{"id":101725,"date":"2021-10-22T16:22:55","date_gmt":"2021-10-22T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave"},"modified":"2021-10-22T16:22:55","modified_gmt":"2021-10-22T14:22:58","slug":"ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","title":{"rendered":"R\u00fcnnak Intel SGX vastu, mis v\u00f5imaldab konfidentsiaalsete andmete v\u00e4ljav\u00f5tmist v\u00f5i koodi t\u00e4itmist anklaavis.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kaitse teadlased Hiina Rahvavabastamise Armee Tehnika\u00fclikoolist, Singapuri Rahvus\u00fclikoolist ja Z\u00fcrichi Tehnika\u00fclikoolist on v\u00e4lja t\u00f6\u00f6tanud uue meetodi Intel SGX (Software Guard eXtensions) eraldatud enklaavide r\u00fcndamiseks. R\u00fcnnak sai nimeks SmashEx ja see on p\u00f5hjustatud probleemidest reentrantsi k\u00e4sitlemisel Intel SGX runtime-komponentide t\u00f6\u00f6tamise ajal. Ettepanekud r\u00fcnnakumeetod v\u00f5imaldab, kui operatsioonis\u00fcsteemi on kontrollitud, tuvastada konfidentsiaalseid andmeid, mis asuvad enklaavis, v\u00f5i korraldada oma koodi kopeerimist enklaavi m\u00e4llu ja selle k\u00e4ivitamist. <\/p>\n

Eksploitide protot\u00fc\u00fcbid on ette valmistatud Intel SGX SDK (CVE-2021-0186) ja Microsoft Open Enclave (CVE-2021-33767) baasil t\u00f6\u00f6tavate anklavide jaoks. Esimesel juhul demonstreeriti RSA-v\u00f5tme v\u00e4ljav\u00f5tmise v\u00f5imalust, mida kasutatakse HTTPS-i jaoks veebiserveris, samas kui teisel juhul \u00f5nnestus m\u00e4\u00e4rata cURL utiliidi sisu, mis k\u00e4ivitus anklavis. Haavatavus on juba k\u00f5rvaldatud tarkvarauuudistes Intel SGX SDK 2.13 ja Open Enclave 0.17.1. Peale Intel SGX SDK ja Microsoft Open Enclave ilmus haavatavus ka Google Asylo, EdgelessRT, Apache Teaclave, Rust SGX SDK, SGX-LKL, CoSMIX ja Veracruz SDK-des. <\/p>\n

Tuletame meelde, et tehnoloogia SGX (Software Guard Extensions) ilmus Intel Core kuuenda p\u00f5lvkonna protsessorites (Skylake) ja pakub rida k\u00e4ske, mis v\u00f5imaldavad kasutajatootel luua suletud m\u00e4lupiirkondi - enklave, mille sisu ei saa lugeda ega muuta isegi tuum ja kood, mis t\u00f6\u00f6tab ring0, SMM ja VMM re\u017eiimides. Anklavisse juhtimise \u00fcleandmine pole v\u00f5imalik traditsiooniliste h\u00fcpetefunktsioonide ja registrite ning virnade manipuleerimise kaudu - anklavi juhtimise \u00fcleandmiseks kasutatakse spetsiaalselt loodud uusi k\u00e4ske EENTER, EEXIT ja ERESUME, mis teostavad volituste kontrollimist. Seejuures v\u00f5ib anklavis olev kood kasutada klassikalisi meetodeid funktsioonide kutsub, mis asuvad anklavis, ning eraldi k\u00e4sku v\u00e4liste funktsioonide kutsumiseks. Riistvaragahakkide, n\u00e4iteks DRAM-moduli \u00fchendamise, kaitsmiseks rakendatakse anklavi m\u00e4lu kr\u00fcpteerimist.

\"R\u00fcnnak<\/center> <\/p>\n

Probleem on seotud sellega, et tehnoloogia SGX v\u00f5imaldab operatsioonis\u00fcsteemil katkestada anklaadi t\u00e4itmise, genereerides riistvaralise erandi, kuid anklaites ei ole n\u00f5uetekohaselt rakendatud primitiive sarnaste erandite atomaarseks t\u00f6\u00f6tlemiseks. Erinevalt operatsioonis\u00fcsteemi tuumast ja tavap\u00e4rasest tarkvarast ei ole kood anklaites juurdep\u00e4\u00e4su primitiividele atomaarsete toimingute korraldamiseks as\u00fcnkroonselt esinevate erandite t\u00f6\u00f6tlemise ajal. Ilma nimetatud atomaarsete primitiivide olemasoluta v\u00f5ib anklai igal ajal katkestada ja j\u00e4tkata t\u00e4itmist, isegi hetkel, kui anklaadis t\u00e4idetakse kriitilisi sektsioone ja see on ebausaldusv\u00e4\u00e4rses olekus (n\u00e4iteks kui CPU registrid ei ole salvestatud\/taasalustatud).

