{"id":119185,"date":"2024-08-08T09:43:01","date_gmt":"2024-08-08T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie"},"modified":"2024-08-08T09:43:01","modified_gmt":"2024-08-08T07:43:01","slug":"uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","title":{"rendered":"Zranitelnost GhostWrite, kter\u00e1 poskytuje pln\u00fd p\u0159\u00edstup k fyzick\u00e9 pam\u011bti na CPU RISC-V XuanTie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z Helmholtzova centra pro informa\u010dn\u00ed bezpe\u010dnost (CISPA) zve\u0159ejnili v\u00fdsledky studie zam\u011b\u0159en\u00e9 na bezpe\u010dnost procesor\u016f zalo\u017een\u00fdch na architektu\u0159e RISC-V a odhalili zranitelnost ozna\u010dovanou jako GhostWrite. Tato zranitelnost se t\u00fdk\u00e1 procesor\u016f RISC-V XuanTie C910, kter\u00e9 vyr\u00e1b\u00ed \u010d\u00ednsk\u00e1 spole\u010dnost T-Head (divize Alibaba) a kter\u00e9 jsou vyv\u00edjeny jako otev\u0159en\u00e9 projekty. Zranitelnost umo\u017e\u0148uje \u00fato\u010dn\u00edkovi s omezen\u00fdm nep\u0159 privileged access k syst\u00e9mu \u010d\u00edst a zapisovat data do jak\u00fdchkoliv oblast\u00ed fyzick\u00e9 pam\u011bti a tak\u00e9 z\u00edskat p\u0159\u00edstup k ovl\u00e1d\u00e1n\u00ed perifern\u00edch za\u0159\u00edzen\u00ed, jako jsou s\u00ed\u0165ov\u00e9 karty pou\u017e\u00edvaj\u00edc\u00ed MMIO (Memory-Mapped Input\/Output). <\/p>\n

Zranitelnost je zp\u016fsobena nedostatky v architektu\u0159e procesoru souvisej\u00edc\u00edmi s izolac\u00ed p\u0159idan\u00fdch instrukc\u00ed, kter\u00e9 roz\u0161i\u0159uj\u00ed architekturu RISC-V a umo\u017e\u0148uj\u00ed p\u0159\u00edm\u00fd p\u0159\u00edstup k DRAM, obch\u00e1zej\u00edc\u00ed mechanismy virtu\u00e1ln\u00ed pam\u011bti. Pr\u00e1ce n\u011bkter\u00fdch roz\u0161\u00ed\u0159en\u00fdch instrukc\u00ed p\u0159\u00edmo s fyzickou pam\u011bt\u00ed nam\u00edsto virtu\u00e1ln\u00ed pam\u011bti umo\u017e\u0148uje obej\u00edt izolaci pam\u011bti mezi procesy. <\/p>\n

P\u0159ipraven\u00e1 technika prov\u00e1d\u011bn\u00ed \u00fatoku je zcela reprodukovateln\u00e1 a vy\u017eaduje vykon\u00e1n\u00ed k\u00f3du b\u011bhem n\u011bkolika mikrosekund. Programov\u00e9 metody izolace, jako jsou kontejnery a sandboxov\u00e1 prost\u0159ed\u00ed, nebr\u00e1n\u00ed vyu\u017eit\u00ed zranitelnosti. K blokov\u00e1n\u00ed zranitelnosti pom\u00e1h\u00e1 pouze \u00fapln\u00e9 vypnut\u00ed podpory vektorov\u00fdch roz\u0161\u00ed\u0159en\u00ed, co\u017e vede ke sn\u00ed\u017een\u00ed v\u00fdkonu v testech rvv-bench o 33 % (v anotaci zpr\u00e1vy je uvedeno 77 %, na souhrnn\u00e9 str\u00e1nce \u2014 33 %, p\u0159i\u010dem\u017e v detailech je zm\u00edn\u011bno sn\u00ed\u017een\u00ed v\u00fdkonu memcpy o 33 % a memset o 8 %), a tak\u00e9 p\u0159ibli\u017en\u011b dvakr\u00e1t zkracuje dostupnou sadu procesorov\u00fdch instrukc\u00ed pro aplikace. <\/p>\n

Procesory XuanTie C910 jsou jedny z nejv\u00fdkonn\u011bj\u0161\u00edch \u010dip\u016f RISC-V dostupn\u00fdch na trhu a ji\u017e se aktivn\u011b pou\u017e\u00edvaj\u00ed v serverech<\/a> cloudov\u00fdch syst\u00e9mech a notebooc\u00edch. Probl\u00e9m se nap\u0159\u00edklad projevuje na serverech Scaleway Elastic Metal RV1, clusterech Lichee Cluster 4A, notebooku Lichee Book 4A, hern\u00ed konzoli Lichee Console 4A, p\u0159enosn\u00e9m po\u010d\u00edta\u010di Lichee Pocket 4A, jednodeskov\u00fdch po\u010d\u00edta\u010d\u00edch Sipeed Lichee Pi 4A, Milk-V Meles a BeagleV-Ahead. <\/p>\n

