{"id":112031,"date":"2023-12-06T21:10:26","date_gmt":"2023-12-06T19:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati"},"modified":"2023-12-06T21:10:26","modified_gmt":"2023-12-06T19:10:26","slug":"slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","title":{"rendered":"SLAM \u2014 \u00fatok na CPU Intel, AMD a ARM, kter\u00fd umo\u017e\u0148uje zjistit obsah pam\u011bti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z Amsterdamsk\u00e9 svobodn\u00e9 univerzity p\u0159edstavila novou techniku \u00fatoku SLAM (Spectre Linear Address Masking), kter\u00e1 nab\u00edz\u00ed nov\u00fd zp\u016fsob, jak vyu\u017e\u00edvat mikroarchitektonick\u00e9 zranitelnosti t\u0159\u00eddy Spectre, p\u0159i kter\u00fdch doch\u00e1z\u00ed k \u00faniku dat b\u011bhem translace nekonven\u010dn\u00edch adres. K obch\u00e1zen\u00ed kontrol konven\u010dnosti jsou vyu\u017e\u00edv\u00e1ny roz\u0161\u00ed\u0159en\u00ed pro maskov\u00e1n\u00ed liniov\u00fdch adres, kter\u00e1 jsou nov\u011b k dispozici v procesorech. V\u00fdzkumn\u00edci zve\u0159ejnili n\u00e1stroj s implementac\u00ed t\u00e9to metody a navrhli demonstraci, kter\u00e1 ukazuje, jak lze b\u011bhem n\u011bkolika des\u00edtek sekund extrahovat z pam\u011bti j\u00e1dra data odpov\u00eddaj\u00edc\u00ed ur\u010dit\u00e9 masce (bylo prok\u00e1z\u00e1no, jak v Ubuntu extrahovat z pam\u011bti j\u00e1dra \u0159et\u011bzec s hash hodnotou hesla u\u017eivatele root).

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

\u00datok m\u016f\u017ee b\u00fdt proveden na syst\u00e9mech s procesory Intel, kter\u00e9 podporuj\u00ed roz\u0161\u00ed\u0159en\u00ed LAM (Linear Address Masking), procesory AMD s roz\u0161\u00ed\u0159en\u00edm UAI (Upper Address Ignore) a procesory ARM s roz\u0161\u00ed\u0159en\u00edm TBI (Top Byte Ignore). Tato roz\u0161\u00ed\u0159en\u00ed umo\u017e\u0148uj\u00ed pou\u017e\u00edvat \u010d\u00e1st bit\u016f 64bitov\u00fdch ukazatel\u016f pro ukl\u00e1d\u00e1n\u00ed metadat nesouvisej\u00edc\u00edch s adresov\u00e1n\u00edm (pro b\u011b\u017en\u00e9 programy nen\u00ed t\u0159eba tolik pam\u011bti, tak\u017ee mohou adresovat 64bitov\u00e9 ukazatele, a proto mohou b\u00fdt horn\u00ed bity vy\u010dlen\u011bny nap\u0159\u00edklad pro zabezpe\u010dovac\u00ed kontroly). Zaj\u00edmav\u00e9 je, \u017ee procesory Intel, AMD a ARM, kter\u00e9 podporuj\u00ed LAM, UAI a TBI, byly teprve ozn\u00e1meny, ale je\u0161t\u011b nejsou v masov\u00e9 v\u00fdrob\u011b, co\u017e \u010din\u00ed SLAM prvn\u00edm spekulativn\u00edm \u00fatokem na budouc\u00ed CPU. \u00datok lze tak\u00e9 prov\u00e9st na star\u00fdch CPU AMD Zen+ a Zen 2, kter\u00e9 jsou zraniteln\u00e9 v\u016f\u010di CVE-2020-12965. <\/p>\n

