{"id":36892,"date":"2019-10-31T22:14:35","date_gmt":"2019-10-31T19:14:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu\/"},"modified":"2019-10-31T22:14:35","modified_gmt":"2019-10-31T19:14:35","slug":"swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","title":{"rendered":"SWAPGS \u2014 en ny s\u00e5rbarhed i CPU'ens spekulative udf\u00f8relsesmekanisme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra Bitdefender har identificeret<\/a><\/noindex> en ny s\u00e5rbarhed (CVE-2019-1125<\/a><\/noindex>) i den spekulative udf\u00f8relsesmekanisme i moderne CPU'er, som har f\u00e5et navnet SWAPGS, efter instruktionen i processoren, der for\u00e5rsager problemet. S\u00e5rbarheden det muligt<\/a><\/noindex> giver en ikke-privilegeret angriber mulighed for at bestemme indholdet af hukommelsesomr\u00e5der i kernen eller k\u00f8rende virtuelle maskiner. Problemet er bekr\u00e6ftet<\/a><\/noindex> forekommer i Intel-processorer (x86_64) og delvist affects<\/noindex> i AMD-processorer, for hvilke den prim\u00e6re angrebsvektor ikke ses. Tidligere implementerede metoder til at im\u00f8deg\u00e5 s\u00e5rbarhederne Spectre og Meltdown beskytter ikke mod SWAPGS-angrebet ved anvendelse af Intel-processorer, men der er allerede blevet foresl\u00e5et rettelser til Linux, ChromeOS, Android og Windows.<\/p>\n

S\u00e5rbarheden tilh\u00f8rer klassen Spectre v1 og er baseret p\u00e5 ideen om at gendanne data fra processorens cache, der er blevet efterladt efter spekulativ udf\u00f8relse af instruktioner. Blokke til forudsigelse af overgange i moderne CPU'er anvender forsynet udf\u00f8relse af visse instruktioner for at forbedre ydeevnen, som sandsynligvis vil blive udf\u00f8rt, men uden at vente p\u00e5 beregningen af alle de faktorer, der bestemmer deres udf\u00f8relse (for eksempel n\u00e5r betingelserne for overgangen eller adgangsparametre ikke er blevet beregnet endnu). Hvis prognosen ikke bekr\u00e6ftes, kasserer processoren resultatet af den spekulative udf\u00f8relse, men de data, der er behandlet i processen, bliver lagt i processorens cache og kan gendannes ved hj\u00e6lp af metoder til at bestemme indholdet af cachen gennem sidekanaler, der analyserer \u00e6ndringen i adgangstiden til cachelagrede og ikke-cachelagrede data. <\/p>\n

S\u00e6rlig ved den nye angrebstype er brugen af l\u00e6kagen, der opst\u00e5r under den spekulative udf\u00f8relse af SWAPGS-instruktionen, som anvendes i operativsystemer til at \u00e6ndre v\u00e6rdien af GS-registeret, n\u00e5r kontrollen overg\u00e5r fra brugerens rum til kernerummet (den brugerplads GS-v\u00e6rdi erstattes med den v\u00e6rdi, der anvendes ved operationer i kernen). I Linux-kernen opbevares GS en per_cpu-peger, der bruges til at f\u00e5 adgang til kerne data, mens der i brugerens rum er referencer til TLS (Thread Local Storage). <\/p>\n

For preventing the double invocation of the SWAPGS instruction when re-accessing the kernel space or when executing code that does not require changing the GS register, a check and conditional jump are performed before the instruction. The speculative execution mechanism preemptively transitions to executing the code with the SWAPGS instruction, without waiting for the result of the check, and if the chosen branch is not confirmed, the result is discarded. Thus, a situation may arise where the speculative branch does not include the execution of SWAPGS, but during the speculative execution, the value of the GS register is altered by the SWAPGS instruction and used in dependent memory operations that settle in the CPU cache. <\/p>\n

