{"id":138893,"date":"2025-07-09T23:11:55","date_gmt":"2025-07-09T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd"},"modified":"2025-07-09T23:11:55","modified_gmt":"2025-07-09T21:11:55","slug":"ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd","title":{"rendered":"\u00datok TSA vedouc\u00ed k \u00faniku informac\u00ed z mikroarchitektonick\u00fdch struktur CPU AMD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Spole\u010dnost AMD odhalila informace o nov\u00e9 t\u0159\u00edd\u011b mikroarchitektonick\u00fdch \u00fatok\u016f na sv\u00e9 procesory \u2014 TSA (Transient Scheduler Attack). Tento \u00fatok umo\u017e\u0148uje \u00fato\u010dn\u00edkovi obej\u00edt mechanismy izolace CPU a zjistit data, kter\u00e1 jsou zpracov\u00e1v\u00e1na v jin\u00fdch kontextech, nap\u0159\u00edklad zjistit informace z prostoru u\u017eivatele, kter\u00e9 se zpracov\u00e1vaj\u00ed na \u00farovni j\u00e1dra, nebo v hostitelsk\u00e9m syst\u00e9mu zjistit data pou\u017e\u00edvan\u00e1 v jin\u00e9m hostitelsk\u00e9m syst\u00e9mu. <\/p>\n
Zranitelnosti byly odhaleny v pr\u016fb\u011bhu v\u00fdvoje n\u00e1stroje vytvo\u0159en\u00e9ho v\u00fdzkumn\u00edky z Microsoftu a \u0160v\u00fdcarsk\u00e9ho feder\u00e1ln\u00edho technologick\u00e9ho institutu v Curychu pro stresov\u00e9 testov\u00e1n\u00ed mikroarchitektonick\u00e9 izolace mezi r\u016fzn\u00fdmi z\u00f3nami p\u0159\u00edstupu, jako je j\u00e1dro, virtu\u00e1ln\u00ed stroje a procesy. <\/p>\n
Metoda \u00fatoku je zalo\u017eena na z\u00e1vislosti doby prov\u00e1d\u011bn\u00ed n\u011bkter\u00fdch instrukc\u00ed na stavu mikroarchitektonick\u00fdch struktur. Kdy\u017e procesor \u010dek\u00e1 na rychl\u00e9 dokon\u010den\u00ed instrukce \u010dten\u00ed dat z pam\u011bti (nap\u0159\u00edklad v domn\u011bn\u00ed, \u017ee data jsou v pam\u011bti L1), ale zda se mu poda\u0159\u00ed \u00fasp\u011b\u0161n\u011b z\u00edskat data, nast\u00e1v\u00e1 stav «neprav\u00e9ho dokon\u010den\u00ed» instrukce (false completion). V takov\u00e9m p\u0159\u00edpad\u011b procesor je\u0161t\u011b p\u0159edt\u00edm, ne\u017e toto stav ur\u010d\u00ed, m\u016f\u017ee napl\u00e1novat spekulativn\u00ed vykon\u00e1v\u00e1n\u00ed jin\u00fdch operac\u00ed, kter\u00e9 z\u00e1vis\u00ed na v\u00fdsledku prov\u00e1d\u011bn\u00ed instrukce na\u010dten\u00ed z pam\u011bti. <\/p>\n
Jeliko\u017e na\u010d\u00edt\u00e1n\u00ed nebylo dokon\u010deno, data s n\u00edm spojen\u00e1 jsou procesorem pova\u017eov\u00e1na za neplatn\u00e1 a operace na\u010d\u00edt\u00e1n\u00ed je pozd\u011bji provedena znovu. Z\u00e1visl\u00e9 operace jsou tak\u00e9 znovu vykon\u00e1ny po p\u0159ipravenosti spr\u00e1vn\u00fdch dat. P\u0159itom nen\u00ed prov\u00e1d\u011bn flush potrub\u00ed (pipeline flush) po proveden\u00ed instrukce, pro kterou bylo zaznamen\u00e1no «neprav\u00e9 dokon\u010den\u00ed», a neplatn\u00e1 data mohou b\u00fdt p\u0159esm\u011brov\u00e1na do z\u00e1visl\u00fdch operac\u00ed. <\/p>\n
Prov\u00e1d\u011bn\u00ed takov\u00fdch operac\u00ed nem\u011bn\u00ed stav cache a TLB (Translation Lookaside Buffer), tj. data nelze obnovit pomoc\u00ed tradi\u010dn\u00edch metod pro ur\u010den\u00ed stavu cache. Tyto data v\u0161ak ovliv\u0148uj\u00ed dobu vykon\u00e1n\u00ed dal\u0161\u00edch instrukc\u00ed. Anal\u00fdza doby vykon\u00e1n\u00ed m\u016f\u017ee b\u00fdt pou\u017eita jako zdroj \u00faniku informac\u00ed z mikroarchitektonick\u00fdch struktur, kter\u00e9 z\u016fstaly po spekulativn\u00edm prov\u00e1d\u011bn\u00ed dal\u0161\u00edch operac\u00ed. <\/p>\n
V z\u00e1vislosti na zdroji extrakce zbytkov\u00fdch dat byly identifikov\u00e1ny dv\u011b zranitelnosti: <\/p>\n
\n
CVE-2024-36350 (TSA-SQ \u2014 TSA Store Queue) \u2014 \u00fanik z vyrovn\u00e1vac\u00ed pam\u011bti operac\u00ed z\u00e1pisu (Store Queue), kter\u00fd umo\u017e\u0148uje zjistit v\u00fdsledek prov\u00e1d\u011bn\u00ed instrukc\u00ed z\u00e1pisu do pam\u011bti.\n
Zranitelnosti se projevuj\u00ed v rodin\u011b procesor\u016f AMD (Fam19h) zalo\u017een\u00fdch na mikroarchitektur\u00e1ch Zen 3 a Zen 4. Probl\u00e9m se nap\u0159\u00edklad vyskytuje v s\u00e9ri\u00edch CPU AMD Ryzen 5000\/6000\/7000\/8000, AMD EPYC Milan\/Milan-X\/Genoa\/Genoa-X\/Bergamo\/Siena, AMD Instinct MI300A, AMD Ryzen Threadripper PRO 7000 WX, AMD EPYC Embedded 7003\/8004\/9004\/97X4, AMD Ryzen Embedded 5000\/7000\/V3000. <\/p>\n
Pot\u0159ebn\u00e9 zm\u011bny pro zablokov\u00e1n\u00ed zranitelnosti jsou zahrnuty v prosincov\u00e9 aktualizaci mikroprogramu a PI firmwaru (Platform Initialization), kter\u00e9 byly p\u0159ed\u00e1ny v\u00fdrobc\u016fm OEM. Opravy na ochranu proti zranitelnosti byly p\u0159ed\u00e1ny pro za\u0159azen\u00ed do j\u00e1dra Linuxu (pro deaktivaci ochrany, kter\u00e1 negativn\u011b ovliv\u0148uje v\u00fdkon, je k dispozici volba v p\u0159\u00edkazov\u00e9m \u0159\u00e1dku j\u00e1dra «tsa=off»). Oprava byla tak\u00e9 p\u0159id\u00e1na do hypervisoru Xen. Pro zablokov\u00e1n\u00ed zranitelnosti je pot\u0159eba jak aktualizace mikroprogramu, tak aktivace re\u017eimu ochrany na \u00farovni j\u00e1dra nebo hypervisoru. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"