\"R\u00fcnnak<\/center> <\/p>\n

SGX-tehnoloogia normaalne toimimine v\u00f5imaldab katkestada anklavide t\u00e4itmise seadistatud riistvaralihenduste abil. See omadus v\u00f5imaldab anklavide runtime-keskkondadel teostada anklavi siseseid erandeid v\u00f5i signaalide t\u00f6\u00f6tlemist, kuid see v\u00f5ib samuti p\u00f5hjustada reentratabluse vigu. SmashEx r\u00fcnnak p\u00f5hineb SDK-s esinevate puuduj\u00e4\u00e4kide \u00e4rakasutamisel, mis takistavad \u00f5igesti erandit\u00f6\u00f6tleja korduvat k\u00e4ivitamist. Oluline on, et r\u00fcnnaku teostamiseks peab r\u00fcndaja suutma katkestada anklavi t\u00e4itmise, st kontrollima s\u00fcsteemikeskkonna toimimist. <\/p>\n

P\u00e4rast erandi genereerimist saab r\u00fcndaja v\u00e4ikese ajavahemiku, mille jooksul saab l\u00e4bi sisendparameetrite manipuleerimise t\u00e4itmise voogu katkestada. Eelk\u00f5ige, kui s\u00fcsteemile (keskkonnale v\u00e4ljaspool enklaavi) on juurdep\u00e4\u00e4s, on v\u00f5imalik kohe p\u00e4rast enklaavi sisenemise k\u00e4su (EENTER) t\u00e4itmist luua uus erand, mis viib juhtimise tagasitoomiseni s\u00fcsteemi etappi, kus enklaavi jaoks ei ole veel virnastamise seadistamine l\u00f5pule viidud, sealhulgas CPU registrite oleku salvestamine. <\/p>\n

S\u00fcsteem v\u00f5ib seej\u00e4rel juhtimise tagasi anklavi anda, kuid kuna anklavi virna ei olnud katkemise ajal seadistatud, toimub anklavi t\u00e4itmine s\u00fcsteemi m\u00e4lus asuva virnaga, mida saab kasutada tagasip\u00f6\u00f6ramise-keskkonnaga seotud r\u00fcnnaku meetodite rakendamiseks (ROP - Return-Oriented Programming). ROP tehnikat kasutades ei \u00fcrita r\u00fcndaja oma koodi m\u00e4llu paigutada, vaid t\u00f6\u00f6tab juba laaditud teekides olevate masinakeele k\u00e4su plokkidega, mis l\u00f5pevad juhtimise tagastamise k\u00e4suga (tavaliselt on need teekide funktsioonide l\u00f5pp). Ekspluataatori t\u00f6\u00f6 seisneb sarnaste plokkide (\"gadgetide\") kutsete ahelate ehitamises, et saada vajalik funktsionaalsus.

\"R\u00fcnnak<\/center>
\"R\u00fcnnak<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u043d\u043a\u043b\u0430\u0432\u044b Intel SGX (Software Guard eXtensions). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 SmashEx \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441 \u0440\u0435\u0435\u043d\u0442\u0435\u0440\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u044b runtime-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f Intel SGX. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnak Intel SGX-le, mis v\u00f5imaldab konfidentsiaalsete andmete v\u00e4ljav\u00f5tmist v\u00f5i koodi k\u00e4ivitamist enklavis | ProHoster","description":"Kuna teadlased Hiina Rahvaarmeedest, Singapuri Rahvus\u00fclikoolist ja Z\u00fcrichi Tehnika\u00fclikoolist v\u00e4lja t\u00f6\u00f6tanud uue r\u00fcnde meetodi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Intel SGX, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432\u0435 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-22T14:22:58+00:00","article:modified_time":"2021-10-22T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-22 14:25:41","updated":"2022-09-28 00:18:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/101726"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}