{"id":73756,"date":"2020-03-11T20:42:30","date_gmt":"2020-03-11T17:42:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/lvi-novyj-klass-atak-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu"},"modified":"2020-03-11T20:42:30","modified_gmt":"2020-03-11T17:42:30","slug":"lvi-novyj-klass-atak-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/lvi-novyj-klass-atak-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu","title":{"rendered":"LVI \u2014 nov\u00fd typ \u00fatok\u016f na mechanismus spekulativn\u00edho prov\u00e1d\u011bn\u00ed v CPU","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byly zve\u0159ejn\u011bny<\/a><\/noindex> informace o nov\u00e9m typu \u00fatok\u016f LVI<\/a><\/noindex> (Load Value Injection, CVE-2020-0551<\/a><\/noindex>) na mechanismus spekulativn\u00edho prov\u00e1d\u011bn\u00ed v CPU Intel, kter\u00fd m\u016f\u017ee b\u00fdt vyu\u017eit k \u00faniku kl\u00ed\u010d\u016f a tajn\u00fdch dat z enclaves Intel SGX a dal\u0161\u00edch proces\u016f.<\/p>\n

Nov\u00fd typ \u00fatok\u016f je zalo\u017een na manipulaci se stejn\u00fdmi mikroarchitektonick\u00fdmi strukturami, jako p\u0159i \u00fatoc\u00edch MDS<\/a><\/noindex> (Microarchitectural Data Sampling), Spectre a Meltdown<\/a><\/noindex>Nicm\u00e9n\u011b nov\u00e9 \u00fatoky nejsou blokov\u00e1ny existuj\u00edc\u00edmi metodami ochrany proti Meltdownu, Spectre, MDS a dal\u0161\u00edm podobn\u00fdm \u00fatok\u016fm. Pro zaji\u0161t\u011bn\u00ed efektivn\u00ed ochrany proti LVI jsou vy\u017eadov\u00e1ny hardwarov\u00e9 zm\u011bny v CPU. P\u0159i organizaci ochrany softwarov\u011b, p\u0159id\u00e1n\u00edm instrukce LFENCE po ka\u017ed\u00e9 operaci na\u010d\u00edt\u00e1n\u00ed z pam\u011bti a nahrazen\u00edm instrukce RET instrukcemi POP, LFENCE a JMP, vznikaj\u00ed p\u0159\u00edli\u0161 vysok\u00e9 re\u017eijn\u00ed n\u00e1klady \u2013 podle odhad\u016f v\u00fdzkumn\u00edk\u016f by pln\u00e1 softwarov\u00e1 ochrana vedla k poklesu v\u00fdkonu o 2-19kr\u00e1t. <\/p>\n

\u010c\u00e1ste\u010dn\u011b je obt\u00ed\u017enost zablokov\u00e1n\u00ed probl\u00e9mu kompenzov\u00e1na t\u00edm, \u017ee v sou\u010dasnosti \u00fatok m\u00e1 sp\u00ed\u0161e teoretick\u00fd ne\u017e praktick\u00fd charakter (\u00fatok je teoreticky mo\u017en\u00fd, ale velmi obt\u00ed\u017en\u00fd na realizaci a reprodukovateln\u00fd pouze v syntetick\u00fdch testech).
\nSpole\u010dnost Intel p\u0159i\u0159adila<\/a><\/noindex> probl\u00e9mu st\u0159edn\u00ed stupe\u0148 nebezpe\u010dnosti (5,6 z 10) a vyu\u017eila<\/a><\/noindex> aktualizaci firmwaru a SDK pro prost\u0159ed\u00ed SGX, ve kter\u00fdch se sna\u017eila zablokovat proveden\u00ed \u00fatoku alternativn\u00edm zp\u016fsobem. Navrhovan\u00e9 metody \u00fatoku jsou zat\u00edm pou\u017eiteln\u00e9 pouze pro procesory Intel, ale nelze vylou\u010dit mo\u017enost adaptace LVI i na jin\u00e9 procesory, kter\u00e9 jsou vystaveny \u00fatok\u016fm typu Meltdown.<\/p>\n

Probl\u00e9m byl identifikov\u00e1n v dubnu lo\u0148sk\u00e9ho roku v\u00fdzkumn\u00edkem Jo Van Bulckem z Leuven University, po \u010dem\u017e v spolupr\u00e1ci s 9 dal\u0161\u00edmi v\u00fdzkumn\u00edky z r\u016fzn\u00fdch univerzit byly vyvinuty p\u011bt z\u00e1kladn\u00edch metod prov\u00e1d\u011bn\u00ed \u00fatok\u016f, z nich\u017e ka\u017ed\u00e1 umo\u017e\u0148uje existenci specifick\u00fdch variant<\/a><\/noindex>. Nez\u00e1visle v \u00fanoru tohoto roku tak\u00e9 v\u00fdzkumn\u00edci ze spole\u010dnosti Bitdefender. objevili<\/a><\/noindex> Jedna z variant\u016f \u00fatoku LVI byla nahl\u00e1\u0161ena spole\u010dnosti Intel. Varianty \u00fatok\u016f se li\u0161\u00ed pou\u017eit\u00edm r\u016fzn\u00fdch mikroarchitektonick\u00fdch struktur, jako jsou \u00falo\u017ei\u0161t\u011b dat (SB, Store Buffer), vyrovn\u00e1vac\u00ed pam\u011b\u0165 (LFB, Line Fill Buffer), kontextov\u00e1 p\u0159ep\u00ednac\u00ed vyrovn\u00e1vac\u00ed pam\u011b\u0165 FPU a prvn\u00ed \u00farove\u0148 vyrovn\u00e1vac\u00ed pam\u011bti (L1D), kter\u00e9 byly d\u0159\u00edve pou\u017eity v takov\u00fdch \u00fatoc\u00edch jako ZombieLoad<\/a><\/noindex>, RIDL<\/a><\/noindex>, Fallout<\/a><\/noindex>, LazyFP<\/a><\/noindex>, Foreshadow<\/a><\/noindex> a Meltdown<\/a><\/noindex>.<\/p>\n

