{"id":52649,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel"},"modified":"2020-02-18T14:00:26","modified_gmt":"2020-02-18T11:00:26","slug":"vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","title":{"rendered":"A new variant of the Zombieload attack on Intel processors has been identified","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from Graz University of Technology (Austria) revealed<\/a><\/noindex> information about a new side-channel attack method ZombieLoad 2.0<\/a><\/noindex> (CVE-2019-11135<\/a><\/noindex>), which allows the extraction of confidential information from other processes, the operating system, virtual machines, and protected enclaves (TEE, Trusted Execution Environment). The issue affects only Intel processors. Components to block the problem are offered<\/a><\/noindex> in yesterday's microcode update<\/a><\/noindex>. <\/p>\n

The issue belongs to the MDS (Microarchitectural Data Sampling) class and is an enhanced version of disclosed<\/a><\/noindex> in May of the ZombieLoad attack. ZombieLoad 2.0, like other MDS class attacks, relies on using side-channel analysis methods on data within microarchitectural structures (for example, in fill buffers (Line Fill Buffer) and store buffers (Store Buffer), where data used in Load and Store operations is temporarily held).<\/p>\n

The new variation of the Zombieload attack is based<\/a><\/noindex> on a leak that occurs during the operation of the asynchronous interrupt mechanism (TAA, TSX Asynchronous Abort), implemented in the TSX (Transactional Synchronization Extensions) extension, which provides capabilities for working with transactional memory. This allows for improved performance of multithreaded applications by dynamically excluding unnecessary synchronization operations (supporting atomic transactions that can either be committed or aborted). If an interruption occurs, operations performed with the transactional memory region are rolled back.<\/p>\n

Transaction interruption occurs asynchronously, during which other threads may access the cache that is also used in the discarded transactional memory region. From the start to the actual completion of the asynchronous transaction interruption, there may be situations where the processor, during speculative execution of an operation, could read data from internal microarchitectural buffers and pass it to a speculatively executing operation. Then, a conflict will be identified, and the speculative operation will be discarded, but the data will remain in the cache and may be retrieved using side-channel cache recovery methods. <\/p>\n

The attack involves opening TSX transactions and creating conditions for their asynchronous interruption, during which conditions arise for leaking contents of internal buffers, speculatively filled with data from memory read operations executed on the same CPU core. The leak is limited to the current physical CPU core (where the attacker's code is running), but since microarchitectural buffers are shared among different threads in Hyper-Threading mode, it is possible for memory operation leaks executed in other CPU threads to occur. <\/p>\n

Attack is susceptible to<\/a><\/noindex> affects some models of eighth, ninth, and tenth generation Intel Core processors, as well as Intel Pentium Gold, Intel Celeron 5000, Intel Xeon E, Intel Xeon W, and the second generation Intel Xeon Scalable. New Intel processors based on the Cascade Lake microarchitecture, which was originally not susceptible to RIDL and Fallout attacks, are also affected. In addition to Zombieload 2.0, researchers have also identified a way to bypass previously proposed defenses against MDS attacks, based on the use of the VERW instruction to clear the contents of microarchitectural buffers when returning from kernel to user space or when transferring control to the guest system.<\/p>\n

Intel's report states that in systems with heterogeneous workloads, the possibility of conducting the attack is hampered as leaks from microarchitectural structures encompass all activity in the system, and the attacker cannot influence the source of the extracted data; they can only accumulate insights that arise from the leak and attempt to identify useful information among that data, without the ability to deliberately intercept data related to specific memory addresses. Nevertheless, researchers have published exploit prototype<\/a><\/noindex>, operational on Linux and Windows, and demonstrated the possibility of using the attack to determine the hash of the root user's password.
\nIt is possible<\/a><\/noindex> to conduct the attack from a guest system to accumulate data that appears in operations of other guest systems, the host environment, the hypervisor, and Intel SGX enclaves.<\/p>\n

\r\n \"Play\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Patches to block the vulnerability includes<\/a><\/noindex> have been integrated into the Linux kernel code base and are included in the releases \t5.3.11, 4.19.84, 4.14.154, 4.9.201, and 4.4.201<\/a><\/noindex>. Updates with kernel and microcode have also already been released for major distributions (Debian<\/a><\/noindex>, Arch<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Alpine<\/a><\/noindex>, FreeBSD<\/a><\/noindex>). The problem was identified in April and the fix was coordinated by Intel with operating system developers.<\/p>\n

The simplest method for blocking Zombieload 2.0 is to disable TSX support in the CPU. The proposed Linux kernel fix includes several protection options. The first option offers the parameter \"tsx=on\/off\/auto,\" allowing management of TSX extension activation in the CPU (the auto value disables TSX only for vulnerable CPUs). The second protection option is activated using the parameter \"tsx_async_abort=off\/full\/full,nosmt\" and is based on clearing microarchitectural buffers during context switching (the nosmt flag additionally disables SMT\/Hyper-Threads). To check the system's vulnerability, the sysfs parameter \"\/sys\/devices\/system\/cpu\/vulnerabilities\/tsx_async_abort\" is provided.<\/p>\n

In addition, the official blog says nothing about release dates, but the creators shared gameplay fragments from a new demo intended for internal testing.<\/a><\/noindex> microcode has been closed<\/a><\/noindex> another vulnerability<\/a><\/noindex> (CVE-2018-12207<\/a><\/noindex>) in Intel processors, which is also blocked in the latest the official blog says nothing about release dates, but the creators shared gameplay fragments from a new demo intended for internal testing.<\/a><\/noindex> Linux kernel. The vulnerability , rather than taking focus.<\/a><\/noindex> an unprivileged attacker can initiate a denial of service, causing the system to hang in a \"Machine Check Error\" state.
\n The attack can also be performed<\/a><\/noindex> from a guest system.<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u043c \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c ZombieLoad 2.0 (CVE-2019-11135), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u043e\u0432 (TEE, Trusted Execution Environment). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel. \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u044b \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 MDS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A new variant of the Zombieload attack on Intel processors has been discovered | ProHoster","description":"Researchers from Graz University of Technology (Austria)","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 Zombieload \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f)","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:26","updated":"2026-01-24 04:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/52649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=52649"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/52649\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=52649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=52649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=52649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}