{"id":84664,"date":"2020-06-10T01:42:18","date_gmt":"2020-06-09T23:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami"},"modified":"2020-06-10T01:42:18","modified_gmt":"2020-06-09T23:42:18","slug":"crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","title":{"rendered":"CROSSTalk \u2014 zranitelnost v CPU Intel, kter\u00e1 vede k \u00faniku dat mezi j\u00e1dry","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z Amsterdamsk\u00e9 univerzity osvobozen\u00ed odhalila nov\u00e9 zranitelnost<\/a><\/noindex> (CVE-2020-0543) v mikroarchitektonick\u00fdch struktur\u00e1ch procesor\u016f Intel, kter\u00e1 se vyzna\u010duje t\u00edm, \u017ee umo\u017e\u0148uje obnovit v\u00fdsledky vykon\u00e1v\u00e1n\u00ed n\u011bkter\u00fdch instrukc\u00ed, kter\u00e9 byly vykon\u00e1v\u00e1ny na jin\u00e9m j\u00e1dru CPU. To je prvn\u00ed zranitelnost mechanismu spekulativn\u00edho prov\u00e1d\u011bn\u00ed instrukc\u00ed, kter\u00e1 umo\u017e\u0148uje \u00fanik dat mezi jednotliv\u00fdmi j\u00e1dry CPU (d\u0159\u00edve byly \u00faniky omezeny na r\u016fzn\u00e9 vl\u00e1kna jednoho j\u00e1dra). V\u00fdzkumn\u00edci tomuto probl\u00e9mu p\u0159i\u0159adili n\u00e1zev CROSSTalk, ale v dokumentech Intel<\/a><\/noindex> se zranitelnost zmi\u0148uje jako SRBDS (Special Register Buffer Data Sampling). <\/p>\n

Zranitelnost se vztahuje na p\u0159edstavenou<\/a><\/noindex> p\u0159ed rokem t\u0159\u00eddu probl\u00e9m\u016f MDS (Microarchitectural Data Sampling) a vych\u00e1z\u00ed z pou\u017eit\u00ed metod anal\u00fdzy skrze kan\u00e1ly na data v mikroarchitektonick\u00fdch struktur\u00e1ch. Princip \u010dinnosti<\/a><\/noindex> CROSSTalk je bl\u00edzk\u00fd zranitelnosti RIDL<\/a><\/noindex>, ale li\u0161\u00ed se zdrojem \u00faniku.
\nNov\u00e1 zranitelnost manipuluje s \u00fanikem z d\u0159\u00edve nedokumentovan\u00e9ho mezipam\u011b\u0165ov\u00e9ho bufferu, kter\u00fd je sd\u00edlen v\u0161emi j\u00e1dry CPU. <\/p>\n

\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

Podstata probl\u00e9mu<\/a><\/noindex> spo\u010d\u00edv\u00e1 v tom, \u017ee n\u011bkter\u00e9 instrukce mikroprocesoru, v\u010detn\u011b RDRAND, RDSEED a SGX EGETKEY, jsou implementov\u00e1ny pomoc\u00ed vnit\u0159n\u00ed mikroarchitektonick\u00e9 operace SRR (Special Register Reads). Na zraniteln\u00fdch procesorech se data vracen\u00e1 pro SRR ukl\u00e1daj\u00ed do mezipam\u011b\u0165ov\u00e9ho bufferu, kter\u00fd je spole\u010dn\u00fd pro v\u0161echna j\u00e1dra CPU, a pot\u00e9 jsou p\u0159enesena do bufferu pln\u011bn\u00ed, kter\u00fd je v\u00e1z\u00e1n na konkr\u00e9tn\u00ed fyzick\u00e9 j\u00e1dro CPU, na kter\u00e9m byla iniciov\u00e1na operace \u010dten\u00ed. D\u00e1le se z bufferu pln\u011bn\u00ed hodnota kop\u00edruje do registr\u016f, kter\u00e9 jsou aplikac\u00edm viditeln\u00e9. <\/p>\n

Velikost spole\u010dn\u00e9ho mezipam\u011b\u0165ov\u00e9ho bufferu odpov\u00edd\u00e1 velikosti cache \u0159\u00e1dku, co\u017e je obvykle v\u00edce ne\u017e velikost \u010dten\u00fdch dat, a r\u016fzn\u00e9 operace \u010dten\u00ed se dot\u00fdkaj\u00ed r\u016fzn\u00fdch posun\u016f v bufferu. Proto\u017ee se spole\u010dn\u00fd buffer kop\u00edruje do bufferu pln\u011bn\u00ed najednou, doch\u00e1z\u00ed k p\u0159esunu nejen pot\u0159ebn\u00e9 \u010d\u00e1sti pro aktu\u00e1ln\u00ed operaci, ale tak\u00e9 k dat\u016fm, kter\u00e1 z\u016fstala po vykon\u00e1n\u00ed jin\u00fdch operac\u00ed, v\u010detn\u011b t\u011bch proveden\u00fdch na jin\u00fdch j\u00e1drech CPU.
\n

\"CROSSTalk<\/a><\/noindex><\/center>
\n
\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

