{"id":120977,"date":"2024-12-13T21:46:00","date_gmt":"2024-12-13T19:46:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd"},"modified":"2024-12-13T21:46:00","modified_gmt":"2024-12-13T19:46:02","slug":"ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","title":{"rendered":"BadRAM r\u00fcnnak, mis v\u00f5imaldab \u00fcletada SEV-SNP atesteerimise mehhanismi AMD CPU-s.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Leuveni, L\u00fcbeki ja Birmingham \u00fclikooli teadlaste grupp t\u00f6\u00f6tas v\u00e4lja BadRAM (CVE-2024-21944) r\u00fcnnaku meetodi, mis v\u00f5imaldab m\u00f6\u00f6duda autentimise mehhanismist ja kompromiteerida keskkondi, mis on kaitstud AMD protsessorite SEV-SNP laiendusega. R\u00fcnnaku sooritamiseks peab r\u00fcndaja, v\u00e4lja arvatud harvadel juhtudel, omama f\u00fc\u00fcsilist juurdep\u00e4\u00e4su m\u00e4lumoodulitele ning olema v\u00f5imeline t\u00e4itma koodi nulltaseme kaitsetasandil (ring0) serveris, kus t\u00f6\u00f6tavad kaitstud k\u00fclgs\u00fcsteemid. <\/p>\n

AMD SEV (Secure Encrypted Virtualization) laiendused on suunatud virtuaalmasinate m\u00e4lute kestvuse tagamisele ning nende kaitsmisele sekkumise ja anal\u00fc\u00fcsi eest, mida suudab teostada host-s\u00fcsteemi administraator, kes suudab t\u00e4ita koodi h\u00fcperviisori tasandil. Alguses piirdus AMD SEV kaitse k\u00fclgs\u00fcsteemi m\u00e4lusisalduse kr\u00fcpteerimise ja registrite eraldamisega, kuid hiljem AMD EPYC protsessorites viidi ellu SEV-SNP (Secure Nested Paging) laiendus, et tagada m\u00e4lulehtede turvaline t\u00f6\u00f6tlemine, mis garanteerib m\u00e4lute kestvuse ja ei v\u00f5imalda h\u00fcperviisoril k\u00fclgs\u00fcsteemi m\u00e4lu muuta. <\/p>\n

AMD SEV-SNP mehhanism loodi selliselt, et mitte \u00fchtegi riigiasutust ega andmekeskuse v\u00f5i pilveteenuse pakkuja t\u00f6\u00f6tajat, kelle halduses on kaitstud k\u00fclgs\u00fcsteemid, ei saaks sekkuda k\u00fclgs\u00fcsteemi toimimisse. Pakutud BadRAM r\u00fcnnaku meetod v\u00f5imaldab m\u00f6\u00f6duda tagatud garantiidest, muutes DDR4 v\u00f5i DDR5 m\u00e4lumoodulite SPD (Serial Presence Detect) metaandmeid. Eduka r\u00fcnnaku korral v\u00f5ib r\u00fcndaja kirjutada \u00fcle k\u00fclgs\u00fcsteemi m\u00e4lus asuva salajase sisu (\u0161ifreeritud tasemel, dekr\u00fcpteerimise v\u00f5imaluseta) ja m\u00f6\u00f6duda autentimise mehhanismist, n\u00e4iteks peites tagaukse virtualiseeritud masinasse, mis on kaitstud SEV-SNP tehnoloogia abil. <\/p>\n

R\u00fcnnaku aluseks on SPD-s vale m\u00e4lumooduli parameetrite esitlemine, mis sunnib protsessorit p\u00f6\u00f6rduma mitteeksisteerivatele aadressidele, mis kajastuvad olemasolevates m\u00e4lupiirkondades. R\u00fcndaja v\u00f5ib SPD-d kohandada nii, et m\u00e4lumoodul tagastab protsessorile suurema suuruse kui m\u00e4lumooduli tegelikud omadused. P\u00e4rast seda v\u00f5ib r\u00fcndaja luua fiktiivse mitteeksisteeriva m\u00e4lu mapa reaalsesse DRAMi piirkonda, mida juba kasutatakse kr\u00fcpteeritud kujul kaitstud k\u00fclalis\u00fcsteemides. Tulemuseks on olukord, kus erinevad aadressid viitavad \u00fchele ja samale f\u00fc\u00fcsilisele m\u00e4lule (kaks piirkonda on peegeldatud \u00fchte DRAM-i piirkonda), st fiktiivse peegeldatud m\u00e4luaadressi kaudu on v\u00f5imalik p\u00e4\u00e4seda ligi juba kasutatavale reaalsele m\u00e4lule ja m\u00f6\u00f6duda CPU m\u00e4lu kaitsemehhanismidest.

\"BadRAM<\/center> <\/p>\n

R\u00fcnnaku teostamiseks piisab lihtsast programmeerijast, mille maksumus on umbes 10 dollarit, mis koosneb Raspberry Pi Pico mikrokontrollerist, DDR4 \/ DDR5 moodulite \u00fchenduslingist ja toiteallikast. R\u00fcnnaku teostamiseks kasutatavad t\u00f6\u00f6riistad, tuuma moodul ja eksploitide protot\u00fc\u00fcbid on \u00fches kohas GitHubis saadaval.

\"BadRAM<\/center> <\/p>\n

M\u00f5nede tootjate kiipide puhul, kus SPD kirjutamise lukustus ei ole aktiveeritud, on r\u00fcnnaku teostamine v\u00f5imalik programmiliselt ilma f\u00fc\u00fcsilise juurdep\u00e4\u00e4suta serverile. N\u00e4iteks on v\u00f5imalik programmiliselt muuta RGB-valgustusega Corsairi m\u00e4lumoodulite parameetreid. T\u00e4iesti programmilise r\u00fcnnaku korral v\u00f5ib s\u00fcsteem olla kompromiteeritud, n\u00e4iteks l\u00e4bi pahatahtliku BIOS-i v\u00e4rskenduse v\u00f5i administraatorite diversioonide kaudu. serverid<\/a> pilveteenustes.

