{"id":123472,"date":"2025-04-11T15:05:18","date_gmt":"2025-04-11T13:05:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp"},"modified":"2025-04-11T15:05:18","modified_gmt":"2025-04-11T13:05:18","slug":"cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","title":{"rendered":"AMD Zen 5 protsessorid on haavatavad haavatavuse suhtes, mis lubab mikroprotsessori koodi muutmist ja SEV-SNP isolatsiooni \u00fcmbers\u00f5itu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

AMD on lisanud Zen 5 mikroarhitektuuril p\u00f5hinevad protsessorid tooteid, mis on vastuv\u00f5tlikud EntrySign haavatavusele, mis v\u00f5imaldab \u00fcmbers\u00f5ita digitaalallkirja kontrollimise mehhanismi mikrokoodi v\u00e4rskendamisel. Alguses arvati, et haavatavus m\u00f5jutab ainult AMD protsessoreid, mis p\u00f5hinevad 1-4 p\u00f5lvkonna Zen mikroarhitektuuril. Seega osutus haavatavus kehtivaks ka sellistele protsessoritele nagu Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen AI 300 (Strix Halo, Strix Point, Krackan Point) ja Ryzen 9000HX (Fire Range). <\/p>\n

Peale mikrokoodi v\u00e4rskenduse on haavatavuse k\u00f5rvaldamiseks s\u00fcsteemides, mis kasutavad SEV-SNP autentimist, samuti vajalik AMD SEV p\u00fcsivara v\u00e4rskendamine, mis on osa BIOS-i v\u00e4rskendustest. Teatavaks on saanud, et AMD on edastanud seadme tootjatele muudetud p\u00fcsivara (ComboAM5PI 1.2.0.3c AGESA), mis on vajalik probleemi lahendamiseks, kuid tarbijatele saadaval olevad l\u00f5plikud BIOS-i v\u00e4rskendused v\u00f5ivad tootjatelt ilmuda alles n\u00e4dalate v\u00f5i kuude p\u00e4rast. <\/p>\n

AMD t\u00f6\u00f6tajad on samuti pakkunud Linuxi tuumasse lisamiseks plaastri, mis blokeerib mitteametlike mikrokoodi v\u00e4rskenduste laadimise (m\u00e4rgitakse, et \u00f5iged mikrokoodi v\u00e4rskendused tuleb installida koos seadme tootja BIOS-iga, kuid entusiastide katsetused mitteametlike paranduste loomiseks, mis p\u00f5hinevad BIOS-ist v\u00e4lja l\u00f5igatud mikrokoodi fragmentidel, on juba alanud). Kasutajatele soovitatakse oodata ametlikke BIOS-i v\u00e4rskendusi. <\/p>\n

EntrySign haavatavuse kaudu antud mikrokoodi muutmise v\u00f5imalus v\u00f5ib ohustada AMD SEV (Secure Encrypted Virtualization) mehhanismi, mida kasutatakse virtualiseerimiss\u00fcsteemide kaitsmiseks virtuaalmasinate<\/a> h\u00fcpervisori v\u00f5i host-s\u00fcsteemi administraatori sekkumise eest. R\u00fcnnaku k\u00e4igus on v\u00f5imalik kaasata kaitstud k\u00fclgs\u00fcsteemide t\u00f6\u00f6, mida kaitsevad AMD SEV (Secure Encrypted Virtualization) ja SEV-SNP (Secure Nested Paging) laiendused, mis pakuvad virtuaalmasinate m\u00e4lutervekuse tagamise garantiisid, eraldades protsessori registrid ja tagades turvalise t\u00f6\u00f6 sisemiste m\u00e4lulehe tabelitega. <\/p>\n

Haavatavus tuleneb CMAC algoritmi mikrokoodi kontrollimise protsessis kasutamisest, mitte usaldusv\u00e4\u00e4rsest hash-funktsioonist. AMD kasutab allkirjastamiseks RSA privaatv\u00f5tit, et kinnitada protsessorisse laaditava mikrokoodi digiallkirja, samas kui mikrokoodipaketiga levitatakse avalikku v\u00f5tit. Kontrollimiseks, et avalik v\u00f5ti vastab originaalsele RSA-v\u00f5tme paarile, v\u00f5rdleb protsessor AMD tootmisprotsessis kinnitatud avaliku v\u00f5tme hash'i mikrokoodi paketis m\u00e4rgitud avaliku v\u00f5tme hash'iga. <\/p>\n