Forskere har foresl\u00e5et to angrebsscenarier, for hvilke der er forberedt prototyper af exploits. Det f\u00f8rste scenarie er baseret p\u00e5 en situation, hvor SWAPGS-instruktionen ikke udf\u00f8res spekulativt, selvom den bruges under faktisk udf\u00f8relse, mens det andet scenarie er omvendt, hvor SWAPGS-instruktionen udf\u00f8res spekulativt, selvom den faktisk ikke burde. For hvert scenarie er der to varianter af udnyttelse: angriberen kan bestemme v\u00e6rdien fra en bestemt adresse i kernen, og angriberen kan udf\u00f8re en s\u00f8gning efter en bestemt v\u00e6rdi p\u00e5 tilf\u00e6ldige adresser i kernen. Gennemf\u00f8relsen af angrebet tager tid, og for at organisere l\u00e6kagen kan det v\u00e6re n\u00f8dvendigt at udf\u00f8re exploit'en i flere timer. <\/p>\n

\r\n \"Afspil\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

In the Linux kernel, the problem er blevet l\u00f8st<\/a><\/noindex> is through changing the logic of calling the SWAPGS instruction (blocking speculative execution), similar to the fixes for other Spectre v1 class vulnerabilities. It is assumed that the added protection will minimally affect the performance of typical workloads. The delay occurs during switching between user space and the kernel, which may lead to reduced performance, for example, during intensive execution of system calls from an application or frequent generation of NMIs and interrupts. <\/p>\n

Reparationen kr\u00e6ver installation af kernopdateringer b\u00e5de i det prim\u00e6re system og i g\u00e6stemilj\u00f8er, efterfulgt af genstart af systemet. For at deaktivere beskyttelsen i Linux kan indstillingen \u00abnospectre_v1\u00bb bruges, som ogs\u00e5 deaktiverer foranstaltninger til at blokere s\u00e5rbarheden i SWAPGS. Reparationen er tilg\u00e6ngelig i form af et patch<\/a><\/noindex> for Linux-kernen, som allerede er inkluderet i versionerne 4.19.65<\/a><\/noindex>, 5.2.7<\/a><\/noindex>, 4.14.137, 4.9.188 og 4.4.188. Opdateringer til Linux-distributioner er endnu ikke udgivet (Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>). Problemet er blevet l\u00f8st p\u00e5 Windows uden un\u00f8dig offentlig omtale i juliopdateringen<\/a><\/noindex>. Google has prepared<\/a><\/noindex> har en reparation til kernen 4.19, leveret i ChromeOS og Android<\/a><\/noindex>.<\/p>\n

If\u00f8lge forskere fra virksomheden Bitdefender blev Intel informeret om problemet allerede i august sidste \u00e5r. Problemet blev besluttet at blive l\u00f8st via software, og udviklere fra Microsoft, Google og Linux-kernen blev involveret i den koordinerede udvikling af reparationen. Gamle Intel-processorer, f\u00f8r Ivy Bridge, er meget sv\u00e6rere at angribe p\u00e5 grund af manglende underst\u00f8ttelse af WRGSBASE-instruktionen, der blev brugt i udnyttelsen. ARM, POWER, SPARC, MIPS og RISC-V systemer er ikke udsat for problemet, da de ikke underst\u00f8tter SWAPGS-instruktionen.<\/p>\n

Problemet truer prim\u00e6rt ejere af Intel-processorer \u2014
\n p\u00e5 AMD-systemer lykkedes det kun at reproducere det andet angrebsscenarie, som er begr\u00e6nset til spekulativ behandling af den grundl\u00e6ggende v\u00e6rdi af GS-registeret, hvilket kan bruges til at finde specifikke v\u00e6rdier i tilf\u00e6ldige hukommelsesomr\u00e5der. For at blokere denne angrebstype er det nok<\/noindex> findes der eksisterende metoder til beskyttelse mod s\u00e5rbarhederne Spectre v1. <\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-1125) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 CPU, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0438\u043c\u044f SWAPGS, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043d\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Intel (x86_64) \u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b AMD, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SWAPGS \u2014 en ny s\u00e5rbarhed i mekanismen for spekulativ udf\u00f8relse af CPU | ProHoster","description":"Forskere fra Bitdefender har opdager en ny s\u00e5rbarhed (","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SWAPGS \u2014 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f CPU | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:35+00:00","article:modified_time":"2019-10-31T19:14:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:14:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:22","updated":"2026-01-22 05:14:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/36892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=36892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/36892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=36892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=36892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=36892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}