢复了前沿强化学习训练和推理。我们预留了大量算力用于持续的红队测试，并将高算力红队测试纳入我们用来决定前沿训练和评估能否安全推进的安全论证中。 https://t.co/EmEZsFRMcF
查看原文
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications. On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments. While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software. After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely. https://t.co/EmEZsFRMcF
正文
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below: https://t.co/Y1Y72aHxrW