{"id":101725,"date":"2021-10-22T16:22:55","date_gmt":"2021-10-22T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave"},"modified":"2021-10-22T16:22:55","modified_gmt":"2021-10-22T14:22:58","slug":"ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","title":{"rendered":"R\u00fcnnak Intel SGX-le, mis v\u00f5imaldab konfidentsiaalsete andmete v\u00e4ljav\u00f5tmist v\u00f5i koodi t\u00e4itmist anklaavis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uuringud, mille viisid l\u00e4bi Hiina Rahvavabastuse Armee Kaitse Tehnika \u00dclikooli, Singapuri Rahvus\u00fclikooli ja Z\u00fcrichis asuva \u0160veitsi F\u00f6deraalse Tehnoloogiainstituudi teadlased, on v\u00e4lja t\u00f6\u00f6tanud uue r\u00fcnnakumeetodi Intel SGX (Software Guard eXtensions) isoleeritud anklaavidele. R\u00fcnnaku nimeks on SmashEx ja see on tingitud murest reentrantsuse \u00fcle erandite t\u00f6\u00f6tlemisel Intel SGX runtime komponentide k\u00e4itamise protsessis. Pakutud r\u00fcnnakumeetod annab v\u00f5imaluse, kui operatsioonis\u00fcsteemi all kontrollitakse, tuvastada konfidentsiaalsed andmed, mis asuvad anklaavis, v\u00f5i korraldada oma koodi kopeerimine anklaavi m\u00e4llu ja selle t\u00e4itmine. <\/p>\n

Eksploitide protot\u00fc\u00fcbid on ette valmistatud anklaavide jaoks, mille runtime p\u00f5hineb Intel SGX SDK-l (CVE-2021-0186) ja Microsoft Open Enclave-l (CVE-2021-33767). Esimeses olukorras demonstreeriti RSA-v\u00f5tme v\u00e4ljav\u00f5tmise v\u00f5imalust, mis on kasutusel veebiserveris HTTPS-i jaoks, samas kui teises olukorras \u00f5nnestus tuvastada cURL utiliidi v\u00e4ljund, mis k\u00e4ivitatakse anklaavis. Haavatavus on juba tarkvaraliselt k\u00f5rvaldatud Intel SGX SDK versioonides 2.13 ja Open Enclave versioonis 0.17.1. Lisaks Intel SGX SDK ja Microsoft Open Enclave pakettidele ilmneb haavatavus ka Google Asylo, EdgelessRT, Apache Teaclave, Rust SGX SDK, SGX-LKL, CoSMIX ja Veracruz SDK-des. <\/p>\n

Tuletame meelde, et tehnoloogia SGX (Software Guard Extensions) ilmus Intel Core kuue p\u00f5lvkonna protsessorites (Skylake) ja pakub hulga k\u00e4ske, mis v\u00f5imaldavad eraldada kasutaja taseme rakendustele suletud m\u00e4lualasid - enklave, mille sisu ei saa lugeda ega muuta isegi kernel ja kood, mis t\u00f6\u00f6tab ring0, SMM ja VMM re\u017eiimides. Anklavisse juhtimise \u00fcleandmine ei ole v\u00f5imalik traditsiooniliste h\u00fcpetefunktsioonide ja registrite ning kuhja manipuleerimise kaudu - juhtimise edastamiseks enklavisse kasutatakse spetsiaalselt loodud uusi k\u00e4ske EENTER, EEXIT ja ERESUME, mis teevad volituste kontrolli. Samuti saab anklavisse paigutatud kood kasutada klassikalisi ehk traditsioonilisi meetodeid funktsioonide kutsumiseks enklavis ja spetsiaalset k\u00e4sku v\u00e4list funktsioonide kutsumiseks. Riistvarar\u00fcnnakute, n\u00e4iteks DRAM mooduli \u00fchendamise kaitsmiseks, kasutatakse enklavi m\u00e4lu kr\u00fcpteerimist.

\"R\u00fcnnak<\/center> <\/p>\n

Probleem on seotud sellega, et SGX-tehnoloogia v\u00f5imaldab operatsioonis\u00fcsteemil katkestada enclavi t\u00e4itmise, genereerides riistvaralise erandi, ja enclavides ei ole n\u00f5uetekohaselt rakendatud primitiive sarnaste erandite aatomaarseks t\u00f6\u00f6tlemiseks. Erinevalt operatsioonis\u00fcsteemi tuumast ja tavap\u00e4rastest rakendustest ei p\u00e4\u00e4se enclavide sisene kood primitiivide juurde, et korraldada aatomseid tegevusi, kui t\u00f6\u00f6deldakse as\u00fcnkroonselt tekkivaid erandeid. Ilma nende aatomaarsete primitiivideta v\u00f5ib enclav olla igal ajal katkestatud ja t\u00e4itmisele tagasi saadetud, isegi hetkel, kui enclavis t\u00e4idetakse kriitilisi sektsioone ja see on ebaturvalises seisundis (n\u00e4iteks kui CPU registrid ei ole salvestatud\/taaselustatud).

