{"id":123472,"date":"2025-04-11T15:05:18","date_gmt":"2025-04-11T13:05:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp"},"modified":"2025-04-11T15:05:18","modified_gmt":"2025-04-11T13:05:18","slug":"cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","title":{"rendered":"AMD Zen 5 protsessorid on haavatavad haavatavuse suhtes, mis v\u00f5imaldab mikrokoodi muutmist ja SEV-SNP isolatsiooni \u00fcletamist.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firma AMD on lisanud Zen 5 mikroarhitektuuril p\u00f5hinevad protsessorid toodete loetellu, mis on haavatavad EntrySign haavatavuse suhtes. See haavatavus v\u00f5imaldab m\u00f6\u00f6da minna digitaalse allkirja kontrollimist mikrokoodi v\u00e4rskendamise ajal. Alguses arvestati, et haavatavus m\u00f5jutab ainult AMD protsessoreid, mis p\u00f5hinevad Zen mikroarhitektuuri 1.\u20134. p\u00f5lvkonna versioonidel. Seega on see haavatavus kohaldatav ka sellistele protsessoritele nagu Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen AI 300 (Strix Halo, Strix Point, Krackan Point) ja Ryzen 9000HX (Fire Range). <\/p>\n

Lisaks mikrokoodi v\u00e4rskendusele on SEV-SNP autentimist kasutavates s\u00fcsteemides haavatavuse k\u00f5rvaldamiseks vajalik ka AMD SEV firmware'i v\u00e4rskendamine, mis tuleb BIOS-i v\u00e4rskenduste koosseisus. Teatatakse, et AMD on edastanud seadme tootjatele muudetud firmware'i (ComboAM5PI 1.2.0.3c AGESA), mis on vajalik probleemi lahendamiseks, kuid tarbijatele kergesti ligip\u00e4\u00e4setavad l\u00f5plikud BIOS-i v\u00e4rskendused v\u00f5ivad tootjatelt ilmuda alles n\u00e4dalate v\u00f5i kuude p\u00e4rast. <\/p>\n

AMD t\u00f6\u00f6tajad pakkusid Linuxi tuumikusse lisamiseks pat\u0161i, mis blokeerib mitteametlike mikrokoodi uuenduste laadimise (m\u00e4rgitakse, et \u00f5igesti toimivad mikrokoodi uuendused tuleb installeerida koos seadme tootja BIOS-iga, kuid entusiastide katsetused mitteametlike paranduste loomiseks, mis p\u00f5hinevad BIOS-ist v\u00e4lja l\u00f5igatud mikrokoodi fragmentidel, on juba alanud). Kasutajatele soovitatakse oodata ametlikke BIOS-i uuendusi. <\/p>\n

EntrySigni pakutav haavatavus mikrokoodi muutmise v\u00f5imalusega v\u00f5imaldab kompromiteerida AMD SEV (Secure Encrypted Virtualization) mehhanismi, mida kasutatakse virtualiseerimise s\u00fcsteemides kaitseks. virtuaalmasinad<\/a> k\u00fcberh\u00fcppajate v\u00f5i host-s\u00fcsteemi administraatori sekkumise eest. R\u00fcnnaku k\u00e4igus saab tungida k\u00fclaliss\u00fcsteemide t\u00f6\u00f6le, mida kaitstakse AMD SEV (Secure Encrypted Virtualization) ja SEV-SNP (Secure Nested Paging) laiendustega, mis pakuvad terviklikkuse garantiisid virtuaalmasinate m\u00e4lu osas, isolatsiooni protsessori registrite vahel ja tagavad ohutu t\u00f6\u00f6tamise m\u00e4lulehede pesad. <\/p>\n

Haavatavus tuleneb CMAC'i viidatud autentimise algoritmi kasutamisest, mitte usaldusv\u00e4\u00e4rsest r\u00e4si-funktsioonist protsessi verifitseerimise k\u00e4igus. AMD kasutab allkirjastamiseks RSA privaatv\u00f5tit, et t\u00f5estada protsessorisse laaditava mikrokoodi digitaalset allkirja ning jagab mikrokoodi pat\u0161iga koos avaliku v\u00f5tmega. Et kontrollida, kas avalik v\u00f5ti vastab originaal RSA v\u00f5tme paarile, teostab protsessor hash'i v\u00f5rdlemise AMD avaliku v\u00f5tme hash'iga, mis on CPU-sse tootmise k\u00e4igus kirjutatud, ning pat\u0161is m\u00e4rgitud avaliku v\u00f5tme hash'iga. <\/p>\n

Mikrokoodi autentimine plaastris toimub, v\u00f5rreldes plaastriga kaasasolevat allkirjastatud hash'i (RSASSA-PKCS1-v1_5) ja hash'i, mis on arvutatud tegeliku plaastris esitatava mikrokoodi p\u00f5hjal. Kui viite- ja arvutatud hash'id kattuvad \u2014 laaditakse plaastrid CPU sisemisse m\u00e4llu. Probleem on selles, et soovitatud kr\u00fcptograafiliselt turvaliste hash-funktsioonide asemel on kasutatud algoritmi CMAC, mis ei ole selliste operatsioonide jaoks m\u00f5eldud ja ei kaitse kokkulangevuste leidmise eest. <\/p>\n

