{"id":103200,"date":"2022-02-06T03:36:58","date_gmt":"2022-02-06T01:37:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostupen-kasper-skaner-problem-so-spekulyativnym-vypolneniem-koda-v-yadre-linux"},"modified":"2022-02-06T03:36:58","modified_gmt":"2022-02-06T01:37:00","slug":"dostupen-kasper-skaner-problem-so-spekulyativnym-vypolneniem-koda-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/dostupen-kasper-skaner-problem-so-spekulyativnym-vypolneniem-koda-v-yadre-linux","title":{"rendered":"Kasper, skener probl\u00e9m\u016f se spekulativn\u00edm vykon\u00e1v\u00e1n\u00edm k\u00f3du v j\u00e1d\u0159e Linux, je k dispozici","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Skupina v\u00fdzkumn\u00edk\u016f z Amsterdamsk\u00e9 svobodn\u00e9 univerzity publikovala n\u00e1stroj Kasper, kter\u00fd je ur\u010den k odhalov\u00e1n\u00ed v j\u00e1d\u0159e Linux \u00fatr\u017ek\u016f k\u00f3du, kter\u00e9 mohou b\u00fdt pou\u017eity k exploitaci zranitelnost\u00ed t\u0159\u00eddy Spectre, zp\u016fsoben\u00fdch spekulativn\u00edm vykon\u00e1v\u00e1n\u00edm k\u00f3du procesorem. Zdroje n\u00e1stroje jsou distribuov\u00e1ny pod licenc\u00ed Apache 2.0. <\/p>\n
P\u0159ipome\u0148me, \u017ee pro prov\u00e1d\u011bn\u00ed takov\u00fdch \u00fatok\u016f, jako je Spectre v1, kter\u00e9 umo\u017e\u0148uj\u00ed zjistit obsah pam\u011bti, je vy\u017eadov\u00e1na p\u0159\u00edtomnost ur\u010dit\u00e9 sekvence p\u0159\u00edkaz\u016f (gadgets) v privilegovan\u00e9m k\u00f3du, kter\u00e1 vede k spekulativn\u00edmu vykon\u00e1v\u00e1n\u00ed instrukc\u00ed. Za \u00fa\u010delem optimalizace za\u010d\u00edn\u00e1 procesor vykon\u00e1vat podobn\u00e9 gadgets v spekulativn\u00edm re\u017eimu, pot\u00e9 zjist\u00ed, \u017ee p\u0159edpov\u011b\u010f v\u011btven\u00ed byla ne\u00fasp\u011b\u0161n\u00e1, a vrac\u00ed operace do p\u016fvodn\u00edho stavu, ale data zpracovan\u00e1 b\u011bhem spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed z\u016fst\u00e1vaj\u00ed v cache a mikroarchitektonick\u00fdch bufferech a jsou dostupn\u00e1 pro extrakci pomoc\u00ed r\u016fzn\u00fdch metod ur\u010den\u00ed zbytkov\u00fdch dat prost\u0159ednictv\u00edm bo\u010dn\u00edch kan\u00e1l\u016f. <\/p>\n
D\u0159\u00edve dostupn\u00e9 n\u00e1stroje pro skenov\u00e1n\u00ed gadgets pro zranitelnost Spectre, zalo\u017een\u00e9 na hled\u00e1n\u00ed typov\u00fdch \u0161ablon, vykazovaly velmi vysokou \u00farove\u0148 fale\u0161n\u00fdch pozitiv, p\u0159i\u010dem\u017e p\u0159itom mnoh\u00e9 skute\u010dn\u00e9 gadgets z\u016fstaly p\u0159ehl\u00e9dnuty (experimenty uk\u00e1zaly, \u017ee 99 % odhalen\u00fdch takov\u00fdmi n\u00e1stroji gadgets nemohlo b\u00fdt pou\u017eito k \u00fatok\u016fm a 33 % pracovn\u00edch gadgets, kter\u00e9 mohly v\u00e9st k \u00fatoku, nebylo zaznamen\u00e1no). <\/p>\n