Podobn\u011b jako u vyu\u017eit\u00ed zranitelnost\u00ed Spectre vy\u017eaduje proveden\u00ed \u00fatoku SLAM p\u0159\u00edtomnost ur\u010dit\u00fdch sekvenc\u00ed instrukc\u00ed (gadgets) v j\u00e1dru, kter\u00e9 vedou ke spekulativn\u00edmu vykon\u00e1v\u00e1n\u00ed instrukc\u00ed. Takov\u00e9 instrukce vedou k spekulativn\u00edmu \u010dten\u00ed dat z pam\u011bti v z\u00e1vislosti na vn\u011bj\u0161\u00edch podm\u00ednk\u00e1ch, na kter\u00e9 m\u016f\u017ee \u00fato\u010dn\u00edk m\u00edt vliv. Pot\u00e9, co je stanoveno chybn\u00fd odhad, je v\u00fdsledek spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed odm\u00edtnut, av\u0161ak zpracovan\u00e1 data z\u016fst\u00e1vaj\u00ed v cache a mohou b\u00fdt pot\u00e9 z\u00edsk\u00e1na pomoc\u00ed anal\u00fdzy p\u0159es extern\u00ed kan\u00e1ly. Pro z\u00edsk\u00e1n\u00ed dat ulo\u017een\u00fdch v cache vyu\u017e\u00edvaj\u00ed v\u00fdzkumn\u00edci metodu Evict+Reload, kter\u00e1 se zakl\u00e1d\u00e1 na vytv\u00e1\u0159en\u00ed podm\u00ednek pro vy\u0159azen\u00ed dat z cache (nap\u0159\u00edklad se vytv\u00e1\u0159\u00ed aktivita, kter\u00e1 rovnom\u011brn\u011b zapl\u0148uje cache typick\u00fdm obsahem) a prov\u00e1d\u011bn\u00ed operac\u00ed, jejich\u017e doba prov\u00e1d\u011bn\u00ed umo\u017e\u0148uje usuzovat na p\u0159\u00edtomnost dat v procesorov\u00e9 cache. <\/p>\n

Pro proveden\u00ed SLAM \u00fatoku se pou\u017e\u00edvaj\u00ed za\u0159\u00edzen\u00ed na z\u00e1klad\u011b k\u00f3du, kde jsou \u00fadaje ovl\u00e1dan\u00e9 \u00fato\u010dn\u00edkem (n\u00ed\u017ee prom\u011bnn\u00e1 «secret») pou\u017eity jako ukazatel. Nap\u0159\u00edklad: void unmasked_gadget(long **secret) { **secret; } <\/p>\n

Je pozorov\u00e1no, \u017ee podobn\u00e9 vzory k\u00f3du se \u010dasto pou\u017e\u00edvaj\u00ed v programech, nap\u0159\u00edklad v j\u00e1d\u0159e Linux bylo odhaleno des\u00edtky tis\u00edc takov\u00fdch gadgets, z nich\u017e alespo\u0148 n\u011bkolik set je vhodn\u00fdch k pou\u017eit\u00ed v exploitech. \u00danik lze zablokovat p\u0159id\u00e1n\u00edm dal\u0161\u00edch instrukc\u00ed do takov\u00fdch gadgets, kter\u00e9 blokuj\u00ed spekulativn\u00ed vykon\u00e1v\u00e1n\u00ed. Spole\u010dnost Intel pl\u00e1nuje poskytnout programovou metodu blokov\u00e1n\u00ed \u00faniku p\u0159ed zah\u00e1jen\u00edm dod\u00e1vek procesor\u016f s podporou LAM. Spole\u010dnost AMD doporu\u010dila pou\u017e\u00edvat existuj\u00edc\u00ed metody blokov\u00e1n\u00ed \u00fatok\u016f t\u0159\u00eddy Spectre v2. V\u00fdvoj\u00e1\u0159i j\u00e1dra Linux se rozhodli pro ochranu p\u0159ed \u00fatokem ve v\u00fdchoz\u00edm nastaven\u00ed vypnout podporu LAM do publikov\u00e1n\u00ed doporu\u010den\u00ed spole\u010dnosti Intel k blokov\u00e1n\u00ed zranitelnosti.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u043d\u0435\u043a\u0430\u043d\u043e\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u043a\u0430\u043d\u043e\u043d\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0432 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043b\u0438\u043d\u0435\u0439\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0442\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112031","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SLAM \u2014 \u00fatok na CPU Intel, AMD a ARM, kter\u00fd umo\u017e\u0148uje zjistit obsah pam\u011bti | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Amsterdamsk\u00e9 svobodn\u00e9 univerzity p\u0159edstavila novou techniku \u00fatoku SLAM (Spectre Linear Address Masking), kter\u00e1 nab\u00edz\u00ed nov\u00fd zp\u016fsob vyu\u017eit\u00ed mikroarchitektonick\u00fdch zranitelnost\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SLAM \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 CPU Intel, AMD \u0438 ARM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-06T19:10:26+00:00","article:modified_time":"2023-12-06T19:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=112031"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112031\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=112031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=112031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=112031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}