{"id":116613,"date":"2024-06-18T12:05:50","date_gmt":"2024-06-18T10:05:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag"},"modified":"2024-06-18T12:05:50","modified_gmt":"2024-06-18T10:05:50","slug":"tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","title":{"rendered":"TikTag \u2014 \u00fatok na mechanismus spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed v CPU ARM, kter\u00fd umo\u017e\u0148uje obej\u00edt ochranu MemTag","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f ze Soulu a spole\u010dnosti Samsung vyvinula techniku \u00fatoku na procesory ARM s k\u00f3dov\u00fdm ozna\u010den\u00edm TikTag, kter\u00e1 m\u016f\u017ee b\u00fdt pou\u017eita k obch\u00e1zen\u00ed hardwarov\u00e9ho ochrann\u00e9ho mechanismu MemTag (MTE, Memory Tagging Extension), jen\u017e je p\u0159\u00edtomen v \u010dipech postaven\u00fdch na architektu\u0159e ARMv8.5-A. \u00datok umo\u017e\u0148uje ur\u010dov\u00e1n\u00ed obsahu tag\u016f TikTag pro libovoln\u00e9 adresy v pam\u011bti d\u00edky \u00fanik\u016fm dat, kter\u00e9 vznikaj\u00ed v d\u016fsledku spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed instrukc\u00ed CPU. <\/p>\n

Technologie MemTag umo\u017e\u0148uje p\u0159i\u0159azen\u00ed tag\u016f k oblastem v pam\u011bti a prov\u00e1d\u011bn\u00ed kontroly spr\u00e1vnosti pou\u017e\u00edv\u00e1n\u00ed ukazatel\u016f za \u00fa\u010delem zablokov\u00e1n\u00ed zneu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed zp\u016fsoben\u00fdch p\u0159\u00edstupem k ji\u017e uvoln\u011bn\u00fdm blok\u016fm pam\u011bti, p\u0159ete\u010den\u00edm bufferu a p\u0159\u00edstupem p\u0159ed inicializac\u00ed. P\u0159i pou\u017eit\u00ed MemTag je pro ka\u017ed\u00fdch 16 bajt\u016f fyzick\u00e9 pam\u011bti vytvo\u0159en 4-bitov\u00fd tag, kter\u00fd funguje jako kl\u00ed\u010d k p\u0159\u00edstupu k t\u00e9to pam\u011bti. Tag m\u016f\u017ee b\u00fdt generov\u00e1n aplikac\u00ed pro alokovanou oblast pam\u011bti pomoc\u00ed speci\u00e1ln\u00edch instrukc\u00ed CPU a pot\u00e9 ulo\u017een do horn\u00edch nepou\u017e\u00edvan\u00fdch bit\u016f ukazatele. P\u0159i p\u0159\u00edstupu k pam\u011bti s pou\u017eit\u00edm tagovan\u00e9ho ukazatele procesor kontroluje shodu tagu p\u0159i\u0159azen\u00e9ho k ukazateli s tagy p\u0159i\u0159azen\u00fdmi k blok\u016fm pam\u011bti a povoluje p\u0159\u00edstup pouze tehdy, pokud se tagy shoduj\u00ed. <\/p>\n

Navrhovan\u00e1 metoda \u00fatoku umo\u017e\u0148uje ur\u010dov\u00e1n\u00ed tag\u016f p\u0159i\u0159azen\u00fdch k blok\u016fm pam\u011bti a obch\u00e1zen\u00ed ochrany MemTag. V\u00fdzkumn\u00edci demonstrovali, \u017ee je mo\u017en\u00e9 prov\u00e9st \u00fatok TikTag p\u0159i exploitaci zranitelnost\u00ed v j\u00e1d\u0159e Linux a prohl\u00ed\u017ee\u010di Chrome, p\u0159i\u010dem\u017e vyu\u017e\u00edvaj\u00ed existuj\u00edc\u00ed sekvence instrukc\u00ed (gadgets), kter\u00e9 vedou k spekulativn\u00edmu vykon\u00e1v\u00e1n\u00ed k\u00f3du. Takov\u00e9 gad\u017eety p\u0159i vykon\u00e1v\u00e1n\u00ed v spekulativn\u00edm re\u017eimu k\u00f3du, kter\u00fd pracuje s ukazateli, vyvol\u00e1vaj\u00ed \u010dten\u00ed metadat MemTag v z\u00e1vislosti na extern\u00edch podm\u00ednk\u00e1ch, na kter\u00e9 m\u016f\u017ee \u00fato\u010dn\u00edk m\u00edt vliv. Po ur\u010den\u00ed chybn\u00fdch p\u0159edpoklad\u016f je v\u00fdsledek spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed odm\u00edtnut, av\u0161ak z\u00edskan\u00e1 data z\u016fst\u00e1vaj\u00ed v cache a mohou b\u00fdt pot\u00e9 vyta\u017eena pomoc\u00ed anal\u00fdzy prost\u0159ednictv\u00edm bo\u010dn\u00edch kan\u00e1l\u016f. Pravd\u011bpodobnost \u00fasp\u011b\u0161n\u00e9ho obch\u00e1zen\u00ed ochrany MemTag v proveden\u00fdch testech byla odhadnuta na 95 % p\u0159i prov\u00e1d\u011bn\u00ed \u00fatoku po dobu p\u0159ibli\u017en\u011b 4 sekund.<\/p>\n