\"BadRAM<\/center> <\/p>\n

Meetodi t\u00f6\u00f6 kinnitamiseks on esitatud kaks r\u00fcnnakut. Esimeses r\u00fcnnakus n\u00e4idatakse v\u00f5imalust taastada \u0161ifreeritud sisu \u2014 AMD SEV kasutamisel hoitakse m\u00e4luandmeid \u0161ifreeritud kujul ning r\u00fcndaja ei saa sisu tuvastada, kuid tal on v\u00f5imalik lugeda \u0161ifreeritud andmeid ja seej\u00e4rel asendada need muu \u0161ifreeritud sisuga. <\/p>\n

Teises r\u00fcnnakus demonstreeriti SEV-SNP sertifitseerimismehhanismi k\u00f5rvaldamise v\u00f5imalust, mis tagab kr\u00fcptograafilise kinnituse virtuaalmasina terviklikkuse osas, kui see t\u00f6\u00f6tab kaitstud keskkonnas. R\u00fcndaja saab haarata \u00f5igesti sertifitseeritud virtuaalmasina aruande ja seej\u00e4rel kasutada seda kompromiteeritud virtuaalmasinaga, n\u00e4iteks varjates tagaukse sissetoomise j\u00e4lgi. <\/p>\n

Probleem puudutab AMD EPYC protsessorite 3. ja 4. p\u00f5lvkonda, mille koodnimed on Milan, Milan-X, Genoa, Bergamo, Genoa-X ja Siena. Haavatavuse blokeerimiseks on AMD juba v\u00e4lja andnud SEV-firmware'i uuenduse, mis sisaldab ALIAS_CHECK kontrolli, mis takistab m\u00e4lu manipuleerimist, mis on seotud k\u00e4sitletava r\u00fcnnakuga. <\/p>\n

Inteli etten\u00e4htud tehnoloogiad Scalable SGX ja TDX ei ole r\u00fcnnakule altti, kuna neis vajalikud kontrollid on algselt olemas. Klassikaline Inteli SGX tehnoloogia, mis 2021. aastal kuulutati Inteli poolt vananenuks, on osaliselt r\u00fcnnakule altti (sarnaselt varasemalt tuntud MemBuster r\u00fcnnakuga, kurjategija saab anal\u00fc\u00fcsida kr\u00fcpteeritud m\u00e4lu juurde p\u00e4\u00e4semisi, see t\u00e4hendab, et on v\u00f5imalik ainult kr\u00fcptoteksti lugemine, kuid mitte selle \u00fcmberkirjutamine). ARM protsessorite CCA (Confidential Compute Architecture) laienduste testimist ei ole l\u00e4bi viidud. <\/p>\n

Lisaks teatatakse veel \u00fchest haavatavusest, mis on seotud AMD SEV-SNP-ga. Haavatavus tuvastati AMD arendatavas QEMU emulaatori harud, mis on ette n\u00e4htud t\u00f6\u00f6tamiseks virtuaalmasinate<\/a> SEV-SNP-iga. Probleem v\u00f5imaldab host-keskkonna administraatoril saada root-juurdep\u00e4\u00e4su k\u00fclaliste s\u00fcsteemidele, manipuleerides ACPI tabelitega. Haavatavus tuleneb sellest, et k\u00fclalise s\u00fcsteemi k\u00e4ivitamisel viiakse l\u00e4bi Linuxi tuuma, algse RAM-diski ja tuuma parameetrite terviklikkuse kontroll, kuid ACPI tabeleid ei arvestata, mille kaudu hypervisor v\u00f5ib esitada spetsiaalselt koostatud AML (ACPI Machine Language) koodi, mis on m\u00f5eldud k\u00e4ivitatavaks k\u00fclaliskeskkonnas. Toodud probleem ei ole konkreetne QEMU suhtes ja seda t\u00e4heldatakse igasugustes hypervisorites ja emulaatorites, kuna Linuxi tuum usaldab igasuguseid ACPI andmeid, mis tulevad hypervisorilt.

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center>
\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0438 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 BadRAM (CVE-2024-21944), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f SEV-SNP \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0437\u0430 \u0440\u0435\u0434\u043a\u0438\u043c \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c, \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u043e\u0434\u0443\u043b\u044f\u043c \u043f\u0430\u043c\u044f\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u043a\u043e\u043b\u044c\u0446\u0430 \u0437\u0430\u0449\u0438\u0442\u044b (ring0) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120978,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120977","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BadRAM r\u00fcnnak, mis v\u00f5imaldab m\u00f6\u00f6da minna AMD CPU SEV-SNP t\u00f5endamise mehhanismist | ProHoster","description":"Leuveni, L\u00fcbecki ja Birminghami \u00fclikoolide teadlaste r\u00fchm on v\u00e4lja t\u00f6\u00f6tanud BadRAM (CVE-2024-21944) r\u00fcnnakumeetodi, mis v\u00f5imaldab m\u00f6\u00f6da minna autentimise mehhanismist ja kompromiteerida keskkondi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 BadRAM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 SEV-SNP \u0432 CPU AMD | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0438 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 BadRAM (CVE-2024-21944), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-13T19:46:02+00:00","article:modified_time":"2024-12-13T19:46:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120977","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:53:19","updated":"2026-02-09 17:38:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=120977"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120977\/revisions"}],"predecessor-version":[{"id":159437,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120977\/revisions\/159437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/120978"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=120977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=120977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=120977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}