{"id":84664,"date":"2020-06-10T01:42:18","date_gmt":"2020-06-09T23:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami"},"modified":"2020-06-10T01:42:18","modified_gmt":"2020-06-09T23:42:18","slug":"crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","title":{"rendered":"CROSSTalk \u2014 en s\u00e5rbarhed i Intel CPU, der f\u00f8rer til datal\u00e6kage mellem kerner","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra det Frie Universitet i Amsterdam har identificeret en ny ASLR i programmer med setuid-flaget og bestemme adressefordelingen i de indl\u00e6ste biblioteker gennem manipulation af milj\u00f8variablen LD_PREFER_MAP_32BIT_EXEC.<\/a><\/noindex> (CVE-2020-0543) i mikroarkitekturstrukturerne af Intel-processorer, bem\u00e6rkelsesv\u00e6rdig ved at den g\u00f8r det muligt at genoprette resultaterne af udf\u00f8relsen af visse instruktioner, der udf\u00f8res p\u00e5 en anden CPU-kerne. Dette er den f\u00f8rste s\u00e5rbarhed i mekanismen for spekulativ udf\u00f8relse af instruktioner, der muligg\u00f8r datal\u00e6kager mellem separate CPU-kerner (tidligere var l\u00e6kager begr\u00e6nset til forskellige tr\u00e5de p\u00e5 den samme kerne). Forskerne har givet problemet navnet CROSSTalk, men i Intel-dokumenterne<\/a><\/noindex> n\u00e6vnes s\u00e5rbarheden som SRBDS (Special Register Buffer Data Sampling). <\/p>\n

S\u00e5rbarheden relaterer sig til en klasse problemer MDS (Microarchitectural Data Sampling), der blev pr\u00e6senteret<\/a><\/noindex> for et \u00e5r siden og er baseret p\u00e5 anvendelse af metoder til angreb via sidekanaler p\u00e5 data i mikroarkitekturstrukturer. Funktionsprincippet<\/a><\/noindex> CROSSTalk er t\u00e6t p\u00e5 s\u00e5rbarheden RIDL<\/a><\/noindex>, men adskiller sig i kilden til l\u00e6kagen.
\nDen nye s\u00e5rbarhed manipulerer en l\u00e6kage fra en tidligere ikke-dokumenteret midlertidig buffer, som bruges af alle CPU-kerner. <\/p>\n

\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

Kernen i problemet<\/a><\/noindex> er, at nogle mikroprocessor instruktioner, inklusive RDRAND, RDSEED og SGX EGETKEY, er implementeret ved hj\u00e6lp af en intern mikroarkitektonisk operation SRR (Special Register Reads). P\u00e5 de s\u00e5rbare processorer, bliver de data, der returneres til SRR, fastgjort i en midlertidig buffer, der er f\u00e6lles for alle CPU-kerner, hvorefter de sendes til en udfyldningsbuffer bundet til den specifikke fysiske CPU-kerne, hvor l\u00e6seoperationen blev initieret. Derefter bliver v\u00e6rdien kopieret fra udfyldningsbufferen til registrene, synlige for applikationer. <\/p>\n

St\u00f8rrelsen af den f\u00e6lles midlertidige buffer svarer til cache-linjen, hvilket normalt er st\u00f8rre end st\u00f8rrelsen af de l\u00e6ste data, og forskellige l\u00e6seoperationer p\u00e5virker forskellige offset i bufferen. Da den f\u00e6lles buffer kopieres til udfyldningsbufferen i sin helhed, flyttes ikke kun den n\u00f8dvendige portion til den nuv\u00e6rende operation, men ogs\u00e5 de data, der er tilbage fra udf\u00f8relsen af andre operationer, herunder dem, der er udf\u00f8rt p\u00e5 andre CPU-kerner.
\n

\"CROSSTalk<\/a><\/noindex><\/center>
\n
\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

