{"id":114955,"date":"2024-04-09T21:31:00","date_gmt":"2024-04-09T19:31:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux"},"modified":"2024-04-09T21:31:00","modified_gmt":"2024-04-09T19:31:00","slug":"novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","title":{"rendered":"Uus BHI r\u00fcnnaku variant Intel CPU-le, mis v\u00f5imaldab Linuxi tuuma kaitse \u00fcletamist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Amsterdami vabade \u00fclikooli uurimisr\u00fchm avastas uue r\u00fcnnaku meetodi «Native BHI» (CVE-2024-2201), mis v\u00f5imaldab Intel'i protsessoritega s\u00fcsteemides m\u00e4\u00e4rata Linuxi tuumikum\u00e4lu sisu, kui eksploit toimub kasutajaruumi. Kui r\u00fcnnak on suunatud virtualiseerimiss\u00fcsteemidele, siis r\u00fcndaja k\u00fclastus s\u00fcsteemist saab m\u00e4\u00e4rata host-\u00fcmbruse v\u00f5i teiste k\u00fclastus s\u00fcsteemide m\u00e4lu sisu. <\/p>\n

Native BHI meetod pakub uut tehnikat BHI (Branch History Injection, CVE-2022-0001) haavatavuse \u00e4ra kasutamiseks, mis \u00fcletab varem rakendatud kaitsemeetodeid. 2022. aastal pakutud BHI r\u00fcnnaku meetod tugines haavatavuse \u00e4rakasutamisele \u00fches privileegitasemes, kusjuures exploit p\u00f5hines kasutaja poolt tuuma laaditud eBPF programmi t\u00e4itmisel. Haavatavuse blokeerimiseks piisab, kui piirata juurdep\u00e4\u00e4su koodi eBPF t\u00e4itmiseks tavalistele kasutajatele. <\/p>\n

Uus Native BHI meetod ei n\u00f5ua juurdep\u00e4\u00e4su eBPF-le ja v\u00f5imaldab r\u00fcnnakut teostada mitteprivileegitud kasutajal kasutajaruumist. Meetod p\u00f5hineb olemasolevate tuumakoodis oleva gadgetide t\u00e4ideviimisel — k\u00e4su j\u00e4rjestustel, mis toovad kaasa spekulatiivsete k\u00e4skude t\u00e4itmise. Tuumakoodi sobivate gadgetide otsimiseks on v\u00e4lja t\u00f6\u00f6tatud spetsiaalne t\u00f6\u00f6riist InSpectre Gadget, mis anal\u00fc\u00fcsis tuuma 6.6-rc4 ja tuvastas 1511 Spectre gadgeti ning 2105 abiga gadgeti.

\"Uus<\/center> <\/p>\n

Leitud gadget'ite p\u00f5hjal on teadlased koostanud exploiti, mis v\u00f5imaldab v\u00e4lja v\u00f5tta tuuma puBuffer'itest root kasutaja parooli hash stringi, mis on laaditud failist \/etc\/shadow. Andmete v\u00e4ljav\u00f5tmise kiirus tuuma m\u00e4lu hulgast on umbes 3.5 KB sekundis.

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

BHI meetod on laiendatud versioon Spectre-v2 r\u00fcnnakust, kus andmete lekkimise korraldamiseks ja lisatud kaitse (Intel eIBRS ja Arm CSV2) \u00fcletamiseks kasutatakse globaalset haru ajaloo puhver (Branch History Buffer) v\u00e4\u00e4rtuste asendust, mida kasutatakse CPU-s haru ennustamise t\u00e4psuse suurendamiseks varasemate \u00fcleminekute ajaloo arvestamise kaudu. R\u00fcnnaku k\u00e4igus luuakse haru ajaloo manipuleerimise kaudu vale \u00fclemineku ennustamise ja vajalikud k\u00e4skude spekulatiivse t\u00e4itmise tingimused, mille tulemus j\u00e4\u00e4b vahem\u00e4lu. <\/p>\n