Jako p\u0159\u00edklad v\u011bdci p\u0159ipravili exploit, kter\u00fd umo\u017e\u0148uje nepriviligovan\u00e9mu u\u017eivateli z\u00edskat root pr\u00e1va v Linuxu. Exploit m\u011bn\u00ed obsah tabulky str\u00e1nek v pam\u011bti, kter\u00e1 se pou\u017e\u00edv\u00e1 pro p\u0159eklad virtu\u00e1ln\u00edch adres na fyzick\u00e9, aby z\u00edskal virtu\u00e1ln\u00ed adresy spojen\u00e9 s jak\u00fdmikoli fyzick\u00fdmi adresami. Tak\u00e9 byl p\u0159ipraven p\u0159\u00edklad exploitu pro \u010dten\u00ed obsahu j\u00e1dra pam\u011bti a dal\u0161\u00edch proces\u016f, co\u017e umo\u017e\u0148uje extrakci ukl\u00e1dan\u00fdch kl\u00ed\u010d\u016f pro \u0161ifrov\u00e1n\u00ed a hesel z pam\u011bti.

D\u00e1le v\u00fdzkumn\u00edci odhalili je\u0161t\u011b dv\u011b m\u00e9n\u011b nebezpe\u010dn\u00e9 architektonick\u00e9 zranitelnosti \u2014 jedna se t\u00fdk\u00e1 procesor\u016f T-Head XuanTie C906 a druh\u00e1 T-Head XuanTie C908. Ob\u011b zranitelnosti se omezuj\u00ed na vyvol\u00e1n\u00ed odm\u00edtnut\u00ed slu\u017eby kv\u016fli zastaven\u00ed pr\u00e1ce CPU. Zranitelnosti mohou p\u0159edstavovat nebezpe\u010d\u00ed pro cloudov\u00e9 platformy postaven\u00e9 na \u010dipech T-Head XuanTie, proto\u017ee p\u0159i existenci p\u0159\u00edstupu k vykon\u00e1v\u00e1n\u00ed k\u00f3du v cloudov\u00e9m prost\u0159ed\u00ed je mo\u017en\u00e9 zastavit \u010dinnost i dal\u0161\u00edch u\u017eivatel\u016f obsluhovan\u00fdch na stejn\u00e9m. serveru<\/a>. <\/p>\n

Probl\u00e9my byly odhaleny pomoc\u00ed r\u00e1mce RISCVuzz, vytvo\u0159en\u00e9ho pro fuzzing testov\u00e1n\u00ed CPU. R\u00e1mec odhaluje rozd\u00edly v implementaci stejn\u00fdch roz\u0161\u00ed\u0159en\u00fdch instrukc\u00ed na r\u016fzn\u00fdch CPU, podle p\u0159edpokladu, \u017ee kv\u016fli absenci jednotn\u00e9ho registru roz\u0161\u00ed\u0159en\u00ed instruk\u010dn\u00edho souboru RISC-V mohou instrukce se stejn\u00fdm k\u00f3dov\u00e1n\u00edm na \u010dipech r\u016fzn\u00fdch v\u00fdrobc\u016f v\u00e9st k prov\u00e1d\u011bn\u00ed r\u016fzn\u00fdch akc\u00ed. Kontrola spo\u010d\u00edvala v porovn\u00e1n\u00ed chov\u00e1n\u00ed p\u0159i zpracov\u00e1n\u00ed procesorov\u00fdch instrukc\u00ed na r\u016fzn\u00fdch CPU RISC-V a anal\u00fdze mo\u017en\u00fdch zranitelnost\u00ed ve situac\u00edch, kde bylo pozorov\u00e1no rozch\u00e1zej\u00edc\u00ed se chov\u00e1n\u00ed.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b RISC-V \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f GhostWrite. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 RISC-V-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b XuanTie C910, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 T-Head (\u043f\u043e\u0434\u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435 Alibaba) \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119185","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost GhostWrite, kter\u00e1 poskytuje pln\u00fd p\u0159\u00edstup k fyzick\u00e9 pam\u011bti na CPU RISC-V XuanTie | ProHoster","description":"V\u011bdci z Helmholtzova centra pro informa\u010dn\u00ed bezpe\u010dnost (CISPA) zve\u0159ejnili v\u00fdsledky studie bezpe\u010dnosti procesor\u016f zalo\u017een\u00fdch na architektu\u0159e RISC-V a odhalili informace o zranitelnosti, kter\u00e1 z\u00edskala k\u00f3dov\u00e9.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c GhostWrite, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 CPU RISC-V XuanTie | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b RISC-V \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-08T07:43:01+00:00","article:modified_time":"2024-08-08T07:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119185","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:01:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:35:19","updated":"2026-02-09 22:01:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/119185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=119185"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/119185\/revisions"}],"predecessor-version":[{"id":164438,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/119185\/revisions\/164438"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=119185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=119185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=119185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}