{"id":121698,"date":"2025-02-04T09:46:00","date_gmt":"2025-02-04T07:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp"},"modified":"2025-02-04T09:46:00","modified_gmt":"2025-02-04T07:46:00","slug":"uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","title":{"rendered":"Viga AMD CPU mikrokoode laadimises, mis v\u00f5imaldab SEV-SNP isolatsiooni \u00fcletamist.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google'i turbeuurimiste meeskond avaldas teavet haavatavuse (CVE-2024-56161) kohta AMD protsessorites, mis m\u00f5jutab mikrokoodi laadimisprotsessi ning v\u00f5imaldab m\u00f6\u00f6da minna digitaalse allkirja kontrollimehhanismist mikrokoodi v\u00e4rskenduste puhul. Muudetud mikrokoodi laadimine v\u00f5ib ohustada AMD SEV (Secure Encrypted Virtualization) mehhanismi, mida kasutatakse virtualiseerimiss\u00fcsteemides virtuaalmasinate kaitsmiseks h\u00fcperviisori v\u00f5i host-s\u00fcsteemi administraatori sekkumise eest. <\/p>\n

Haavatavus on tingitud ebaturvalise r\u00e4si funktsiooni kasutamisest koodis, mis viib l\u00e4bi digitaalse allkirja kontrolli p\u00e4rast mikrokoodi laadimist protsessorisse. R\u00fcnnaku sooritamiseks on vajalik administraatori \u00f5iguste olemasolu kohalikus s\u00fcsteemis (v\u00f5imalus k\u00e4ivitada koodi nullkaitsekihil (ring0), olles mitte virtuaalses masinas). <\/p>\n

R\u00fcnnaku k\u00e4igus on v\u00f5imalik sekkuda AMD SEV (Secure Encrypted Virtualization) ja SEV-SNP (Secure Nested Paging) laienduste abil kaitstud k\u00fclaliss\u00fcsteemide t\u00f6\u00f6korraldusse, mis tagavad m\u00e4lu terviklikkuse. virtuaalmasinad<\/a>, eraldumise protsessori registrid ja tagavad ohutu t\u00f6\u00f6tamise siseteavet p\u00fcsiviidete tabelitega. AMD SEV mehhanisme loodi selleks, et andmekeskuste ja pilveteenuse pakkujate t\u00f6\u00f6tajad ei saaks muuta ega anal\u00fc\u00fcsida kaitstud k\u00fclg- ja s\u00fcsteemide m\u00e4lu sisu ning moonutada arvutusi. <\/p>\n

Uurijad on valmistanud ette eksploitatsiooni protot\u00fc\u00fcbi, mis v\u00f5imaldab laadida juhuslikku mikrokoodi CPU-sse, mis ei ole digitaalallkirjaga kinnitatud. Ohtlikkuse demonstreerimiseks on ettepaneku kohaselt mikrokoodi uuendus, mis muudab RDRAND-i, kui \u00fche allika entropia genereerimise loogikat, mida kasutada valejuhuslikkuse numbrite genereerimisel, mitte vaid v\u00f5tmete vormimise, kr\u00fcptograafiliste operatsioonide tegemise ega juhuslike identifikaatorite genereerimise protsessis. <\/p>\n

Muutmine toob kaasa RDRAND-i k\u00e4su tagastamise ainult numbrile 4, mitte juhuslikule j\u00e4rjestusele. Reaalsete r\u00fcnnakute v\u00e4ltimiseks konfidentsiaalsete arvutuste s\u00fcsteemidele nullib muudetud mikrokood CF-lipu (carry flag), st m\u00e4rgib antud v\u00e4\u00e4rtuse vigaseks. T\u00e4iendavad \u00fcksikasjad ja t\u00f6\u00f6riistad muudetud mikrokoodi genereerimiseks plaanitakse avaldada 5. m\u00e4rtsil, et anda kasutajatele aega oma s\u00fcsteemide parandamiseks. serverite<\/a> AMD EPYC 7B13 (Milan) ja AMD Ryzen 9 7940HS (Phoenix) protsessoritega. <\/p>\n

AMD raportis m\u00e4rgitakse, et haavatavus ilmneb AMD protsessorites, mis p\u00f5hinevad 1-4 p\u00f5lvkonna Zen mikroarhitektuuril. Haavatavust likvideeriv mikrokoodi uuendus anti v\u00e4lja 13. detsembril 2024 AMD EPYC 7001, 7002 ja 7003 seeria (Naples, Rome, Milan ja Milan-X) protsessorite jaoks ning 16. detsembril AMD EPYC 9004 seeria (Genoa, Genoa-X ja Bergamo\/Siena) protsessorite jaoks. SEV-SNP t\u00f5endamisega s\u00fcsteemides haavatavuse k\u00f5rvaldamiseks on vajalik ka AMD SEV p\u00fcsivara uuendus (tuleb koos BIOS-i uuendustega varustajate poolt). <\/p>\n

Teataval on veel \u00fcks haavatavus AMD protsessorites, mis v\u00f5imaldab r\u00fcndajatelt salaja teabe kogumist kaitstud virtuaals\u00fcsteemidest, kasutades AMD SEV mehhanismi. Probleem m\u00f5jutab AMD EPYC 1-4. p\u00f5lvkonna protsessoreid ja on seotud v\u00f5imalusega v\u00e4ljav\u00f5tte tegemiseks protsessori vahem\u00e4lust andmeid, mis kogunevad kaitstud virtuaals\u00fcsteemide t\u00f6\u00f6protsessis. Vahem\u00e4lu sisu anal\u00fc\u00fcsimiseks v\u00f5ib kasutada Prime+Probe meetodit, mis h\u00f5lmab vahem\u00e4lu t\u00e4itmist standardsete v\u00e4\u00e4rtuste komplektiga ja muudatuste m\u00e4\u00e4ramist, m\u00f5\u00f5tes nendele juurde p\u00e4\u00e4semise aega korduvate t\u00e4itmiste kaudu. R\u00fcnnaku blokeerimiseks sobivad meetodid, mida on varem soovitatud Spectre r\u00fcnnakute kaitseks.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-56161) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0417\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u043e\u0442 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121698","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus mikrokoode laadija sees AMD protsessorites, mis v\u00f5imaldab m\u00f6\u00f6da minna SEV-SNP eristamisest | ProHoster","description":"Google'i turva-uuringute meeskond avaldas teavet haavatavuse (CVE-2024-56161) kohta AMD protsessorites, mis puudutab mikrokoode laadimiseks m\u00f5eldud laadijat ja v\u00f5imaldab m\u00f6\u00f6da minna digitaalallkirja kontrollimise mehhanismist mikrokoode v\u00e4rskendamisel. Modifitseeritud mikrokoode laadimine v\u00f5imaldab kahjustada AMD SEV (Secure Encrypted Virtualization) mehhanismi, mida kasutatakse virtualiseerimiss\u00fcsteemides virtuaalmasinate kaitsmiseks h\u00fcperviisori v\u00f5i host-s\u00fcsteemi administraatori sekkumise eest. Haavatavus on p\u00f5hjustatud","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0432 CPU AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e SEV-SNP | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-56161) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0417\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u043e\u0442 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-zagruzchike-mikrokoda-v-cpu-amd-pozvolyayushhaya-obojti-izolyacziyu-sev-snp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-04T07:46:00+00:00","article:modified_time":"2025-02-04T07:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121698","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:40:58","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:18:19","updated":"2026-02-09 17:40:58"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=121698"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121698\/revisions"}],"predecessor-version":[{"id":159396,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121698\/revisions\/159396"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=121698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=121698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=121698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}