{"id":182817,"date":"2026-08-10T19:49:35","date_gmt":"2026-08-10T17:49:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2"},"modified":"2026-08-10T19:49:35","modified_gmt":"2026-08-10T17:49:35","slug":"tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","title":{"rendered":"TONTOU \u2014 \u00fatok na CPU Intel a AMD, umo\u017e\u0148uj\u00edc\u00ed obej\u00edt ochranu proti zranitelnostem Spectre v2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z Massachusettsk\u00e9ho technologick\u00e9ho institutu odhalili techniku \u00fatoku TONTOU (Time-of-Neutralization to Time-of-Use), kter\u00e1 nab\u00edz\u00ed nov\u00fd zp\u016fsob zneu\u017eit\u00ed mikroarchitektonick\u00fdch zranitelnost\u00ed t\u0159\u00eddy Spectre v2. Zranitelnost umo\u017e\u0148uje ur\u010dit obsah j\u00e1drov\u00e9 pam\u011bti b\u011bhem prov\u00e1d\u011bn\u00ed exploit\u016f ve u\u017eivatelsk\u00e9m prostoru. K\u00f3d pro blokov\u00e1n\u00ed zneu\u017eit\u00ed zranitelnosti byl p\u0159ijat do j\u00e1dra Linuxu 5. srpna a je zahrnut v verz\u00edch 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214 a 5.10.263. <\/p>\n

V\u00fdzkumn\u00edci demonstrovali mo\u017enost proveden\u00ed \u00fatoku lok\u00e1ln\u00edm nezprivilegovan\u00fdm u\u017eivatelem za \u00fa\u010delem ur\u010den\u00ed hash hesla u\u017eivatele root, ulo\u017een\u00e9ho v souboru \/etc\/shadow a na\u010dten\u00e9ho do pam\u011bti p\u0159i prov\u00e1d\u011bn\u00ed autentizace v syst\u00e9mu. V\u00fdzkumn\u00edk\u016fm se poda\u0159ilo dos\u00e1hnout \u00faniku dat z j\u00e1drov\u00e9 pam\u011bti s v\u00fdkonem 5,47 bajt\u016f za sekundu a p\u0159esnost\u00ed 91,97 %. Z 10 testovac\u00edch spu\u0161t\u011bn\u00ed exploitu, kter\u00e1 trvala v pr\u016fm\u011bru 18 minut, se v polovin\u011b p\u0159\u00edpad\u016f poda\u0159ilo \u00fasp\u011b\u0161n\u011b ur\u010dit p\u0159\u00edtomnost souboru \/etc\/shadow v pam\u011bti a extrahovat jeho obsah. <\/p>\n

Exploit byl demonstrov\u00e1n na syst\u00e9mech s procesory AMD a m\u016f\u017ee b\u00fdt pou\u017e\u00edv\u00e1n s CPU AMD rodin Zen 1-4. Na syst\u00e9mech Intel je \u00fatok tak\u00e9 provediteln\u00fd, ale zneu\u017eit\u00ed je slo\u017eit\u011bj\u0161\u00ed. K ochran\u011b p\u0159ed p\u0159ete\u010den\u00edm z\u00e1sobn\u00edku adres n\u00e1vratu a blokov\u00e1n\u00edm zranitelnosti SRSO (Speculative Return Stack Overflow) se v procesorech AMD pou\u017e\u00edv\u00e1 ochrann\u00fd mechanismus Safe-RET, kter\u00fd \u010dist\u00ed buffer predikce skok\u016f po ka\u017ed\u00e9m pou\u017eit\u00ed a zu\u017euje okno pro proveden\u00ed \u00fatoku na 2 instrukce vykon\u00e1van\u00e9 b\u011bhem n\u011bkolika des\u00edtek nanosekund. <\/p>\n