\"R\u00fcnnak<\/center> <\/p>\n

SGX-tehnoloogia v\u00f5imaldab normaalseks toimimiseks katkestada enclavi t\u00e4itmise konfigureeritavate riistvaraliste eranditega. See omadus v\u00f5imaldab enclavi k\u00e4ituskeskkondadel tegeleda sees-enklaavi erandite t\u00f6\u00f6tlemise v\u00f5i signaalide t\u00f6\u00f6tlemisega, kuid see v\u00f5ib samuti p\u00f5hjustada tagasil\u00f6\u00f6kide vigasid. SmashEx r\u00fcnnak p\u00f5hineb SDK-s esinevate puuduste \u00e4rakasutamisel, mille t\u00f5ttu ei t\u00f6\u00f6deldud erandi k\u00e4sitleja kaudse kutse olukorda n\u00f5uetekohaselt. On oluline, et haavatavuse \u00e4rakasutamiseks peab r\u00fcndajal olema v\u00f5imalus katkestada enclavi t\u00e4itmine, s.t. peab kontrollima s\u00fcsteemikeskkonna t\u00f6\u00f6d. <\/p>\n

P\u00e4rast erandi genereermist saab r\u00fcndaja v\u00e4ikese ajavahemiku, mille jooksul on v\u00f5imalik katkestada t\u00e4itmisvoog sisendparameetrite manipuleerimise kaudu. Eelk\u00f5ige, omades juurdep\u00e4\u00e4su s\u00fcsteemile (keskkonnale v\u00e4ljaspool enclavi), on v\u00f5imalik luua uus erand kohe p\u00e4rast enclavi sisenemise k\u00e4su (EENTER) t\u00e4itmist, mis toob kaasa kontrolli tagastamise s\u00fcsteemile faasis, kus enclavi jaoks virna seadistamine ei ole veel l\u00f5petatud, sealhulgas salvestatakse CPU registrite olek. <\/p>\n

S\u00fcsteem saab seej\u00e4rel hooldada juhtimis\u00f5igust tagasi enklavisse, kuid kuna enklavi kuhja ei olnud katkestuste ajal seadistatud, toimub enklavi t\u00f6\u00f6 kuhja kaudu, mis asub s\u00fcsteemi m\u00e4lus, mida saab kasutada tagasisuunaga programmeerimise (ROP - Return-Oriented Programming) r\u00fcnnaku meetodite rakendamiseks. ROP tehnikat kasutades ei \u00fcritata r\u00fcndaja oma koodi m\u00e4llu paigutada, vaid ta kasutab juba laaditud raamatukogudes olemasolevaid masinakeele k\u00e4ske, mis l\u00f5pevad juhtimise tagastamise k\u00e4suga (tavaliselt need on raamatukogu funktsioonide l\u00f5pp-punktid). Eksploitatsiooni t\u00f6\u00f6 lihtsustub selliste plokkide ('gadgets') kutseketi loomisega, et saavutada vajalik funktsionaalsus.

\"R\u00fcnnak<\/center>
\"R\u00fcnnak<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u043d\u043a\u043b\u0430\u0432\u044b Intel SGX (Software Guard eXtensions). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 SmashEx \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441 \u0440\u0435\u0435\u043d\u0442\u0435\u0440\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u044b runtime-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f Intel SGX. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Intel SGX r\u00fcnne, mis v\u00f5imaldab konfidentsiaalsete andmete eemaldamist v\u00f5i koodi t\u00e4itmist anklavis | ProHoster","description":"Uuringud, mille viivad l\u00e4bi Hiina Rahvaarmee Kaitse Tehnika \u00dclikool, Singapuri Rahvus\u00fclikool ja \u0160veitsi Federal Institute of Technology Z\u00fcrich, on v\u00e4lja t\u00f6\u00f6tanud uue r\u00fcnnaku meetodi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Intel SGX, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432\u0435 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-22T14:22:58+00:00","article:modified_time":"2021-10-22T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-22 14:25:41","updated":"2022-09-28 00:18:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/101726"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}