I tilf\u00e6lde af en vellykket angrebsorganisation kan en autentificeret lokal bruger i systemet bestemme resultatet af udf\u00f8relsen af instruktionerne RDRAND, RDSEED og EGETKEY i en anden proces eller i Intel SGX-enklaven, uafh\u00e6ngigt af den CPU-kerne, hvor koden udf\u00f8res.
\nForskere, der har identificeret problemet har offentliggjort<\/a><\/noindex> en prototype af et exploit, der demonstrerer muligheden for l\u00e6kage af oplysninger om tilf\u00e6ldige v\u00e6rdier, der opn\u00e5s via RDRAND- og RDSEED-instruktioner, til gendannelse af ECDSA-private n\u00f8gler, der behandles i Intel SGX-enklaven, efter \u00e9n enkelt digital underskriftoperation i systemet.<\/p>\n


\n
\r\n \"Afspil\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Problemet er underlagt<\/a><\/noindex> et bredt spektrum af Intel-desktop-, mobil- og serverprocessorer, herunder Core i3, i5, i7, i9, m3, Celeron (serierne J, G og N), Atom (serierne C, E og X), Xeon (familierne E3, E5, E7, W og D), Xeon Scalable osv. Det er bem\u00e6rkelsesv\u00e6rdigt, at Intel blev underrettet om s\u00e5rbarheden i september 2018, og i juli 2019 blev der pr\u00e6senteret en prototype af et exploit, der demonstrerede datal\u00e6kage mellem CPU-kerner, men udviklingen af en rettelse blev forsinket p\u00e5 grund af kompleksiteten i implementeringen. I den mikroprogrammeringsopdatering, der blev pr\u00e6senteret i dag, er problemet blokeret ved at \u00e6ndre adf\u00e6rden af RDRAND-, RDSEED- og EGETKEY-instruktioner, s\u00e5 de overskriver data i den delte buffer for at forhindre, at resterende oplysninger bliver tilbage i den. Desuden er adgangen til bufferen blevet sat p\u00e5 pause, indtil l\u00e6se- og overskriveoperationer er afsluttet. <\/p>\n

En bivirkning af denne beskyttelse er en \u00f8get forsinkelse ved udf\u00f8relse af RDRAND, RDSEED og EGETKEY samt nedsat b\u00e5ndbredde ved fors\u00f8g p\u00e5 samtidig udf\u00f8relse af disse instruktioner p\u00e5 forskellige logiske processorer. Udf\u00f8relse af RDRAND, RDSEED og EGETKEY suspenderer ogs\u00e5 hukommelsesadgang fra andre logiske processorer. Disse tr\u00e6k kan negativt p\u00e5virke ydeevnen for nogle serverapplikationer, s\u00e5 firmwaren indeholder en mekanisme (RNGDS_MITG_DIS) til at deaktivere beskyttelsen af RDRAND- og RDSEED-instruktioner, der udf\u00f8res uden for Intel SGX-enklaven.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u043c \u044f\u0434\u0440\u0435 CPU. \u042d\u0442\u043e \u043f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0442\u0435\u0447\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u044f\u0434\u0440\u0430\u043c\u0438 CPU (\u0440\u0430\u043d\u0435\u0435 \u0443\u0442\u0435\u0447\u043a\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043f\u043e\u0442\u043e\u043a\u0430\u043c\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u044f\u0434\u0440\u0430). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0438\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84665,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84664","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47CROSSTalk - en s\u00e5rbarhed i Intel CPU, der f\u00f8rer til datal\u00e6kage mellem kerner | ProHoster","description":"En gruppe forskere fra Vrije Universiteit Amsterdam har opdaget en ny s\u00e5rbarhed (CVE-2020-0543) i mikroarkitekturen.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CROSSTalk \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU Intel, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u044f\u0434\u0440\u0430\u043c\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:18+00:00","article:modified_time":"2020-06-09T23:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84664","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:00:17","updated":"2022-09-29 11:12:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/84664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=84664"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/84664\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/84665"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=84664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=84664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=84664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}