{"id":111523,"date":"2023-11-15T15:10:13","date_gmt":"2023-11-15T13:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization"},"modified":"2023-11-15T15:10:13","modified_gmt":"2023-11-15T13:10:13","slug":"uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","title":{"rendered":"A vulnerability in AMD CPU allows bypassing the SEV (Secure Encrypted Virtualization) protection mechanism.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers at the Helmholtz Center for Information Security (CISPA) have published a new attack method called CacheWarp, which compromises the AMD SEV (Secure Encrypted Virtualization) protection mechanism used in virtualization systems to safeguard virtual machines from interference by the hypervisor or host system administrators. This method allows an attacker with access to the hypervisor to execute arbitrary code and escalate privileges within a virtual machine protected by AMD SEV. <\/p>\n

The attack exploits a vulnerability (CVE-2023-20592) arising from improper cache handling during the execution of the INVD processor instruction, which can lead to data inconsistencies in memory and cache, bypassing the mechanisms that maintain the integrity of virtual machine memory built on SEV-ES and SEV-SNP extensions. This vulnerability affects AMD EPYC processors from the first to the third generation. <\/p>\n

For third-generation AMD EPYC processors (Zen 3), the issue was resolved in a microcode update released yesterday by AMD (the fix does not impact performance). For the first and second generations of AMD EPYC (Zen 1 and Zen 2), no protection is provided because these CPUs do not support the SEV-SNP extension that ensures integrity control. of virtual machines<\/a>The fourth generation of AMD processors, AMD EPYC 'Genoa', based on the 'Zen 4' microarchitecture, is not susceptible to vulnerabilities. <\/p>\n

AMD SEV technology is used to isolate virtual machines by cloud providers such as Amazon Web Services (AWS), Google Cloud, Microsoft Azure, and Oracle Compute Infrastructure (OCI). AMD SEV protection is implemented through hardware-level encryption of virtual machine memory. Additionally, the SEV-ES (Encrypted State) extension protects CPU registers. Only the current guest system has access to the decrypted data, while others virtual machines<\/a> and the hypervisor attempting to access this memory receive an encrypted data set. <\/p>\n

The third generation of AMD EPYC processors introduced an additional extension, SEV-SNP (Secure Nested Paging), which ensures secure operation with nested memory page tables. In addition to overall memory encryption and register isolation, SEV-SNP includes additional means to protect memory integrity, preventing the hypervisor from modifying the VM. Encryption key management is handled by an integrated processor component known as the PSP (Platform Security Processor), based on ARM architecture. <\/p>\n

The essence of the proposed attack method is the use of the INVD instruction to invalidate cache lines of dirty pages without flushing the accumulated data in the cache to memory (write-back). This method allows modified data to be evicted from the cache without changing the state of memory. To execute the attack, software exceptions (fault injection) are suggested to interrupt the operation of the virtual machine at two points: first, the attacker invokes the 'wbnoinvd' instruction to flush all accumulated write operations from the cache to memory, and second, they invoke the 'invd' instruction to revert unreflected write operations in memory to their old state. <\/p>\n

To test their systems for vulnerabilities, a prototype exploit has been published that allows for exception injection into a VM protected by AMD SEV, and to roll back unsaved changes in the VM to a previous state. This rollback can be used to alter the program's execution flow by reverting to an old return address on the stack, or to utilize parameters from a previous session for which authentication had already been performed, by returning the authentication flag value. <\/p>\n

For example, researchers demonstrated the possibility of using the CacheWarp method to conduct a Bellcore attack on the RSA-CRT algorithm implementation in the ipp-crypto library, allowing the recovery of the private key through error substitution during digital signature computation. It was also shown how to replace session verification parameters with OpenSSH when remotely connecting to a guest system, and then modify the verification state while running the sudo utility to gain root privileges in Ubuntu 20.04. The exploit was tested on systems with AMD EPYC 7252, 7313P, and 7443 processors.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 CacheWarp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u043e\u0442 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0443, \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111523","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in AMD CPUs allowing the bypass of the SEV (Secure Encrypted Virtualization) protection mechanism | ProHoster","description":"Researchers from the Helmholtz Center for Information Security (CISPA) published a new attack method called CacheWarp, capable of compromising the AMD SEV (Secure Encrypted Virtualization) protection mechanism used in.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b SEV (Secure Encrypted Virtualization) | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 CacheWarp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-15T13:10:13+00:00","article:modified_time":"2023-11-15T13:10:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111523","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:24","updated":"2026-02-09 17:11:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/111523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=111523"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/111523\/revisions"}],"predecessor-version":[{"id":164098,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/111523\/revisions\/164098"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=111523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=111523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=111523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}