{"id":52649,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel"},"modified":"2020-02-18T14:00:26","modified_gmt":"2020-02-18T11:00:26","slug":"vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","title":{"rendered":"Byl objeven nov\u00fd \u00fatok Zombieload na procesory Intel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z Technick\u00e9 univerzity v Grazu (Rakousko) odhalili<\/a><\/noindex> informace o nov\u00e9 metod\u011b \u00fatoku p\u0159es vedlej\u0161\u00ed kan\u00e1ly ZombieLoad 2.0<\/a><\/noindex> (CVE-2019-11135<\/a><\/noindex>), co\u017e umo\u017e\u0148uje z\u00edskat d\u016fv\u011brn\u00e9 informace z jin\u00fdch proces\u016f, opera\u010dn\u00edho syst\u00e9mu, virtu\u00e1ln\u00edch stroj\u016f a chr\u00e1n\u011bn\u00fdch enclave (TEE, Trusted Execution Environment). Probl\u00e9m se t\u00fdk\u00e1 pouze procesor\u016f Intel. Komponenty pro zablokov\u00e1n\u00ed probl\u00e9mu navr\u017eeny<\/a><\/noindex> v\u010dera v aktualizaci mikrok\u00f3du<\/a><\/noindex>. <\/p>\n

Probl\u00e9m pat\u0159\u00ed do t\u0159\u00eddy MDS (Microarchitectural Data Sampling) a je modernizovanou variantou uveden\u00e9<\/a><\/noindex> v kv\u011btnu, \u00fatok\u016f ZombieLoad. ZombieLoad 2.0, stejn\u011b jako ostatn\u00ed \u00fatoky t\u0159\u00eddy MDS, vych\u00e1z\u00ed z pou\u017eit\u00ed metod anal\u00fdzy p\u0159es vedlej\u0161\u00ed kan\u00e1ly na data v mikroarchitektonick\u00fdch struktur\u00e1ch (nap\u0159\u00edklad v bufferech pro vypln\u011bn\u00ed (Line Fill Buffer) a ukl\u00e1d\u00e1n\u00ed (Store Buffer), kde jsou do\u010dasn\u011b uchov\u00e1v\u00e1na data pou\u017e\u00edvan\u00e1 b\u011bhem prov\u00e1d\u011bn\u00ed operac\u00ed Load a Store).<\/p>\n

Nov\u00e1 varianta \u00fatoku Zombieload se zakl\u00e1d\u00e1<\/a><\/noindex> na \u00faniku, kter\u00fd vznik\u00e1 p\u0159i pr\u00e1ci mechanismu asynchronn\u00edho p\u0159eru\u0161en\u00ed operac\u00ed (TAA, TSX Asynchronous Abort), implementovan\u00e9ho v roz\u0161\u00ed\u0159en\u00ed TSX (Transactional Synchronization Extensions), kter\u00e9 poskytuje prost\u0159edky pro pr\u00e1ci s transak\u010dn\u00ed pam\u011bt\u00ed, umo\u017e\u0148uj\u00edc\u00ed zlep\u0161it v\u00fdkonnost v\u00edcethreadov\u00fdch aplikac\u00ed d\u00edky dynamick\u00e9mu vylou\u010den\u00ed nadbyte\u010dn\u00fdch synchroniza\u010dn\u00edch operac\u00ed (podporuj\u00ed se atom\u00e1rn\u00ed transakce, kter\u00e9 mohou b\u00fdt bu\u010f p\u0159ijaty, nebo p\u0159eru\u0161eny). V p\u0159\u00edpad\u011b p\u0159eru\u0161en\u00ed se operace proveden\u00e9 s transak\u010dn\u00edm regionem pam\u011bti vr\u00e1t\u00ed zp\u011bt.<\/p>\n

P\u0159eru\u0161en\u00ed transakce prob\u00edh\u00e1 asynchronn\u011b, a b\u011bhem t\u00e9to doby mohou jin\u00e9 vl\u00e1kna p\u0159istupovat k cache, kter\u00e1 je tak\u00e9 pou\u017e\u00edv\u00e1na v zru\u0161en\u00e9m transak\u010dn\u00edm regionu pam\u011bti. V okam\u017eiku od za\u010d\u00e1tku do skute\u010dn\u00e9ho dokon\u010den\u00ed asynchronn\u00edho p\u0159eru\u0161en\u00ed transakce nen\u00ed vylou\u010deno vzniknut\u00ed situac\u00ed, kdy procesor b\u011bhem spekulativn\u00edho vykon\u00e1v\u00e1n\u00ed operace m\u016f\u017ee p\u0159e\u010d\u00edst data z vnit\u0159n\u00edch mikroarchitektonick\u00fdch buffer\u016f a p\u0159edat je do spekulativn\u011b prov\u00e1d\u011bn\u00e9 operace. Pot\u00e9 bude konflikt odhalen a spekulativn\u00ed operace bude zru\u0161ena, ale data z\u016fstanou v cache a mohou b\u00fdt z\u00edsk\u00e1na pomoc\u00ed metod obnovy cache p\u0159es vedlej\u0161\u00ed kan\u00e1ly. <\/p>\n

