{"id":111523,"date":"2023-11-15T15:10:13","date_gmt":"2023-11-15T13:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization"},"modified":"2023-11-15T15:10:13","modified_gmt":"2023-11-15T13:10:13","slug":"uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","title":{"rendered":"S\u00e5rbarhed i AMD CPU, der muligg\u00f8r omg\u00e5else af SEV (Secure Encrypted Virtualization) beskyttelsesmekanismen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra Helmholtz Center for Information Security (CISPA) har offentliggjort en ny angrebsmetode kaldet CacheWarp, der g\u00f8r det muligt at kompromittere beskyttelsesmekanismen AMD SEV (Secure Encrypted Virtualization), der anvendes i virtualiseringssystemer for at beskytte virtuelle maskiner mod indblanding fra hypervisoren eller administratoren af v\u00e6rtsystemet. Den foresl\u00e5ede metode giver en angriber med adgang til hypervisoren mulighed for at opn\u00e5 udf\u00f8relse af ondsindet kode og h\u00e6ve privilegier i en virtuel maskine beskyttet af AMD SEV. <\/p>\n

Angrebet er baseret p\u00e5 en s\u00e5rbarhed (CVE-2023-20592), der skyldes forkert h\u00e5ndtering af cache under udf\u00f8relsen af processorinstruktionen INVD, hvilket kan f\u00f8re til datainkonsekvens mellem hukommelsen og cachen, og dermed omg\u00e5 mekanismerne til opretholdelse af hukommelsens integritet i virtuelle maskiner, implementeret ved hj\u00e6lp af SEV-ES og SEV-SNP udvidelser. S\u00e5rbarheden p\u00e5virker AMD EPYC-processorer fra f\u00f8rste til tredje generation. <\/p>\n

For AMD EPYC-processorer i tredje generation (Zen 3) er problemet blevet l\u00f8st med den november mikrosoftwareopdatering, der blev udgivet i g\u00e5r af AMD (rettelsen medf\u00f8rer ikke et fald i ydeevnen). For f\u00f8rste og anden generation AMD EPYC (Zen 1 og Zen 2) er der ikke planlagt nogen beskyttelse, da disse CPU'er ikke underst\u00f8tter SEV-SNP-udvidelsen, der sikrer kontrol over integritet. virtual machines<\/a>Den fjerde generation AMD-processorer AMD EPYC \"Genoa\" baseret p\u00e5 mikroarkitekturen \"Zen 4\" er ikke s\u00e5rbare. <\/p>\n

AMD SEV-teknologien anvendes til isolering af virtuelle maskiner af cloud-udbydere som Amazon Web Services (AWS), Google Cloud, Microsoft Azure og Oracle Compute Infrastructure (OCI). Beskyttelsen med AMD SEV er implementeret gennem hardware-kryptering af hukommelsen i virtuelle maskiner. Derudover sikrer SEV-ES (Encrypted State) udvidelsen beskyttelse af CPU-registre. Kun det aktuelle g\u00e6stebaserede system har adgang til de dekrypterede data, mens resten virtuelle maskiner<\/a> og hypervisoren f\u00e5r et krypteret datas\u00e6t, n\u00e5r de fors\u00f8ger at f\u00e5 adgang til disse data. <\/p>\n

I tredje generation af AMD EPYC-processorerne er der implementeret en ekstra SEV-SNP (Secure Nested Paging) udvidelse, der sikrer sikker drift med indlejrede side-tabeller. Ud over den generelle hukommelsesenkryptering og isolering af registre, indeholder SEV-SNP yderligere midler til at beskytte hukommelsens integritet, som forhindrer \u00e6ndringer i VM fra hypervisoren. H\u00e5ndteringen af krypteringsn\u00f8gler sker via en separat processor PSP (Platform Security Processor), som er indbygget i chippen og baseret p\u00e5 ARM-arkitekturen. <\/p>\n

Essensen af den foresl\u00e5ede angrebsmetode er at bruge INVD-instruktionen til at annullere blokke (linjer) i cachen af beskidte (dirty) sider uden at nulstille de akkumulerede data i cachen tilbage til hukommelsen (write-back). P\u00e5 den m\u00e5de g\u00f8r metoden det muligt at uds\u00e6tte de \u00e6ndrede data fra cachen uden at \u00e6ndre tilstanden i hukommelsen. For at udf\u00f8re angrebet foresl\u00e5s det at bruge softwareundtagelser (fault injection) til at afbryde arbejdet i den virtuelle maskine p\u00e5 to steder: F\u00f8rst kalder angriberen \"wbnoinvd\"-instruktionen for at nulstille alle akkumulerede skriveoperationer i hukommelsen, og i det andet sted kalder han \"invd\"-instruktionen for at returnere de uafspejlede skriveoperationer tilbage til en \u00e6ldre tilstand. <\/p>\n

For at teste sine systemer for s\u00e5rbarhed er der offentliggjort en prototype af et exploit, som g\u00f8r det muligt at udf\u00f8re et undtagelsessubstitution i en virtuel maskine, der er beskyttet af AMD SEV, og tilbagef\u00f8re uafleverede \u00e6ndringer i VM til en tidligere tilstand i hukommelsen. Tilbagef\u00f8rsel af \u00e6ndringerne kan bruges til at \u00e6ndre programgenneml\u00f8bet ved at returnere en gammel returadresse p\u00e5 stakken eller til at anvende parametre fra en gammel session, som tidligere er blevet autentificeret, ved at returnere v\u00e6rdien af autentifikationsflaget. <\/p>\n

For example, researchers have demonstrated the possibility of using the CacheWarp method to execute a Bellcore attack on the RSA-CRT algorithm implementation in the ipp-crypto library, allowing the recovery of the private key through error substitution during digital signature calculations. It also showed how one can spoof session verification parameters for OpenSSH when remotely connecting to the guest system, and then alter the verification state while executing the sudo utility to gain root privileges in Ubuntu 20.04. The exploit has been tested on systems with AMD EPYC 7252, 7313P, and 7443 processors.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 CacheWarp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u043e\u0442 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0443, \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111523","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i AMD CPU, der tillader omg\u00e5else af SEV (Secure Encrypted Virtualization) beskyttelsesmekanismen | ProHoster","description":"Forskere fra Helmholtz Center for Information Security (CISPA) har offentliggjort en ny CacheWarp-angrebsmetode, der kan kompromittere beskyttelsesmekanismen AMD SEV (Secure Encrypted Virtualization), der anvendes i.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b SEV (Secure Encrypted Virtualization) | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 CacheWarp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-15T13:10:13+00:00","article:modified_time":"2023-11-15T13:10:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111523","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:24","updated":"2026-02-09 17:11:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=111523"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111523\/revisions"}],"predecessor-version":[{"id":164098,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111523\/revisions\/164098"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=111523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=111523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=111523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}