Aby se zv\u00fd\u0161ila kvalita identifikace probl\u00e9mov\u00fdch za\u0159\u00edzen\u00ed, Kasper modeluje zranitelnosti, kter\u00e9 m\u016f\u017ee \u00fato\u010dn\u00edk vyu\u017e\u00edt v ka\u017ed\u00e9m kroku p\u0159i prov\u00e1d\u011bn\u00ed \u00fatok\u016f t\u0159\u00eddy Spectre \u2014 modeluj\u00ed se probl\u00e9my, kter\u00e9 umo\u017e\u0148uj\u00ed kontrolovat data (nap\u0159\u00edklad vlo\u017een\u00ed dat \u00fato\u010dn\u00edka do mikroarchitektonick\u00fdch struktur za \u00fa\u010delem ovlivn\u011bn\u00ed n\u00e1sledn\u00e9ho spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed pomoc\u00ed \u00fatok\u016f t\u0159\u00eddy LVI), z\u00edskat p\u0159\u00edstup k citliv\u00fdm informac\u00edm (nap\u0159\u00edklad p\u0159i p\u0159ekro\u010den\u00ed hranic vyrovn\u00e1vac\u00ed pam\u011bti nebo pou\u017eit\u00ed pam\u011bti po jej\u00edm uvoln\u011bn\u00ed) a organizovat \u00fanik citliv\u00fdch informac\u00ed (nap\u0159\u00edklad anal\u00fdzou stavu procesorov\u00e9 cache nebo pou\u017eit\u00edm metody MDS).
<\/center> <\/p>\n
P\u0159i testov\u00e1n\u00ed se j\u00e1dro spojuje s runtime knihovnami Kasper a kontrolami, kter\u00e9 funguj\u00ed na \u00farovni LLVM. V r\u00e1mci kontroly doch\u00e1z\u00ed k emulaci spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed k\u00f3du, realizovan\u00e9 pomoc\u00ed mechanismu checkpoint-restore, kter\u00fd speci\u00e1ln\u011b vykon\u00e1v\u00e1 nespr\u00e1vn\u011b p\u0159edpov\u011bzenou v\u011btev k\u00f3du a pot\u00e9 se vrac\u00ed do v\u00fdchoz\u00edho stavu p\u0159ed v\u011btven\u00edm. Kasper se tak\u00e9 sna\u017e\u00ed modelovat r\u016fzn\u00e9 softwarov\u00e9 a hardwarov\u00e9 zranitelnosti, anal\u00fdzou dopad\u016f architektonick\u00fdch a mikroarchitektonick\u00fdch efekt\u016f, a prov\u00e1d\u00ed fuzzingov\u00e9 testov\u00e1n\u00ed mo\u017en\u00fdch \u00fatok\u016f. Pro anal\u00fdzu tok\u016f vykon\u00e1v\u00e1n\u00ed se pou\u017e\u00edv\u00e1 port DataFlowSanitizer pro j\u00e1dro Linuxu, a pro fuzzingov\u00e9 testov\u00e1n\u00ed modifikovan\u00e1 verze bal\u00ed\u010dku syzkaller.
<\/center> <\/p>\n
B\u011bhem skenov\u00e1n\u00ed j\u00e1dra Linux pomoc\u00ed Kasperu bylo odhaleno 1379 dosud nezn\u00e1m\u00fdch gadget\u016f, kter\u00e9 potenci\u00e1ln\u011b vedou k \u00faniku dat b\u011bhem spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed instrukc\u00ed. Je poznamen\u00e1no, \u017ee jen \u010d\u00e1st z nich m\u016f\u017ee p\u0159edstavovat skute\u010dn\u00e9 probl\u00e9my, ale pro demonstraci toho, \u017ee existuje skute\u010dn\u00e9 nebezpe\u010d\u00ed, a ne jen teoretick\u00e9, byl vyvinut funk\u010dn\u00ed prototyp exploit pro jeden z problematick\u00fdch fragment\u016f k\u00f3du, kter\u00fd vede k \u00faniku informac\u00ed z pam\u011bti j\u00e1dra. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Kasper,](\"\/wp-content\/uploads\/2022\/02\/3a6cbda67cad6223d91f3ba63d4c1477.jpg\")
<\/center> <\/p>\n![\"Kasper,](\"\/wp-content\/uploads\/2022\/02\/7717c28239ef47fa49b36c3088759185.jpg\")
<\/center> <\/p>\n