{"id":121698,"date":"2025-02-04T09:46:00","date_gmt":"2025-02-04T07:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp"},"modified":"2025-02-04T09:46:00","modified_gmt":"2025-02-04T07:46:00","slug":"uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","title":{"rendered":"CPU AMD mikroprotsessori k\u00e4ivitamise n\u00f5rkus, mis v\u00f5imaldab SEV-SNP isolatsiooni \u00fcletada","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google'i turva-uuringute spetsialistid avaldasid teavet kahjustuse (CVE-2024-56161) kohta AMD protsessorites, mis m\u00f5jutab mikrokoodilaadijat ja v\u00f5imaldab teenindusprotsessorite digitaalsete allkirjade kontrollimise mehhanismi \u00fcletada mikrokoodi uuendamisel. Modifitseeritud mikrokoodi laadimine v\u00f5imaldab ohustada AMD SEV (Secure Encrypted Virtualization) mehhanismi, mis on kasutusel virtualiseerimiss\u00fcsteemides virtuaalmasinate kaitsmiseks h\u00fcperviisori v\u00f5i host-s\u00fcsteemi administraatori sekkumise eest. <\/p>\n

Kahjustus tuleneb turvamata r\u00e4simisfunktsiooni kasutamisest koodis, mis kontrollib digitaalsete allkirjade kehtivust p\u00e4rast mikrokoodi laadimist CPU-sse. R\u00fcnnaku l\u00e4biviimiseks on vajalik kohaliku s\u00fcsteemi administraatori \u00f5iguste olemasolu (v\u00f5imekust k\u00e4itada koodi nulli kaitseringi (ring0) tasemel, mitte virtuaalmasinas). <\/p>\n

R\u00fcnnaku k\u00e4igus on v\u00f5imalik sekkuda k\u00fclalis\u00fcsteemide t\u00f6\u00f6le, mis on kaitstud AMD SEV (Secure Encrypted Virtualization) ja SEV-SNP (Secure Nested Paging) laiendustega, mis pakuvad m\u00e4lu terviklikkuse garantii. virtuaalmasinate<\/a>, isoleerides protsessori registrid ja tagades ohutu t\u00f6\u00f6 sisemiste lehe tabelitega. AMD SEV mehhanism loodi selleks, et andmekeskuste ja pilveteenuste pakkujate personal ei saaks muuta ega anal\u00fc\u00fcsida kaitstud k\u00fclalis\u00fcsteemide m\u00e4lu sisu ega moonutada arvutusi. <\/p>\n

Uuringute meeskond on ette valmistanud protot\u00fc\u00fcbi eksploiti, mis v\u00f5imaldab laadida suvalise mikrokoodi CPU-sse, millel ei ole digitaalset allkirja. Ohtlikkuse demonstreerimiseks on pakutud mikrokoodi uuendust, mis muudab RDRAND k\u00e4skluse t\u00f6\u00f6loogikat, mida kasutatakse \u00fchte allikana entropia genereerimisel pseudojuhuslike numbrite generaatorites, mida kasutatakse v\u00f5tmete loomisel, kr\u00fcptograafiliste operatsioonide t\u00e4itmisel ja juhuslike identifikaatorite genereerimisel. <\/p>\n

Muudatus toob kaasa selle, et RDRAND-i juhend tagastab ainult numbri 4, mitte juhusliku j\u00e4rjekorra. Et v\u00e4ltida p\u00e4ris r\u00fcnnakute tegemist konfidentsiaalsete arvutuste s\u00fcsteemides, nullib muudetud mikrokood CF (carry flag) lipu, st m\u00e4rgib antud v\u00e4\u00e4rtuse vigaseks. T\u00e4iendavad \u00fcksikasjad ja t\u00f6\u00f6riistad muudetud mikrokoodi genereerimiseks plaanitakse avaldada 5. m\u00e4rtsil, et anda kasutajatele aega paranduse installimiseks oma s\u00fcsteemides. Edukas r\u00fcnnaku n\u00e4ide on demonstreeritud serverid<\/a> AMD EPYC 7B13 (Milan) ja AMD Ryzen 9 7940HS (Phoenix) protsessoritega. <\/p>\n

AMD aruandes m\u00e4rgitakse, et haavatavus ilmneb AMD protsessorites, mis p\u00f5hinevad 1-4 p\u00f5lvkonna Zen mikroarhitektuuril. Haavatavuse k\u00f5rvaldamiseks m\u00f5eldud mikrokoodi uuendus anti v\u00e4lja 13. detsembril 2024 AMD EPYC 7001, 7002 ja 7003 (Naples, Rome, Milan ja Milan-X) protsessorite jaoks, 16. detsembril aga AMD EPYC 9004 (Genoa, Genoa-X ja Bergamo\/Siena) protsessorite jaoks. Haavatavuse k\u00f5rvaldamiseks SEV-SNP atesteeringuga s\u00fcsteemides on lisaks vajalik AMD SEV tarkvara uuendamine (mis tuleb koos BIOS uuendustega seadme tootjatelt). <\/p>\n

Lisaks teatakse veel \u00fchest AMD protsessorites esinevast haavatavusest, mis v\u00f5imaldab r\u00fcnnakut k\u00fclgkanalitest, et v\u00e4ljanneerida teavet arvutuste kohta kaitstud k\u00fclgguest s\u00fcsteemides, kus kasutatakse AMD SEV mehhanismi. Probleem m\u00f5jutab 1-4 p\u00f5lvkonna AMD EPYC protsessoreid ja on seotud v\u00f5imega v\u00e4lja t\u00f5mmata protsessori vahem\u00e4lu andmeid, mis settivad kaitstud k\u00fclgguest s\u00fcsteemide t\u00f6\u00f6 ajal. Vahem\u00e4lu sisu anal\u00fc\u00fcsimiseks v\u00f5ib kasutada Prime+Probe meetodit, mis h\u00f5lmab vahem\u00e4lu t\u00e4itmist viidete kogumiga ja muudatuste m\u00e4\u00e4ramist juurdep\u00e4\u00e4suaja m\u00f5\u00f5tmise kaudu, kui seda uuesti t\u00e4idetakse. M\u00e4rgitakse, et r\u00fcnnaku blokeerimiseks sobivad meetodid, mis on varem ette n\u00e4htud kaitseks Spectre t\u00fc\u00fcpi r\u00fcnnakute vastu.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-56161) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0417\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u043e\u0442 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121698","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus mikrokoodi laadijas AMD CPU-des, mis v\u00f5imaldab m\u00f6\u00f6da minna SEV-SNP isolatsioonist | ProHoster","description":"Google'i turvauurijad avaldasid teavet haavatavuse (CVE-2024-56161) kohta AMD protsessorites, mis m\u00f5jutab mikrokoodi laadijat ja v\u00f5imaldab m\u00f6\u00f6da minna digitaalallkiri kontrollimise mehhanismist.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0432 CPU AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e SEV-SNP | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-56161) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-04T07:46:00+00:00","article:modified_time":"2025-02-04T07:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121698","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:40:58","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:18:19","updated":"2026-02-09 17:40:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=121698"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121698\/revisions"}],"predecessor-version":[{"id":159396,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121698\/revisions\/159396"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=121698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=121698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=121698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}