{"id":105506,"date":"2022-11-09T03:36:39","date_gmt":"2022-11-09T01:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm"},"modified":"2022-11-09T03:36:39","modified_gmt":"2022-11-09T01:36:39","slug":"uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","title":{"rendered":"UEFI-firmwaredes esinev haavatavus, mis v\u00f5imaldab k\u00e4ivitada koodi SMM-tasandil.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avalikustatud oli teave haavatavusest (CVE-2021-33164) UEFI p\u00fcsivaramutes, mis v\u00f5imaldab k\u00e4ivitada koodi SMM (System Management Mode) tasemel, mis on k\u00f5rgem kui h\u00fcperviisori re\u017eiim ja nullringi kaitse, andes piiramatu juurdep\u00e4\u00e4su kogu s\u00fcsteemi m\u00e4lule. Haavatavus, mille koodnimi on RingHopper, on seotud v\u00f5imalusega l\u00e4bi viia ajar\u00fcnnak DMA (Direct Memory Access) abil, et kahjustada m\u00e4lus k\u00e4ituvat koodi SMM tasemel. Haavatavuse olemasolu on kinnitatud Intel, Dell ja Insyde Software p\u00fcsivaramutes, \u00f6eldakse, et probleem m\u00f5jutab 8 tootjat, kuid \u00fclej\u00e4\u00e4nud 5 pole veel avalikustatud. AMD, Phoenix ja Toshiba p\u00fcsivaramud ei ole probleemile vastuv\u00f5tlikud. <\/p>\n

Vulnerability exploitation can be performed from the operating system using vulnerable SMI handlers (System Management Interrupt), access to which requires administrative rights. An attack can also be conducted with physical access during the early boot process, prior to the operating system initialization. To mitigate the issue, Linux users are advised to update their firmware using the LVFS (Linux Vendor Firmware Service) by utilizing the fwupdmgr tool (fwupdmgr get-updates; fwupdmgr update) from the fwupd package. <\/p>\n

Administraatori \u00f5iguste vajadus r\u00fcnnaku sooritamiseks piirab probleemi ohtu, kuid ei takista selle kasutamist teise taseme haavatavusena, et s\u00e4ilitada oma kohalolekut p\u00e4rast teiste s\u00fcsteemi haavatavuste \u00e4rakasutamist v\u00f5i sotsiaalmeedia inseneritaktikate rakendamist. Juhtimine SMM (Ring -2) v\u00f5imaldab kodeerimist tasemel, mis ei ole operatsioonis\u00fcsteemile alluv, mis v\u00f5ib v\u00f5imaldada p\u00fcsivaramute muutmist ja salajase pahavara v\u00f5i rootkitide paigaldamist SPI Flash'i, mis ei tuvastata operatsioonis\u00fcsteemi kaudu, samuti k\u00e4ivitamisprotsessi kontrollimise (UEFI Secure Boot, Intel BootGuard) deaktiviseerimist ja h\u00fcperviisorite r\u00fcnnakuid, et v\u00e4ltida virtuaalsete keskkondade terviklikkuse kontrollimise mehhanisme. <\/p>\n

Probleem on tingitud v\u00f5istlusolukorrast SMI (System Management Interrupt) k\u00e4itlejas, mis tekib juurdep\u00e4\u00e4su kontrollimise ja SMRAM-ile juurdep\u00e4\u00e4su hetkel. Vajalikku hetke juurdep\u00e4\u00e4su seisundi kontrollimise ja kontrollimistulemust kasutamise vahel saab m\u00e4\u00e4rata k\u00fclgkanalite anal\u00fc\u00fcsi abil, kasutades DMA-d. L\u00f5pptulemusena, t\u00e4nu as\u00fcnkrioonsele juurdep\u00e4\u00e4sule SMRAM-ile DMA kaudu, suudab r\u00fcndaja leida vajaliku hetke ja kirjutada SMRAM-i sisu \u00fcmber, kasutades DMA-d SMI k\u00e4itleja API-d m\u00f6\u00f6da. Intel-VT ja Intel VT-d mehhanisme toetavad protsessorid sisaldavad DMA-r\u00fcnnete kaitset, mis p\u00f5hineb IOMMU (Input-Output Memory Management Unit) kasutamisel, kuid see kaitse on t\u00f5hus ainult riistvaraliste DMA-r\u00fcnnete blokeerimisel, mis on teostatud r\u00fcndaja ettevalmistatud seadmete abil, ning ei kaitse SMI k\u00e4itlejate kaudu toimuva r\u00fcndamise eest.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105506","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Haavatavus UEFI p\u00fcsivara, mis v\u00f5imaldab t\u00e4ita koodi SMM tasemel | ProHoster","description":"Avastustest, mis kasutavad UEFI p\u00fcsivara, avastati haavatavus (CVE-2021-33164), mis v\u00f5imaldab t\u00e4ita koodi SMM (System Management Mode) tasemel, mis on prioriteedilt k\u00f5rgem kui h\u00fcperviisori ja nullringi kaitse re\u017eiim ning annab piiramatu juurdep\u00e4\u00e4su kogu s\u00fcsteemi m\u00e4lule. Haavatavus, mille koodnimi on RingHopper, on seotud ajah\u00e4kkimise r\u00fcnnaku v\u00f5imaluse ja DMA (Direct Memory Access) kasutamisega kahjustamiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-09T01:36:39+00:00","article:modified_time":"2022-11-09T01:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=105506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=105506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=105506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=105506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}