V p\u0159\u00edpad\u011b \u00fasp\u011b\u0161n\u00e9ho proveden\u00ed \u00fatoku m\u016f\u017ee autentizovan\u00fd lok\u00e1ln\u00ed u\u017eivatel v syst\u00e9mu zjistit v\u00fdsledek vykon\u00e1v\u00e1n\u00ed instrukc\u00ed RDRAND, RDSEED a EGETKEY v ciz\u00edm procesu nebo uvnit\u0159 enclavy Intel SGX, bez ohledu na j\u00e1dro CPU, na kter\u00e9m je k\u00f3d prov\u00e1d\u011bn.
\nV\u00fdzkumn\u00edci, kte\u0159\u00ed probl\u00e9m odhalili publikovali<\/a><\/noindex> Prototyp exploitu, demonstruj\u00edc\u00ed mo\u017enost \u00faniku informac\u00ed o n\u00e1hodn\u00fdch hodnot\u00e1ch z\u00edskan\u00fdch prost\u0159ednictv\u00edm instrukc\u00ed RDRAND a RDSEED, pro obnoven\u00ed soukrom\u00e9ho kl\u00ed\u010de ECDSA zpracov\u00e1van\u00e9ho v enclav\u011b Intel SGX po proveden\u00ed v syst\u00e9mu jedn\u00e9 operace s digit\u00e1ln\u00edm podpisem.<\/p>\n


\n
\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Probl\u00e9mu podl\u00e9h\u00e1<\/a><\/noindex> \u0161irok\u00fd rozsah desktopov\u00fdch, mobiln\u00edch a serverov\u00fdch procesor\u016f Intel, v\u010detn\u011b Core i3, i5, i7, i9, m3, Celeron (s\u00e9rie J, G a N), Atom (s\u00e9rie C, E a X), Xeon (rodiny E3, E5, E7, W a D), Xeon Scalable atd. Je pozoruhodn\u00e9, \u017ee spole\u010dnost Intel byla o zranitelnosti informov\u00e1na v z\u00e1\u0159\u00ed 2018, a v \u010dervenci 2019 byl p\u0159edlo\u017een prototyp exploitu, demonstruj\u00edc\u00ed \u00fanik dat mezi j\u00e1dry CPU, ale v\u00fdvoj opravy se prodlou\u017eil kv\u016fli slo\u017eitosti realizace. V dnes navrhovan\u00e9 aktualizaci mikrok\u00f3du je probl\u00e9m zablokov\u00e1n zm\u011bnou chov\u00e1n\u00ed instrukc\u00ed RDRAND, RDSEED a EGETKEY pro nadbyte\u010dn\u00e9 p\u0159eps\u00e1n\u00ed dat ve sd\u00edlen\u00e9m vyrovn\u00e1vac\u00ed pam\u011bti, aby se zabr\u00e1nilo usazov\u00e1n\u00ed zbytkov\u00fdch informac\u00ed. Nav\u00edc byla aplikov\u00e1na pozastaven\u00ed p\u0159\u00edstupu k vyrovn\u00e1vac\u00ed pam\u011bti do dokon\u010den\u00ed operac\u00ed \u010dten\u00ed a p\u0159eps\u00e1n\u00ed obsahu. <\/p>\n

Vedlej\u0161\u00edm efektem takov\u00e9 ochrany je zv\u00fd\u0161en\u00ed zpo\u017ed\u011bn\u00ed p\u0159i prov\u00e1d\u011bn\u00ed RDRAND, RDSEED a EGETKEY a sn\u00ed\u017een\u00ed propustnosti p\u0159i pokusu o sou\u010dasn\u00e9 prov\u00e1d\u011bn\u00ed t\u011bchto instrukc\u00ed na r\u016fzn\u00fdch logick\u00fdch procesorech. Prov\u00e1d\u011bn\u00ed RDRAND, RDSEED a EGETKEY tak\u00e9 pozastavuje p\u0159\u00edstup k pam\u011bti z jin\u00fdch logick\u00fdch procesor\u016f. Tyto vlastnosti mohou negativn\u011b ovlivnit v\u00fdkon n\u011bkter\u00fdch serverov\u00fdch aplikac\u00ed, proto je v firmwaru zaji\u0161t\u011bn mechanismus (RNGDS_MITG_DIS) pro deaktivaci ochrany instrukc\u00ed RDRAND a RDSEED prov\u00e1d\u011bn\u00fdch mimo enclavu Intel SGX.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u043c \u044f\u0434\u0440\u0435 CPU. \u042d\u0442\u043e \u043f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0442\u0435\u0447\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u044f\u0434\u0440\u0430\u043c\u0438 CPU (\u0440\u0430\u043d\u0435\u0435 \u0443\u0442\u0435\u0447\u043a\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043f\u043e\u0442\u043e\u043a\u0430\u043c\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u044f\u0434\u0440\u0430). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0438\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84665,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84664","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47CROSSTalk \u2014 zranitelnost v CPU Intel, vedouc\u00ed k \u00faniku dat mezi j\u00e1dry | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Amsterdamsk\u00e9 svobodn\u00e9 univerzity odhalila novou zranitelnost (CVE-2020-0543) v mikroarchitektur\u00e1ch.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CROSSTalk \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU Intel, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u044f\u0434\u0440\u0430\u043c\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:18+00:00","article:modified_time":"2020-06-09T23:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84664","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:00:17","updated":"2022-09-29 11:12:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/84664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=84664"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/84664\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/84665"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=84664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=84664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=84664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}