CMAC ei ole h\u00e4\u0161\u0161ifunktsioon, vaid rakendab s\u00f5numi autentimise koodi (Message Authentication Code), mis s\u00f5ltub kr\u00fcpteerimisv\u00f5tmetest. AES-CMAC t\u00f6\u00f6 p\u00f5him\u00f5te seisneb kr\u00fcptograafilise algoritmi AES kasutamises ja rakendamise tulemuse \u00fchendamises j\u00e4rgmise andmeplokiga XOR-operatsiooni abil. Selline skeem tagab, et sisendi muutmine toob kaasa ettearvamatud muutused v\u00e4ljundandmetes. Samuti ei ole CMACi lubatud kasutada h\u00e4\u0161\u0161ifunktsioonina, kuna iga\u00fcks, kes teab algset kr\u00fcpteerimisv\u00f5tit, v\u00f5ib teada intermediaarseid kr\u00fcpteerimis seisundeid ja arvutada v\u00e4\u00e4rtusi, mis suudavad kompenseerida sisendi muutust, nii et CMACi rakendamise tulemus j\u00e4\u00e4b samaks. <\/p>\n

AMD kasutab AES-CMAC-i jaoks \u00fchist kr\u00fcptov\u00f5tme, mida tarnitakse k\u00f5igis CPU-des alates Zen 1-st. Seega piisab, kui t\u00f5mmata see v\u00f5ti igast AMD CPU-st, ja see sobib k\u00f5ikidele teistele CPU-dele. Uurijad avastasid, et AES-CMAC-i kr\u00fcpteerimiseks on AMD-s kasutatud tuntud v\u00f5tit, mis on saadud n\u00e4itest, mis on mainitud plokk\u0161ifrite kasutamise soovitustes NIST SP 800-38B. Kuna AES-CMAC-i kasutatakse RSA-v\u00f5tme ja mikrokoodi sisu sisseehitatud allkiri h\u00e4lbena, v\u00f5imaldab AES-CMAC-i kr\u00fcptov\u00f5tme m\u00e4\u00e4ramine asendada pat\u0161is teise avaliku RSA-v\u00f5tme ja muuta mikrokoodi sisu. <\/p>\n

Vale faux-patchi loomis piisab, et genereerida uus avalik v\u00f5ti, mis genereerib sama hajusv\u00e4\u00e4rtuse nagu autentne AMD avalik v\u00f5ti, ja leida digitaalallkirja kollisioonid. Kollisioonid genereeritakse, lisades mikrokoodile lisabloki, mis n\u00e4eb v\u00e4lja nagu juhuslike andmete kogum. Nii saab ette valmistada muudetud patchi mikrokoodi, mis vastab digitaalallkirjale, millega originaalpatch AMD poolt kinnitati. Zentool t\u00f6\u00f6riistakomplekt, mis sisaldab utiliite mikrokoodi anal\u00fc\u00fcsimiseks ja patchide loomiseks mikrokoodi muutmiseks, on saadaval Apache 2.0 litsentsi alusel. Mikrokoodi asendamiseks on vajalik \u00f5iguste olemasolu koodi k\u00e4itamiseks nullkaitser\u00f5ngas (VT-x ja AMD-V tehnoloogiad v\u00f5imaldavad k\u00fclalis\u00fcsteemil t\u00f6\u00f6tada Ring 0 \u00f5igustega).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e CPU AMD \u043d\u0430 \u0431\u0430\u0437\u0435 1-4 \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u0430 \u043a \u0442\u0430\u043a\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c, \u043a\u0430\u043a Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123472","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AMD Zen 5 protsessorid on haavatavad, v\u00f5imaldades mikrokoodi muutmist ja SEV-SNP isolatsiooni \u00fcmbersuunamist | ProHoster","description":"AMD on lisanud Zen 5 mikroarhitektuuril p\u00f5hinevad protsessorid tooteid, mis on alla seadme EntrySign haavatavuste, mis v\u00f5imaldavad digitaalsete allkirjade kontrollimise mehhanismi \u00fcmbersuunamist mikrokoodi uuendamisel. Esialgu arvati, et haavatavus m\u00f5jutab ainult Zen mikroarhitektuuri 1-4 p\u00f5lvkonna AMD protsessoreid. Seet\u00f5ttu osutus haavatavus asjakohaseks ka sellistele protsessoritele nagu Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CPU AMD Zen 5 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0445\u043e\u0434 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 SEV-SNP | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e CPU AMD \u043d\u0430 \u0431\u0430\u0437\u0435 1-4 \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u0430 \u043a \u0442\u0430\u043a\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c, \u043a\u0430\u043a Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-11T13:05:18+00:00","article:modified_time":"2025-04-11T13:05:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123472","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:44:58","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:10:19","updated":"2026-02-09 17:44:58"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=123472"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123472\/revisions"}],"predecessor-version":[{"id":159262,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123472\/revisions\/159262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=123472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=123472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=123472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}