\u00datok spo\u010d\u00edv\u00e1 v otev\u00edr\u00e1n\u00ed transakc\u00ed TSX a vytv\u00e1\u0159en\u00ed podm\u00ednek pro jejich asynchronn\u00ed p\u0159eru\u0161en\u00ed, b\u011bhem n\u011bho\u017e doch\u00e1z\u00ed k podm\u00ednk\u00e1m pro \u00fanik obsahu vnit\u0159n\u00edch buffer\u016f, spekulativn\u011b napln\u011bn\u00fdch daty z pr\u00e1v\u011b b\u011b\u017e\u00edc\u00edch operac\u00ed \u010dten\u00ed pam\u011bti na stejn\u00e9m j\u00e1dru CPU. \u00danik je omezen na aktu\u00e1ln\u00ed fyzick\u00e9 j\u00e1dro CPU (na kter\u00e9m se vykon\u00e1v\u00e1 k\u00f3d \u00fato\u010dn\u00edka), ale proto\u017ee mikroarchitektonick\u00e9 buffery jsou sd\u00edleny mezi r\u016fzn\u00fdmi vl\u00e1kny v re\u017eimu Hyper-Threading, m\u016f\u017ee doj\u00edt k \u00faniku operac\u00ed s pam\u011bt\u00ed, kter\u00e9 vykon\u00e1vaj\u00ed jin\u00e1 vl\u00e1kna CPU. <\/p>\n

\u00datok\u016fm je citliv\u00fd<\/a><\/noindex> podl\u00e9haj\u00ed n\u011bkter\u00e9 modely osm\u00e9ho, dev\u00e1t\u00e9ho a des\u00e1t\u00e9ho generace procesor\u016f Intel Core, stejn\u011b jako Intel Pentium Gold, Intel Celeron 5000, Intel Xeon E, Intel Xeon W a druh\u00e1 generace Intel Xeon Scalable. Mezi nimi jsou zraniteln\u00e9 i nov\u00e9 procesory Intel na z\u00e1klad\u011b mikroarchitektury Cascade Lake, kter\u00e1 byla p\u016fvodn\u011b v\u016f\u010di \u00fatok\u016fm RIDL a Fallout odoln\u00e1. Krom\u011b Zombieload 2.0 v\u00fdzkumn\u00edci tak\u00e9 odhalili mo\u017enost obch\u00e1zen\u00ed d\u0159\u00edve navr\u017een\u00fdch metod ochrany proti \u00fatok\u016fm MDS, kter\u00e9 jsou zalo\u017eeny na pou\u017eit\u00ed instrukce VERW pro vymaz\u00e1n\u00ed obsahu mikroarchitektonick\u00fdch buffer\u016f p\u0159i n\u00e1vratu z j\u00e1dra do u\u017eivatelsk\u00e9ho prostoru nebo p\u0159i p\u0159ed\u00e1n\u00ed kontroly hostitelsk\u00e9mu syst\u00e9mu.<\/p>\n