\"LVI<\/a><\/noindex><\/center><\/p>\n

Hlavn\u00edm rozd\u00edlem<\/a><\/noindex> LVI od \u00fatok\u016f MDS je to, \u017ee MDS manipuluje s definic\u00ed obsahu mikroarchitektonick\u00fdch struktur, kter\u00e9 z\u016fst\u00e1vaj\u00ed v mezipam\u011bti po spekulativn\u00edm zpracov\u00e1n\u00ed v\u00fdjimek (fault) nebo operac\u00edch na\u010d\u00edt\u00e1n\u00ed a ukl\u00e1d\u00e1n\u00ed, zat\u00edmco
\n\u00fatoky LVI umo\u017e\u0148uj\u00ed vkl\u00e1d\u00e1n\u00ed \u00fadaj\u016f \u00fato\u010dn\u00edka do mikroarchitektonick\u00fdch struktur, aby m\u011bly vliv na n\u00e1sledn\u00e9 spekulativn\u00ed vykon\u00e1n\u00ed k\u00f3du ob\u011bti. Pomoc\u00ed t\u011bchto manipulac\u00ed m\u016f\u017ee \u00fato\u010dn\u00edk z\u00edskat obsah uzav\u0159en\u00fdch datov\u00fdch struktur v jin\u00fdch procesech p\u0159i prov\u00e1d\u011bn\u00ed ur\u010dit\u00e9ho k\u00f3du na c\u00edlov\u00e9m j\u00e1dru CPU.<\/p>\n

\"LVI<\/a><\/noindex><\/center><\/p>\n

Pro exploatace probl\u00e9mu<\/a><\/noindex> v k\u00f3du procesu-ob\u011bti mus\u00ed se vyskytovat<\/a><\/noindex> speci\u00e1ln\u00ed sekvence k\u00f3du (gadgets), ve kter\u00fdch se na\u010d\u00edt\u00e1 kontrolovan\u00e1 hodnota \u00fato\u010dn\u00edka, a na\u010dten\u00ed t\u00e9to hodnoty vede k vzniku v\u00fdjimek (fault, abort nebo assist), kter\u00e9 vy\u0159azuj\u00ed v\u00fdsledek a znovu vykon\u00e1vaj\u00ed instrukci. P\u0159i zpracov\u00e1n\u00ed v\u00fdjimky vznik\u00e1 spekulativn\u00ed okno, b\u011bhem n\u011bho\u017e doch\u00e1z\u00ed k \u00faniku dat zpracov\u00e1van\u00fdch v gadgetu. Konkr\u00e9tn\u011b za\u010d\u00edn\u00e1 procesor vykon\u00e1vat v spekulativn\u00edm re\u017eimu kus k\u00f3du (gadget), pot\u00e9 zjist\u00ed, \u017ee predikce nebyla spr\u00e1vn\u00e1 a vr\u00e1t\u00ed operace do v\u00fdchoz\u00edho stavu, ale data zpracovan\u00e1 b\u011bhem spekulativn\u00edho vykon\u00e1n\u00ed z\u016fst\u00e1vaj\u00ed v mezipam\u011bti L1D a mikroarchitektonick\u00fdch vyrovn\u00e1vac\u00edch pam\u011btech a jsou dostupn\u00e1 pro extrakci pomoc\u00ed zn\u00e1m\u00fdch metod ur\u010den\u00ed rezidu\u00e1ln\u00edch dat prost\u0159ednictv\u00edm bo\u010dn\u00edch kan\u00e1l\u016f.<\/p>\n

V\u00fdjimka \u201eassist\u201c, na rozd\u00edl od \u201efault\u201c, je zpracov\u00e1v\u00e1na uvnit\u0159 procesoru bez vol\u00e1n\u00ed softwarov\u00fdch zpracovatel\u016f. Assist m\u016f\u017ee nastat nap\u0159\u00edklad tehdy, kdy\u017e je t\u0159eba aktualizovat bit A (Accessed) nebo D (Dirty) v tabulce str\u00e1nkov\u00e9 pam\u011bti. Hlavn\u00ed obt\u00ed\u017e p\u0159i prov\u00e1d\u011bn\u00ed \u00fatoku na jin\u00e9 procesy spo\u010d\u00edv\u00e1 v tom, jak iniciovat vznik assist, manipulac\u00ed s procesem ob\u011bti. V sou\u010dasnosti neexistuj\u00ed spolehliv\u00e9 zp\u016fsoby, jak to prov\u00e9st, ale v budoucnu se jejich nalezen\u00ed nevylu\u010duje. Mo\u017enost proveden\u00ed \u00fatoku byla zat\u00edm potvrzena pouze pro enclave Intel SGX, ostatn\u00ed sc\u00e9n\u00e1\u0159e jsou teoretick\u00e9 nebo reprodukovateln\u00e9 v syntetick\u00fdch podm\u00ednk\u00e1ch (je nutn\u00e9 p\u0159idat do k\u00f3du ur\u010dit\u00e9 gadgety).<\/p>\n

\"LVI<\/a><\/noindex><\/center><\/p>\n

\"LVI<\/a><\/noindex><\/center><\/p>\n

Mo\u017en\u00e9 vektory \u00fatok\u016f:<\/p>\n