Byla odhalena informace o zranitelnosti (CVE-2021-33164) ve firmwaru UEFI, kter\u00e1 umo\u017e\u0148uje vykon\u00e1n\u00ed k\u00f3du na \u00farovni SMM (System Management Mode), prioritn\u011b vy\u0161\u0161\u00ed ne\u017e hypervizor a nulov\u00fd ochrann\u00fd kruh, a poskytuje neomezen\u00fd p\u0159\u00edstup k cel\u00e9 syst\u00e9mov\u00e9 pam\u011bti. Zranitelnost, kter\u00e1 byla ozna\u010dena k\u00f3dov\u00fdm jm\u00e9nem RingHopper, souvis\u00ed s mo\u017enost\u00ed proveden\u00ed \u010dasov\u00e9ho \u00fatoku pomoc\u00ed DMA (Direct Memory Access) pro po\u0161kozen\u00ed pam\u011bti v k\u00f3du vykon\u00e1van\u00e9m na \u00farovni SMM. P\u0159\u00edtomnost zranitelnosti byla potvrzena ve firmwaru Intel, Dell a Insyde Software (tvrd\u00ed se, \u017ee probl\u00e9m se t\u00fdk\u00e1 8 v\u00fdrobc\u016f, ale zb\u00fdvaj\u00edc\u00edch 5 zat\u00edm nebylo odhaleno). Firmwary AMD, Phoenix a Toshiba t\u00e9to probl\u00e9mu nepodl\u00e9haj\u00ed. <\/p>\n
Exploatace zranitelnost\u00ed m\u016f\u017ee b\u00fdt provedena z opera\u010dn\u00edho syst\u00e9mu, vyu\u017e\u00edvaj\u00edc\u00ed zraniteln\u00e9 obslu\u017en\u00e9 programy SMI (System Management Interrupt), pro jejich\u017e p\u0159\u00edstup jsou vy\u017eadov\u00e1na administr\u00e1torsk\u00e1 pr\u00e1va. \u00datok m\u016f\u017ee b\u00fdt tak\u00e9 proveden za p\u0159\u00edtomnosti fyzick\u00e9ho p\u0159\u00edstupu na po\u010d\u00e1tku spu\u0161t\u011bn\u00ed, v f\u00e1zi p\u0159ed inicializac\u00ed opera\u010dn\u00edho syst\u00e9mu. Pro blokaci probl\u00e9mu se doporu\u010duje u\u017eivatel\u016fm Linuxu aktualizovat firmware pomoc\u00ed slu\u017eby LVFS (Linux Vendor Firmware Service) prost\u0159ednictv\u00edm n\u00e1stroje fwupdmgr (fwupdmgr get-updates; fwupdmgr update) z bal\u00ed\u010dku fwupd. <\/p>\n
Nutnost m\u00edt administr\u00e1torsk\u00e1 pr\u00e1va pro proveden\u00ed \u00fatoku omezuje nebezpe\u010dnost probl\u00e9mu, ale nebr\u00e1n\u00ed jeho vyu\u017eit\u00ed jako zranitelnosti druh\u00e9ho stupn\u011b, pro udr\u017een\u00ed si p\u0159\u00edstupu po exploitaci jin\u00fdch zranitelnost\u00ed v syst\u00e9mu nebo pou\u017eit\u00ed metod soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed. P\u0159\u00edstup k SMM (Ring -2) umo\u017e\u0148uje vykon\u00e1n\u00ed k\u00f3du na \u00farovni, kter\u00e1 nen\u00ed pod kontrolou opera\u010dn\u00edho syst\u00e9mu, co\u017e m\u016f\u017ee b\u00fdt vyu\u017eito pro modifikaci firmware a um\u00edst\u011bn\u00ed skryt\u00e9ho \u0161kodliv\u00e9ho k\u00f3du nebo rootkit\u016f do SPI Flash, kter\u00e9 nejsou detekov\u00e1ny opera\u010dn\u00edm syst\u00e9mem, a tak\u00e9 pro deaktivaci verifikace p\u0159i spu\u0161t\u011bn\u00ed (UEFI Secure Boot, Intel BootGuard) a \u00fatoky na hypervizory za \u00fa\u010delem obejit\u00ed mechanism\u016f kontroly integrity virtu\u00e1ln\u00edch prost\u0159ed\u00ed. <\/p>\n
Probl\u00e9m je zp\u016fsoben z\u00e1vodem stav\u016f v obslu\u017en\u00e9 rutin\u011b SMI (System Management Interrupt), kter\u00fd nast\u00e1v\u00e1 v okam\u017eiku mezi kontrolou p\u0159\u00edstupu a p\u0159\u00edstupem k SMRAM. Pro ur\u010den\u00ed spr\u00e1vn\u00e9ho okam\u017eiku mezi kontrolou stavu a pou\u017eit\u00edm v\u00fdsledku kontroly lze pou\u017e\u00edt anal\u00fdzu pomoc\u00ed DMA p\u0159es vedlej\u0161\u00ed kan\u00e1ly. V d\u016fsledku asynchronn\u00ed povahy p\u0159\u00edstupu k SMRAM p\u0159es DMA m\u016f\u017ee \u00fato\u010dn\u00edk ur\u010dit spr\u00e1vn\u00fd okam\u017eik a p\u0159epsat obsah SMRAM pomoc\u00ed DMA, obej\u00edt tak API obslu\u017en\u00e9 rutiny SMI. Procesory podporuj\u00edc\u00ed mechanismy Intel-VT a Intel VT-d obsahuj\u00ed ochranu proti DMA \u00fatok\u016fm, zalo\u017eenou na pou\u017eit\u00ed IOMMU (Input-Output Memory Management Unit), ale tato ochrana je \u00fa\u010dinn\u00e1 pouze p\u0159i blokov\u00e1n\u00ed hardwarov\u00fdch DMA \u00fatok\u016f prov\u00e1d\u011bn\u00fdch pomoc\u00ed za\u0159\u00edzen\u00ed p\u0159ipraven\u00fdch \u00fato\u010dn\u00edkem a nechr\u00e1n\u00ed p\u0159ed \u00fatoky prost\u0159ednictv\u00edm obslu\u017en\u00fdch rutin SMI. \u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105506","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v UEFI firmwarech, kter\u00e1 umo\u017e\u0148uje spustit k\u00f3d na \u00farovni SMM | ProHoster","description":"Byly zve\u0159ejn\u011bny informace o zranitelnosti (CVE-2021-33164) v UEFI firmwarech, kter\u00e1 umo\u017e\u0148uje spustit k\u00f3d na \u00farovni SMM (System Management Mode), prioritn\u011bj\u0161\u00edm ne\u017e hypervizor a nulov\u00e9 ochrann\u00e9 krou\u017eky.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-09T01:36:39+00:00","article:modified_time":"2022-11-09T01:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=105506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=105506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=105506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=105506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"