{"id":105506,"date":"2022-11-09T03:36:39","date_gmt":"2022-11-09T01:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm"},"modified":"2022-11-09T03:36:39","modified_gmt":"2022-11-09T01:36:39","slug":"uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","title":{"rendered":"Vulnerabiliteet UEFI p\u00fcsivara, mis v\u00f5imaldab sooritada koodi SMM tasemel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avalikustatud teave UEFI p\u00fcsivara haavatavuse (CVE-2021-33164) kohta, mis v\u00f5imaldab SMM (System Management Mode) tasemel koodi k\u00e4ivitada, mis on prioriteedilt k\u00f5rgem kui h\u00fcperts\u00fckli re\u017eiim ja nullringikaitsme tase, andes piiramatu juurdep\u00e4\u00e4su kogu s\u00fcsteemi m\u00e4lu. Haavatavus, mille koodnimi on RingHopper, on seotud ajar\u00fcnnakute teostamise v\u00f5imalusega DMA (Direct Memory Access) abil, et kahjustada m\u00e4lu SMM tasemel k\u00e4ivitatavates koodides. Haavatavuse olemasolu on kinnitatud Intel, Dell ja Insyde Software p\u00fcsivara puhul (v\u00e4idetavalt puudutab probleem kokku 8 tootjat, kuid \u00fclej\u00e4\u00e4nud 5 ei ole veel avalikustatud). AMD, Phoenix ja Toshiba p\u00fcsivara ei ole probleemi suhtes haavatavad. <\/p>\n

Haavatavuste \u00e4rakasutamine v\u00f5ib toimuda operatsioonis\u00fcsteemist, kasutades haavatavaid SMI (System Management Interrupt) t\u00f6\u00f6tlejaid, millele juurdep\u00e4\u00e4semiseks on vajalik administraatori \u00f5igused. R\u00fcnnakut saab teostada ka f\u00fc\u00fcsilise juurdep\u00e4\u00e4su korral varajases laadimisfaasis, enne operatsioonis\u00fcsteemi k\u00e4ivitamist. Probleemi blokeerimiseks soovitatakse Linuxi kasutajatel p\u00fcsivara uuendada LVFS (Linux Vendor Firmware Service) teenuse kaudu, kasutades utiliiti fwupdmgr (fwupdmgr get-updates; fwupdmgr update) fwupd paketist. <\/p>\n

Administratiivsete \u00f5iguste vajadus r\u00fcnnaku teostamiseks piirab probleemi ohtu, kuid ei takista selle kasutamist teise taseme haavatavusena, et s\u00e4ilitada oma kohalolek p\u00e4rast teiste s\u00fcsteemi haavatavuste \u00e4rakasutamist v\u00f5i sotsiaalsete inseneritehnikate rakendamist. Juhtimine SMM (Ring -2) tasemel v\u00f5imaldab k\u00e4itada koodi tasemel, mida operatsioonis\u00fcsteem ei kontrolli, mida saab kasutada p\u00fcsivara modifitseerimiseks ja SPI Flashi peidetud pahavara v\u00f5i rootkitide paigaldamiseks, mida operatsioonis\u00fcsteem ei tuvastaks, samuti k\u00e4ivitamise ajal allkirjade kontrollimise (UEFI Secure Boot, Intel BootGuard) keelamiseks ja r\u00fcnnakuteks h\u00fcperts\u00fcklite suhtes, et m\u00f6\u00f6duda virtuaalsete keskkondade terviklikkuse kontrollimismehhanismidest. <\/p>\n

Probleem tuleneb v\u00f5istlusest SMI (System Management Interrupt) t\u00f6\u00f6tlejas, mis ilmneb hetkel, mil kontrollitakse juurdep\u00e4\u00e4su ja p\u00f6\u00f6rdutakse SMRAMi. \u00d5ige hetke m\u00e4\u00e4ramiseks kontrollimise ja kontrollimise tulemuse kasutamise vahel saab kasutada anal\u00fc\u00fcsi kolmandate osapoolte kanalite kaudu DMA abil. L\u00f5puks, as\u00fcnkroonse juurdep\u00e4\u00e4su t\u00f5ttu SMRAM-ile l\u00e4bi DMA, saab r\u00fcndaja m\u00e4\u00e4rata vajaliku hetke ja kirjutada SMRAMi sisu \u00fcle, kasutades DMA-d SMI t\u00f6\u00f6tleja API-d m\u00f6\u00f6da. Protsessorid, mis toetavad Intel-VT ja Intel VT-d mehhanisme, sisaldavad DMA-r\u00fcnnakute kaitset, mis p\u00f5hineb IOMMU (Input-Output Memory Management Unit) rakendamisel, kuid see kaitse on efektiivne ainult r\u00fcnnata valmistatud seadmete abil tehtud riistvaraliste DMA-r\u00fcnnakute blokeerimisel ning ei kaitse SMI t\u00f6\u00f6tlejate kaudu toimuva r\u00fcndamise eest.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105506","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UEFI p\u00fcsivara haavatavus, mis v\u00f5imaldab k\u00e4ivitada koodi SMM tasemel | ProHoster","description":"Avalikustatud teave UEFI p\u00fcsivara haavatavuse (CVE-2021-33164) kohta, mis v\u00f5imaldab k\u00e4ivitada koodi SMM (System Management Mode) tasemel, mis on k\u00f5rgem kui h\u00fcpervisor ja nullkaitse ring.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-09T01:36:39+00:00","article:modified_time":"2022-11-09T01:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=105506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=105506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=105506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=105506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}