{"id":114955,"date":"2024-04-09T21:31:00","date_gmt":"2024-04-09T19:31:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux"},"modified":"2024-04-09T21:31:00","modified_gmt":"2024-04-09T19:31:00","slug":"novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","title":{"rendered":"En ny variant af BHI-angrebet p\u00e5 Intel CPU'er, som g\u00f8r det muligt at omg\u00e5 beskyttelsen i Linux-kernen.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra det frie universitet i Amsterdam har identificeret en ny angrebsmetode kaldet 'Native BHI' (CVE-2024-2201), som g\u00f8r det muligt at bestemme indholdet af Linux-kernens hukommelse p\u00e5 systemer med Intel-processorer under udf\u00f8relsen af et exploit i brugerrummet. Hvis angrebet anvendes mod virtualiseringssystemer, kan angriberen fra g\u00e6stesystemet afg\u00f8re indholdet af hukommelsen i v\u00e6rtsmilj\u00f8et eller andre g\u00e6stesystemer. <\/p>\n

Native BHI-metoden tilbyder en alternativ teknik til udnyttelse af BHI-s\u00e5rbarheden (Branch History Injection, CVE-2022-0001), som omg\u00e5r tidligere implementerede beskyttelsesmetoder. Den angrebsm\u00e5de, der blev foresl\u00e5et i 2022, indebar udnyttelse af s\u00e5rbarheden inden for et enkelt privilegieniveau, hvor exploit\u2019en var baseret p\u00e5 udf\u00f8relse af en eBPF-program, der blev indl\u00e6st af brugeren i kernen. For at blokere s\u00e5rbarheden var det tilstr\u00e6kkeligt at begr\u00e6nse adgangen til udf\u00f8relse af eBPF-kode for almindelige brugere. <\/p>\n

Den nye Native BHI-metode kr\u00e6ver ikke adgang til eBPF og tillader en angreb fra en ikke-privilegeret bruger i brugerrummet. Metoden er baseret p\u00e5 udf\u00f8relsen af eksisterende gadgets i kernens kode \u2014 sekvenser af kommandoer, der f\u00f8rer til spekulativ udf\u00f8relse af instruktioner. For at finde passende gadgets i kernen er der udviklet et specielt v\u00e6rkt\u00f8j kaldet InSpectre Gadget, der ved analyse af kernen 6.6-rc4 identificerede 1511 Spectre-gadgets og 2105 hj\u00e6lpegadgets til dispatcher.

\"En<\/center> <\/p>\n

P\u00e5 baggrund af de fundne gadgets har forskerne forberedt et exploit, der giver mulighed for at udtr\u00e6kke en streng med hash af root-brugerens adgangskode, der er indl\u00e6st fra filen \/etc\/shadow. Hastigheden for dataudtr\u00e6k fra kernen hukommelse er cirka 3,5 Kb i sekunder.

\r\n \"Afspil\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

BHI-metoden er en udvidet version af Spectre-v2 angrebet, hvor der anvendes substitution af v\u00e6rdier i bufferen med global historik for overgange (Branch History Buffer) til at omg\u00e5 den ekstra beskyttelse (Intel eIBRS og Arm CSV2) og organisere datal\u00e6kage. Under angrebet skabes betingelserne for en forkert forudsigelse af overgang og den spekulative udf\u00f8relse af n\u00f8dvendige instruktioner gennem manipulation af overgangshistorikken, hvis resultat lagres i cachen. <\/p>\n

Forskellene fra Spectre-v2 ang\u00e5r brugen af en buffer med historik over grene (Branch History Buffer) i stedet for en buffer til forudsigelse af grene (Branch Target Buffer). For at udtr\u00e6kke data fra hukommelsen skal angriberen skabe betingelser, hvor den spekulative operation tager adressen fra det omr\u00e5de, som skal bestemmes. Efter udf\u00f8relsen af det spekulative indirekte spring forbliver den l\u00e6ste adresse i hukommelsen i cachen, hvorefter en af metoderne til at bestemme indholdet af cachen kan anvendes baseret p\u00e5 analysen af \u00e6ndringer i adgangstiden til cachede og ikke-cachede data. <\/p>\n

Native BHI-angrebet beskyttes ikke af brugen af Intel IBT (Indirect Branch Tracking) instruktioner og den hybridmekanisme til beskyttelse af kontrolflytning FineIBT i Linux-kernen, som kombinerer brugen af hardwareinstruktioner IBT og softwarebeskyttelse kCFI (kernel Control Flow Integrity) for at blokere forstyrrelser i den normale r\u00e6kkef\u00f8lge af udf\u00f8relse (control flow). FineIBT tillader kun udf\u00f8relse via indirekte spring, hvis springet g\u00e5r til instruktionen ENDBR, som placeres i begyndelsen af funktionen. Derudover (analogt med kCFI-mekanismen) f\u00f8lges der op med en kontrol af hashes, der sikrer u\u00e6ndrethed af pegerne. <\/p>\n

For at beskytte mod den nye type angreb er der tilf\u00f8jet en \u00e6ndring i Linux-kernen, der implementerer en ekstra beskyttelsesmetode ved hj\u00e6lp af de hardwarebeskyttelsesmidler (BHI_DIS_S), som Intel har foresl\u00e5et, eller alternativ softwarebeskyttelse implementeret til beskyttelse af hypervisoren. KVM<\/a>. Udviklerne af Xen-hypervisoren har ogs\u00e5 udgivet en patch baseret p\u00e5 brugen af BHI_DIS_S-modus, som begr\u00e6nser forudsigelser baseret p\u00e5 historik over grene. St\u00f8tte til BHI_DIS_S er tilg\u00e6ngelig i processorer fra Intel Alder Lake samt server-CPU'er fra Intel Sapphire Rapids. Der er ogs\u00e5 en softwarebeskyttelsestilstand baseret p\u00e5 brugen af sekvenser til at rydde branchhistorikbufferen, men denne f\u00f8rer til en mere m\u00e6rkbar reduktion i ydeevnen.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 «Native BHI» (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u043e\u0436\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0433\u043e\u0441\u0442\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041c\u0435\u0442\u043e\u0434 Native BHI \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u043d\u0443\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114956,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ny variant af BHI-angreb p\u00e5 Intel CPU'er, der muligg\u00f8r omg\u00e5else af beskyttelsen i Linux-kernen | ProHoster","description":"En gruppe forskere fra Vrije Universiteit Amsterdam har afsl\u00f8ret en ny metode til angreb \"Native BHI\" (CVE-2024-2201), som g\u00f8r det muligt p\u00e5 systemer med Intel-processorer at bestemme indholdet af Linux-kernens hukommelse.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 BHI \u043d\u0430 CPU Intel, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 "Native BHI" (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-09T19:31:00+00:00","article:modified_time":"2024-04-09T19:31:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114955","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 21:54:46","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:54:46","updated":"2026-01-22 21:54:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=114955"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114955\/revisions"}],"predecessor-version":[{"id":164266,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114955\/revisions\/164266"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/114956"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=114955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=114955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=114955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}