{"id":107877,"date":"2023-04-16T12:48:13","date_gmt":"2023-04-16T10:48:13","guid":{"rendered":"https:\/\/prohoster.info\/?p=107877"},"modified":"2023-04-17T17:50:38","modified_gmt":"2023-04-17T15:50:38","slug":"uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","title":{"rendered":"Zranitelnost v j\u00e1dru Linux 6.2, kter\u00e1 umo\u017e\u0148uje obej\u00edt ochranu proti \u00fatok\u016fm Spectre v2.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V j\u00e1dru Linux 6.2 byla zji\u0161t\u011bna zranitelnost (CVE-2023-1998), kter\u00e1 deaktivuje ochranu proti \u00fatok\u016fm typu Spectre v2, co\u017e umo\u017e\u0148uje p\u0159\u00edstup k pam\u011bti jin\u00fdch proces\u016f b\u011b\u017e\u00edc\u00edch v r\u016fzn\u00fdch vl\u00e1knech SMT nebo Hyper Threading na jednom fyzick\u00e9m j\u00e1dru procesoru. Tato zranitelnost m\u016f\u017ee b\u00fdt mimo jin\u00e9 vyu\u017eita k organizaci \u00faniku dat mezi virtu\u00e1ln\u00edmi stroji v cloudov\u00fdch syst\u00e9mech. Probl\u00e9m se t\u00fdk\u00e1 pouze j\u00e1dra Linux 6.2 a je zp\u016fsoben nespr\u00e1vnou implementac\u00ed optimalizac\u00ed, kter\u00e9 m\u011bly sn\u00ed\u017eit v\u00fdznamn\u00e9 n\u00e1klady spojen\u00e9 s ochranou proti Spectre v2. Zranitelnost byla odstran\u011bna v experiment\u00e1ln\u00ed v\u011btvi j\u00e1dra Linux 6.3. <\/p>\n

Ve vrstv\u011b u\u017eivatelsk\u00e9ho prostoru mohou procesy za \u00fa\u010delem ochrany p\u0159ed \u00fatoky typu Spectre selektivn\u011b deaktivovat spekulativn\u00ed vykon\u00e1v\u00e1n\u00ed instrukc\u00ed pomoc\u00ed prctl PR_SET_SPECULATION_CTRL nebo pou\u017e\u00edt filtrov\u00e1n\u00ed syst\u00e9mov\u00fdch vol\u00e1n\u00ed na z\u00e1klad\u011b mechanismu seccomp. Podle v\u00fdzkumn\u00edk\u016f, kte\u0159\u00ed probl\u00e9m odhalili, nespr\u00e1vn\u00e1 optimalizace v j\u00e1dru 6.2 zanechala bez dostate\u010dn\u00e9 ochrany virtu\u00e1ln\u00ed stroje<\/a> alespo\u0148 jednoho velk\u00e9ho poskytovatele cloudu, i p\u0159es aktivaci re\u017eimu blokov\u00e1n\u00ed \u00fatok\u016f spectre-BTI prost\u0159ednictv\u00edm prctl. Zranitelnost se tak\u00e9 projevuje na b\u011b\u017en\u00fdch serverech<\/a> s j\u00e1drem 6.2, p\u0159i jejich na\u010d\u00edt\u00e1n\u00ed se pou\u017e\u00edv\u00e1 nastaven\u00ed «spectre_v2=ibrs. <\/p>\n

Podstatou zranitelnosti je, \u017ee p\u0159i v\u00fdb\u011bru re\u017eim\u016f ochrany IBRS nebo eIBRS zaveden\u00e9 optimalizace deaktivovaly pou\u017eit\u00ed mechanismu STIBP (Single Thread Indirect Branch Predictors), nezbytn\u00e9ho pro blokaci \u00fanik\u016f p\u0159i pou\u017eit\u00ed technologie sou\u010dasn\u00e9ho v\u00edcevl\u00e1kn\u011bn\u00ed (SMT nebo Hyper-Threading). Ochranu proti \u00faniku mezi vl\u00e1kny zaji\u0161\u0165uje pouze re\u017eim eIBRS, nikoli re\u017eim IBRS, proto\u017ee v tomto p\u0159\u00edpad\u011b je bit IBRS, kter\u00fd zaji\u0161\u0165uje ochranu p\u0159ed \u00faniky mezi logick\u00fdmi j\u00e1dry, z d\u016fvodu v\u00fdkonnosti vymaz\u00e1n p\u0159i n\u00e1vratu \u0159\u00edd\u00edc\u00edho p\u0159\u00edstupu do u\u017eivatelsk\u00e9ho prostoru, co\u017e \u010din\u00ed vl\u00e1kna v u\u017eivatelsk\u00e9m prostoru nechr\u00e1n\u011bn\u00e1 v\u016f\u010di \u00fatok\u016fm typu Spectre v2.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper Threading, \u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u044f\u0434\u0440\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0442\u0435\u0447\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107877","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v j\u00e1dru Linux 6.2, kter\u00e1 umo\u017e\u0148uje obej\u00edt ochranu proti \u00fatok\u016fm Spectre v2 | ProHoster","description":"V j\u00e1dru Linux 6.2 byla zji\u0161t\u011bna zranitelnost (CVE-2023-1998), kter\u00e1 deaktivuje ochranu proti \u00fatok\u016fm typu Spectre v2, co\u017e umo\u017e\u0148uje p\u0159\u00edstup k pam\u011bti jin\u00fdch proces\u016f b\u011b\u017e\u00edc\u00edch v r\u016fzn\u00fdch vl\u00e1knech SMT nebo Hyper.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux 6.2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0430\u0442\u0430\u043a Spectre v2 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-16T10:48:13+00:00","article:modified_time":"2023-04-17T15:50:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/107877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=107877"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/107877\/revisions"}],"predecessor-version":[{"id":164434,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/107877\/revisions\/164434"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=107877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=107877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=107877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}