{"id":107141,"date":"2023-03-07T12:48:16","date_gmt":"2023-03-07T10:48:16","guid":{"rendered":"https:\/\/prohoster.info\/?p=107141"},"modified":"2023-03-10T11:57:09","modified_gmt":"2023-03-10T09:57:09","slug":"uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","title":{"rendered":"TPM 2.0 referentside rakenduste haavatavused, mis v\u00f5imaldavad p\u00e4\u00e4seda ligi kr\u00fcptokiibi andmetele","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TPM 2.0 (Usaldusv\u00e4\u00e4rse Platvormi Mooduli) standardi viidatud l\u00e4htekoodis on avastatud haavatavused (CVE-2023-1017, CVE-2023-1018), mis v\u00f5imaldavad andmete kirjutamist v\u00f5i lugemist v\u00e4ljaspool eraldatud puhvrit. R\u00fcnnakud, mis suunatakse haavatava koodiga kr\u00fcptoprotsessorite elluviimisele, v\u00f5ivad viia teabe, sealhulgas kr\u00fcptograafiliste v\u00f5tmete v\u00e4lja toomiseni v\u00f5i \u00fcmberkirjutamiseni, mis on salvestatud t\u0161ipi poole. TPM-i p\u00fcsiprogrammi andmete \u00fcmberkirjutamine v\u00f5ib v\u00f5imaldada r\u00fcndajal oma koodi t\u00e4itmist TPM-i kontekstis, mida saab kasutusele v\u00f5tta n\u00e4iteks TPM-i k\u00fclgsete tagaukserakenduste seadmisel, mis ei pruugi olla tuvastatavad operatsioonis\u00fcsteemi poolt. <\/p>\n

Haavatavused tulenevad vale kontrollimise tulemusena funktsiooni CryptParameterDecryption() parameetrite suuruse osas, mis v\u00f5imaldab kirjutada v\u00f5i lugeda kahte bitti v\u00e4ljaspool puhvrit, mida edastatakse ExecuteCommand() funktsioonile ja mis sisaldab TPM 2.0 k\u00e4sku. S\u00f5ltuvalt p\u00fcsiprogrammi elluviimisest v\u00f5ivad \u00fcmberkirjutatavad kaks bitti kahjustada nii kasutamata m\u00e4lu kui ka andmeid v\u00f5i n\u00e4itajaid virnas. <\/p>\n

Haavatavuse \u00e4rakasutamine toimub, saates TPM-moodulile spetsiaalselt vormindatud k\u00e4ske (r\u00fcndajal peab olema juurdep\u00e4\u00e4s TPM-i liidesele). Probleemid on k\u00f5rvaldatud jaanuaris v\u00e4lja antud TPM 2.0 standardi uuenduses (1.59 Errata 1.4, 1.38 Errata 1.13, 1.16 Errata 1.6). <\/p>\n

Haavatav on ka avatud l\u00e4htekoodiga raamatukogu libtpms, mida kasutatakse TPM-moodulite tarkvaraliseks emulatsiooniks ja TPM-i toe integreerimiseks h\u00fcperviisoritesse. Haavatavus on k\u00f5rvaldatud libtpms versioonis 0.9.6.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 TPM 2.0 (Trusted Platform Module) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-1017, CVE-2023-1018), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0438\u043b\u0438 \u0447\u0442\u0435\u043d\u0438\u044e \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0435\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043a\u043e\u0434, \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044e \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0442\u0430\u043a\u043e\u0439 \u043a\u0430\u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 TPM \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107141","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused TPM 2.0 standardi elluviimises, mis v\u00f5imaldavad juurdep\u00e4\u00e4su kr\u00fcptochipi andmetele | ProHoster","description":"TPM 2.0 (Usaldusv\u00e4\u00e4rse Platvormi Mooduli) standardi viidatud l\u00e4htekoodis on avastatud haavatavused (CVE-2023-1017, CVE-2023-1018), mis v\u00f5imaldavad andmete kirjutamist v\u00f5i lugemist v\u00e4ljaspool eraldatud puhvrit.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 TPM 2.0, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0447\u0438\u043f\u0435 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 TPM 2.0 (Trusted Platform Module) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-1017, CVE-2023-1018), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0438\u043b\u0438 \u0447\u0442\u0435\u043d\u0438\u044e \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0435\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-07T10:48:16+00:00","article:modified_time":"2023-03-10T09:57:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/107141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=107141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/107141\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=107141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=107141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=107141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}