\"TikTag<\/center><\/p>\n

Byly odhaleny dva typy gadget\u016f, kter\u00e9 vedou k \u00faniku informac\u00ed o taz\u00edch MemTag. V prvn\u00edm p\u0159\u00edpad\u011b doch\u00e1z\u00ed ke spekulativn\u00edmu vykon\u00e1v\u00e1n\u00ed v d\u016fsledku chybn\u00fdch predikc\u00ed skok\u016f, p\u0159i\u010dem\u017e podm\u00ednky pro vykon\u00e1v\u00e1n\u00ed gadgetu mohou b\u00fdt vytvo\u0159eny manipulacemi se syst\u00e9mov\u00fdmi vol\u00e1n\u00edmi. Ve druh\u00e9m p\u0159\u00edpad\u011b
\nSpekulativn\u00ed prov\u00e1d\u011bn\u00ed vznik\u00e1 z chybn\u00e9ho p\u0159edpov\u011bzen\u00ed vztahu mezi operacemi \u010dten\u00ed a z\u00e1pisu p\u0159i pou\u017eit\u00ed optimalizace STLF (Store-To-Load-Forwarding), co\u017e umo\u017e\u0148uje vybrat tag hodnocen\u00edm stavu cache (pokud se tag shoduje, hodnota bude p\u0159\u00edmo p\u0159esm\u011brov\u00e1na z p\u0159edchoz\u00edho p\u0159\u00edkazu \u201estore\u201c do operace \u201eload\u201c a zm\u011bn\u00ed stav cache). Prvn\u00ed typ gadget\u016f je vhodn\u00fd pro \u00fatok na j\u00e1dro Linux, zat\u00edmco druh\u00fd na JavaScriptov\u00fd motor V8 pou\u017e\u00edvan\u00fd v prohl\u00ed\u017ee\u010d\u00edch na b\u00e1zi Chromium. Prototyp n\u00e1stroje pro prov\u00e1d\u011bn\u00ed \u00fatoku byl publikov\u00e1n na GitHubu.<\/p>\n

\"TikTag\"TikTag<\/center><\/p>\n

Spole\u010dnost ARM potvrdila mo\u017enost proveden\u00ed \u00fatoku na syst\u00e9mech s procesory Cortex-X2, Cortex-X3, Cortex-A510, Cortex-A520, Cortex-A710, Cortex-A715 a Cortex-A720, ale nem\u00e1 v \u00famyslu prov\u00e1d\u011bt zm\u011bny v CPU pro zablokov\u00e1n\u00ed probl\u00e9mu, proto\u017ee architektura MemTag p\u0159edpokl\u00e1d\u00e1, \u017ee tagy nejsou tajn\u00fdmi daty pro aplikace. V k\u00f3dov\u00e9 z\u00e1kladn\u011b Chromu probl\u00e9m tak\u00e9 z\u016fst\u00e1v\u00e1 neopravov\u00e1n, proto\u017ee v prohl\u00ed\u017ee\u010di Chrome nen\u00ed ochrana zalo\u017een\u00e1 na MemTag zat\u00edm aplikov\u00e1na jako v\u00fdchoz\u00ed. T\u00fdm odpov\u011bdn\u00fd za bezpe\u010dnost platformy Android p\u0159iznal mo\u017enost proveden\u00ed \u00fatoku na za\u0159\u00edzen\u00ed Pixel 8, kde je aplikov\u00e1na ochrana MemTag, p\u0159idal opravy pro zablokov\u00e1n\u00ed \u00fanik\u016f a vyj\u00e1d\u0159il ochotu vyplatit odm\u011bnu za nalezenou zranitelnost.<\/p>\n

Jako obch\u00e1zej\u00edc\u00ed metody pro blokov\u00e1n\u00ed \u00fatoku navrhuj\u00ed v\u011bdci pou\u017e\u00edt instrukce sb nebo isb k z\u00e1kazu spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed b\u011bhem prov\u00e1d\u011bn\u00ed kritick\u00fdch operac\u00ed s pam\u011bt\u00ed nebo vkl\u00e1dat mezi v\u011btvic\u00edmi instrukcemi a instrukcemi p\u0159\u00edstupu k pam\u011bti vypln\u011bn\u00ed z jin\u00fdch instrukc\u00ed.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0435\u0443\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Samsung \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b ARM, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TikTag, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b MemTag (MTE, Memory Tagging Extension), \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0432 \u0447\u0438\u043f\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b ARMv8.5-A. \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0442\u0435\u0433\u043e\u0432 TikTag \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u0437-\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0438\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":116614,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TikTag \u2014 \u00fatok na mechanismus spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed v CPU ARM, umo\u017e\u0148uj\u00edc\u00ed obej\u00edt ochranu MemTag | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Soulsk\u00e9 univerzity a spole\u010dnosti Samsung vyvinula techniku \u00fatoku na procesory ARM, kter\u00e1 dostala k\u00f3dov\u00e9 jm\u00e9no TikTag, kterou lze pou\u017e\u00edt k obch\u00e1zen\u00ed hardwarov\u00e9ho ochrann\u00e9ho mechanismu.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47TikTag \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 CPU ARM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 MemTag | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0435\u0443\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Samsung \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b ARM, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TikTag, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-18T10:05:50+00:00","article:modified_time":"2024-06-18T10:05:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116613","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 02:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 02:28:19","updated":"2026-01-23 02:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/116613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=116613"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/116613\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/116614"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=116613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=116613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=116613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}