K obejit\u00ed t\u00e9to ochrany a roz\u0161\u00ed\u0159en\u00ed okna prov\u00e1d\u011bn\u00ed \u00fatoku byla realizov\u00e1na technika zpomalen\u00ed CPU, kter\u00e1 umo\u017enila v\u010das vykonat substituci p\u0159eru\u0161en\u00ed pro p\u0159esm\u011brov\u00e1n\u00ed toku vykon\u00e1v\u00e1n\u00ed v j\u00e1d\u0159e a vyu\u017eit\u00ed zpracovatele p\u0159eru\u0161en\u00ed k pozm\u011bn\u011bn\u00ed z\u00e1znamu v bufferu p\u0159edpov\u011bdi skok\u016f. Pro vyu\u017eit\u00ed zranitelnosti SRSO m\u016f\u017ee \u00fato\u010dn\u00edk vytvo\u0159it podm\u00ednky, za kter\u00fdch blok p\u0159edpov\u011bdi skok\u016f spekulativn\u011b provede velk\u00e9 mno\u017estv\u00ed nespr\u00e1vn\u011b p\u0159edpov\u011bzen\u00fdch vol\u00e1n\u00ed CALL, dostate\u010dn\u00e9 k p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku adres n\u00e1vratu a p\u0159eps\u00e1n\u00ed spr\u00e1vn\u011b p\u0159edpov\u011bzen\u00fdch bod\u016f n\u00e1vratu um\u00edst\u011bn\u00fdch na za\u010d\u00e1tku z\u00e1sobn\u00edku. V d\u016fsledku toho mohou b\u00fdt po\u010d\u00e1te\u010dn\u00ed prvky z\u00e1sobn\u00edku p\u0159eps\u00e1ny na hodnoty zvolen\u00e9 \u00fato\u010dn\u00edkem, co\u017e povede k pou\u017eit\u00ed t\u011bchto nahrazen\u00fdch hodnot p\u0159i spekulativn\u00edm vykon\u00e1v\u00e1n\u00ed instrukce RET v kontextu jin\u00e9ho procesu. <\/p>\n

Procesor ur\u010d\u00ed, \u017ee p\u0159edpov\u011b\u010f v\u011btven\u00ed nebyla spr\u00e1vn\u00e1, a vr\u00e1t\u00ed operaci do v\u00fdchoz\u00edho stavu, ale zpracovan\u00e1 data z procesu spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed z\u016fstanou v cache a mikroarchitektonick\u00fdch bufferech. Pokud chybn\u011b proveden\u00fd blok provede p\u0159\u00edstup do pam\u011bti, povede jeho spekulativn\u00ed vykon\u00e1v\u00e1n\u00ed k ulo\u017een\u00ed do spole\u010dn\u00e9 cache a dat, kter\u00e1 byla p\u0159e\u010dtena z pam\u011bti. K extrakci informac\u00ed z cache m\u016f\u017ee b\u00fdt pou\u017eit jeden ze zp\u016fsob\u016f ur\u010dov\u00e1n\u00ed obsahu cache na z\u00e1klad\u011b anal\u00fdzy zm\u011bn doby p\u0159\u00edstupu k p\u0159echov\u00e1van\u00fdm a nep\u0159echov\u00e1van\u00fdm dat\u016fm.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043c\u0430\u0441\u0441\u0430\u0447\u0443\u0441\u0435\u0442\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 TONTOU (Time-of-Neutralization to Time-of-Use), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041a\u043e\u0434 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043d\u044f\u0442 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 7.1.7, 6.18.43, 6.12.102, 6.6.149, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182817","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TONTOU \u2014 \u00fatok na CPU Intel a AMD, kter\u00fd umo\u017e\u0148uje obej\u00edt ochranu p\u0159ed zranitelnostmi Spectre v2 | ProHoster","description":"V\u00fdzkumn\u00edci z Massachusettsk\u00e9ho technologick\u00e9ho institutu identifikovali techniku \u00fatoku TONTOU (Time-of-Neutralization to Time-of-Use), kter\u00e1 nab\u00edz\u00ed nov\u00fd zp\u016fsob vyu\u017eit\u00ed mikroarchitektonick\u00fdch zranitelnost\u00ed t\u0159\u00eddy Spectre.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47TONTOU \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 CPU Intel \u0438 AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Spectre v2 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043c\u0430\u0441\u0441\u0430\u0447\u0443\u0441\u0435\u0442\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 TONTOU (Time-of-Neutralization to Time-of-Use), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-10T17:49:35+00:00","article:modified_time":"2026-08-10T17:49:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182817","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/182817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=182817"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/182817\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=182817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=182817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=182817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}