Ve zpr\u00e1v\u011b Intel se uv\u00e1d\u00ed, \u017ee v syst\u00e9mech s heterogenn\u00edm zat\u00ed\u017een\u00edm je mo\u017enost proveden\u00ed \u00fatoku zt\u00ed\u017eena, nebo\u0165 \u00fanik z mikroarchitektonick\u00fdch struktur pokr\u00fdv\u00e1 ve\u0161kerou aktivitu v syst\u00e9mu a \u00fato\u010dn\u00edk nem\u016f\u017ee ovlivnit zdroj extrahovan\u00fdch dat, tj. m\u016f\u017ee pouze shroma\u017e\u010fovat informace, kter\u00e9 se v d\u016fsledku \u00faniku objevuj\u00ed, a sna\u017eit se mezi t\u011bmito daty naj\u00edt u\u017eite\u010dn\u00e9 informace, ani\u017e by m\u011bl mo\u017enost c\u00edlen\u011b zachytit data souvisej\u00edc\u00ed s konkr\u00e9tn\u00edmi adresami pam\u011bti. Nicm\u00e9n\u011b, v\u00fdzkumn\u00edci zve\u0159ejnili prototyp exploit\u016f.<\/a><\/noindex>, b\u011b\u017e\u00edc\u00ed na Linuxu a Windows, a byla demonstrov\u00e1na mo\u017enost pou\u017eit\u00ed \u00fatoku k ur\u010den\u00ed hashe hesla u\u017eivatele root.
\nMo\u017en\u00e9<\/a><\/noindex> prov\u00e1d\u011bn\u00ed \u00fatoku z hostitelsk\u00e9ho syst\u00e9mu za \u00fa\u010delem shroma\u017e\u010fov\u00e1n\u00ed dat, kter\u00e1 se objevuj\u00ed v operac\u00edch jin\u00fdch hostitelsk\u00fdch syst\u00e9m\u016f, hostitelsk\u00e9ho prost\u0159ed\u00ed, hypervizora a enclaves Intel SGX.<\/p>\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Opravy pro zablokov\u00e1n\u00ed zranitelnosti byly zahrnuty<\/a><\/noindex> byly zahrnuty do k\u00f3du j\u00e1dra Linuxu a byly sou\u010d\u00e1st\u00ed vyd\u00e1n\u00ed \t5.3.11, 4.19.84, 4.14.154, 4.9.201 a 4.4.201<\/a><\/noindex>. Aktualizace j\u00e1dra a mikro-k\u00f3du byly tak\u00e9 ji\u017e vyd\u00e1ny pro hlavn\u00ed distribuce (Debian<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>). Probl\u00e9m byl zji\u0161t\u011bn v dubnu a oprava byla koordinov\u00e1na spole\u010dnost\u00ed Intel s v\u00fdvoj\u00e1\u0159i opera\u010dn\u00edch syst\u00e9m\u016f.<\/p>\n

Nejjednodu\u0161\u0161\u00ed metodou blokov\u00e1n\u00ed Zombieload 2.0 je vypnut\u00ed podpory TSX v CPU. Navrhovan\u00e1 oprava pro j\u00e1dro Linux zahrnuje n\u011bkolik variant ochrany. Prvn\u00ed varianta nab\u00edz\u00ed parametr «tsx=on\/off\/auto», kter\u00fd umo\u017e\u0148uje \u0159\u00eddit zapnut\u00ed roz\u0161\u00ed\u0159en\u00ed TSX v CPU (hodnota auto vypne TSX pouze pro zraniteln\u00e9 CPU). Druh\u00e1 varianta ochrany se aktivuje parametrem «tsx_async_abort=off\/full\/full,nosmt» a je zalo\u017eena na vy\u010di\u0161t\u011bn\u00ed mikroarchitektonick\u00fdch buffer\u016f b\u011bhem p\u0159ep\u00edn\u00e1n\u00ed kontextu (p\u0159\u00edznak nosmt nav\u00edc vyp\u00edn\u00e1 SMT\/Hyper-Threads). Pro kontrolu zranitelnosti syst\u00e9mu je v sysfs k dispozici parametr «\/sys\/devices\/system\/cpu\/vulnerabilities\/tsx_async_abort».<\/p>\n

Krom\u011b toho v byl vy\u0159e\u0161en<\/a><\/noindex> mikrok\u00f3du odstran\u011bna<\/a><\/noindex> je\u0161t\u011b jedna zranitelnost<\/a><\/noindex> (CVE-2018-12207<\/a><\/noindex>) v procesorech Intel, kter\u00e1 je tak\u00e9 blokov\u00e1na v nov\u00e9m byl vy\u0159e\u0161en<\/a><\/noindex> j\u00e1dru Linux. Zranitelnost umo\u017e\u0148uje umo\u017e\u0148uje<\/a><\/noindex> neprivilegovan\u00e9mu \u00fato\u010dn\u00edkovi zah\u00e1jit \u00fatok typu denial of service, co\u017e vede k zamrznut\u00ed syst\u00e9mu ve stavu «Machine Check Error».
\n \u00datok m\u016f\u017ee b\u00fdt tak\u00e9 proveden<\/a><\/noindex> z hostitelsk\u00e9ho syst\u00e9mu.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u043c \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c ZombieLoad 2.0 (CVE-2019-11135), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u043e\u0432 (TEE, Trusted Execution Environment). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel. \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u044b \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 MDS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Byl odhalen nov\u00fd variant \u00fatoku Zombieload na procesory Intel | ProHoster","description":"V\u00fdzkumn\u00edci z Technick\u00e9 univerzity v Grazu (Rakousko)","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 Zombieload \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f)","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:26","updated":"2026-01-24 04:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=52649"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52649\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=52649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=52649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=52649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}