Erinevused Spectre-v2 r\u00fcnnakust seisnevad haru ajaloo puhvriga (Branch History Buffer) t\u00f6\u00f6tamises, mitte harude ennustamise puhvriga (Branch Target Buffer). Andmete v\u00e4ljav\u00f5tmiseks m\u00e4lust peab r\u00fcndaja looma tingimused, kus spekulatiivse toimingu t\u00e4itmisel v\u00f5etakse aadress alalt, mida on vaja t\u00e4psustada. P\u00e4rast spekulatiivset kaudset \u00fcleminekut j\u00e4\u00e4b m\u00e4lust loetud \u00fclemineku aadress vahem\u00e4lu, mille sisu m\u00e4\u00e4ramine v\u00f5ib toimuda, anal\u00fc\u00fcsides juurdep\u00e4\u00e4su ajade muutusi vahem\u00e4lu ja mittevahem\u00e4lu andmetele. <\/p>\n

Native BHI r\u00fcnnaku vastu ei kaitse Intel IBT (Indirect Branch Tracking) k\u00e4sud ja Linuxi tuumas rakendatud h\u00fcbriidmehhanism juhtimisvoo kaitsmiseks FineIBT, mis \u00fchendab IBT riistvara k\u00e4sud ja kCFI (kernel Control Flow Integrity) tarkvara kaitse, et blokeerida normaalsete tegevuste j\u00e4rjekorra rikkumisi (control flow). FineIBT lubab kaudset \u00fcleminekut ainult siis, kui \u00fcleminek toimub ENDBR k\u00e4sule, mis asub funktsiooni alguses. T\u00e4iendavalt (sarnaselt kCFI mehhanismile) toimub kohe j\u00e4rgnevalt hashide kontroll, mis tagab viidete muutumatus. <\/p>\n

Uue t\u00fc\u00fcpi r\u00fcnnaku kaitseks on Linuxi tuuma lisatud muudatus, mis rakendab t\u00e4iendavat kaitsere\u017eiimi, kasutades Intel'i pakutud riistvarakaitsemehhanisme (BHI_DIS_S) v\u00f5i alternatiivset tarkvarakaitset, mis on rakendatud h\u00fcperviisori kaitsmiseks. KVM<\/a>. Xen h\u00fcperviisori arendajad on samuti v\u00e4ljastanud paranduse, mis p\u00f5hineb BHI_DIS_S re\u017eiimi kasutamisel, piirates ennustusi haru ajaloo p\u00f5hjal. BHI_DIS_S toetust on saadaval protsessorites alates Intel Alder Lake'st ning serveri CPU-dest alates Intel Sapphire Rapids'ist. Samuti on saadaval tarkvaraline kaitse re\u017eiim, mis p\u00f5hineb j\u00e4rjestustel haru ajaloo puhvrise puhastamiseks, kuid see toob endaga kaasa m\u00e4rgatava j\u00f5udluse languse.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 «Native BHI» (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u043e\u0436\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0433\u043e\u0441\u0442\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041c\u0435\u0442\u043e\u0434 Native BHI \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u043d\u0443\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114956,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Uus BHI r\u00fcnnaku variant Intel CPU-lt, mis v\u00f5imaldab m\u00f6\u00f6duda Linuxi tuuma kaitsetest | ProHoster","description":"Amsterdam'i Vaba \u00dclikooli teadlaste r\u00fchm avastas uue r\u00fcnnaku meetodi \"Native BHI\" (CVE-2024-2201), mis v\u00f5imaldab Intel'i protsessoritega s\u00fcsteemides m\u00e4\u00e4rata Linuxi tuuma m\u00e4lu sisu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 BHI \u043d\u0430 CPU Intel, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 "Native BHI" (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-09T19:31:00+00:00","article:modified_time":"2024-04-09T19:31:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114955","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 21:54:46","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:54:46","updated":"2026-01-22 21:54:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114955"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114955\/revisions"}],"predecessor-version":[{"id":164266,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114955\/revisions\/164266"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/114956"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}