{"id":182817,"date":"2026-08-10T19:49:35","date_gmt":"2026-08-10T17:49:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2"},"modified":"2026-08-10T19:49:35","modified_gmt":"2026-08-10T17:49:35","slug":"tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","title":{"rendered":"TONTOU \u2014 angreb p\u00e5 Intel- og AMD-CPU'er, der muligg\u00f8r omg\u00e5else af beskyttelsen mod Spectre v2 s\u00e5rbarheder","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Forskere fra Massachusetts Institute of Technology har identificeret angrebsteknikken TONTOU (Time-of-Neutralization to Time-of-Use), som tilbyder en ny m\u00e5de at udnytte mikroarkitektur s\u00e5rbarheder af typen Spectre v2. S\u00e5rbarheden g\u00f8r det muligt at bestemme indholdet af kernens hukommelse, mens exploiten k\u00f8rer i brugerrum. Koden til blokering af udnyttelse af s\u00e5rbarheden blev inkluderet i Linux-kernen den 5. august og er indg\u00e5et i versionerne 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214 og 5.10.263. <\/p>\n
Forskere har demonstreret muligheden for, at en lokal ikke-privilegeret bruger kan bestemme hash-v\u00e6rdien af root-brugerens adgangskode, der gemmes i filen \/etc\/shadow og indl\u00e6ses i hukommelsen under autentificeringen i systemet. Forskere form\u00e5ede at opn\u00e5 datal\u00e6kage fra kernens hukommelse med en hastighed p\u00e5 5,47 byte per sekund og en n\u00f8jagtighed p\u00e5 91,97%. Af 10 testk\u00f8rsler, der i gennemsnit varede i 18 minutter, lykkedes det i halvdelen af tilf\u00e6ldene at bestemme tilstedev\u00e6relsen af filen \/etc\/shadow i hukommelsen og udtr\u00e6kke dens indhold. <\/p>\n
Exploiten er demonstreret p\u00e5 systemer med AMD-processorer og kan anvendes med AMD CPU'er fra Zen 1-4-familien. P\u00e5 Intel-systemer er angrebet ogs\u00e5 muligt, men udnyttelsen er mere kompleks. For at beskytte mod stack-overflow af returadresser og blokere s\u00e5rbarheden SRSO (Speculative Return Stack Overflow) anvender AMD-processorer en beskyttelsesmekanisme ved navn Safe-RET, som rydder branch-predictor-bufferet efter hvert brug og indsn\u00e6vrer angrebsvinduet til 2 instruktioner, der udf\u00f8res i l\u00f8bet af flere titusindedele af et sekund. <\/p>\n
For circumventing this protection and extending the attack window, a CPU throttling technique has been implemented, allowing the attacker to execute an interrupt substitution at the right moment to redirect the execution flow in the kernel and use the interrupt handler to corrupt the entries in the branch prediction buffer. To exploit the SRSO vulnerability, the attacker can create conditions under which the branch prediction block speculatively executes a large number of incorrectly predicted CALL invocations, sufficient to overflow the return address stack and overwrite correctly predicted return points located at the beginning of the stack. As a result, the initial stack elements can be overwritten with values chosen by the attacker, which will later lead to the use of these replaced values during the speculative execution of the RET instruction in the context of another process. <\/p>\n
The processor will determine that the branch prediction failed and will revert the operation to its initial state, but the data processed during speculative execution will remain in the cache and microarchitectural buffers. If the incorrectly executed block accesses memory, its speculative execution will result in data being cached from the memory read. One of the methods for extracting information from the cache may involve analyzing changes in access time to cached and uncached data. \n Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"