Mikrokoodi autentimine plaastris toimub plaastriga tarnitud r\u00e4siga, mis on kinnitatud digitaalse allkirjaga (RSASSA-PKCS1-v1_5), ja r\u00e4siga, mis on arvutatud tegelikult tarnitud mikrokoodist. Kui viidatud ja arvutatud r\u00e4sid kattuvad \u2014 laaditakse plaastrit CPU sisem\u00e4lu. Probleem on selles, et soovitatud kr\u00fcptograafiliselt turvaliste r\u00e4sifunktsioonide asemel on kasutatud algoritmi CMAC, mis ei ole m\u00f5eldud selliste toimingute jaoks ja ei ole kollisioone v\u00e4ltiv. <\/p>\n

CMAC ei ole hash-funktsioon, vaid realiseerib s\u00f5numi autentimise koodi (Message Authentication Code), mis s\u00f5ltub kr\u00fcpteerimise v\u00f5tme olemasolust. AES-CMAC t\u00f6\u00f6p\u00f5him\u00f5te on kasutada kr\u00fcptograafilist algoritmi AES ja \u00fchendada tulemused j\u00e4rgmise andmeploki abil XOR operatsiooniga. Selline skeem tagab, et sisendandmete muutmine toob kaasa ettearvamatu v\u00e4ljundandmete muutumise. Samas ei ole CMAC'i sobilik kasutada hash-funktsioonina, kuna iga\u00fcks, kes tunneb algset kr\u00fcpteerimisv\u00f5tit, v\u00f5ib teada saada kr\u00fcpteerimise vahelisi olekuid ja arvutada v\u00e4\u00e4rtusi, mis suudavad kompenseerida sisendandmete muutusi, nii et CMAC'i rakendamise tulemus j\u00e4\u00e4b muutumatuks. <\/p>\n

AMD kasutab AES-CMAC-i jaoks \u00fchtset kr\u00fcpteerimisv\u00f5tit, mis tarnitakse k\u00f5ikidesse CPU-desse alates Zen 1. Seega on piisav, et saada see v\u00f5ti mis tahes AMD CPU-st ja see on rakendatav k\u00f5igis teistes CPU-des. Uurijad on avastanud, et AES-CMAC kr\u00fcpteerimiseks on AMD-s kasutatud tuttavat v\u00f5tit, mis on saadud n\u00e4itest, millele viidatakse NIST SP 800-38B soovitustes plokkkr\u00fcptograafia kasutamiseks. Kuna AES-CMAC-i kasutatakse RSA v\u00f5tme ja mikrokoodi sisu allkirjastamise jaoks, t\u00e4hendab AES-CMAC kr\u00fcpteerimisv\u00f5tme m\u00e4\u00e4ramine, et tekkib v\u00f5imalus asendada RSA v\u00f5ti muudatustega ja muuta mikrokoodi sisu. <\/p>\n

Valepat\u0161i loomiseks tuleb vaid genereerida uus avalik v\u00f5ti, mis genereerib sama hash'i, mis originaalne AMD avalik v\u00f5ti, ning leida kollisioonid digitaalse allkirja jaoks. Kollisioonid luuakse, lisades mikrokoodile t\u00e4iendava ploki, mis n\u00e4eb v\u00e4lja nagu juhuslike andmete kogum. Nii saab ette valmistada muudetud pat\u0161i mikrokoodiga, mis vastab originaalse AMD pat\u0161i digitaalallkirjale. Zentooli t\u00f6\u00f6riistakomplekt, mis sisaldab mikrokoodi anal\u00fc\u00fcsi ja pat\u0161ide loomiseks m\u00f5eldud utiliite, on saadaval Apache 2.0 litsentsi alusel. Mikrokoodi asendamiseks on vajalik juurdep\u00e4\u00e4s nullkaitse taseme koodi t\u00e4itmiseks (VT-x ja AMD-V tehnoloogiad v\u00f5imaldavad k\u00fclalisoperatsioonis\u00fcsteemil t\u00f6\u00f6tada Ring 0 \u00f5igustes).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e CPU AMD \u043d\u0430 \u0431\u0430\u0437\u0435 1-4 \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u0430 \u043a \u0442\u0430\u043a\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c, \u043a\u0430\u043a Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123472","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AMD Zen 5 CPU-d on haavatavad, mis v\u00f5imaldab mikrokoodi muutmist ja SEV-SNP isolatsiooni \u00fcletamist | ProHoster","description":"AMD on lisanud Zen 5 mikroarhitektuuril p\u00f5hinevad protsessorid toodete loetellu, mis on haavatavad EntrySign haavatavuse suhtes, mis v\u00f5imaldab m\u00f6\u00f6da minna digitaalallkirja kontrollimise mehhanismist mikrokoodi uuendamisel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CPU AMD Zen 5 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0445\u043e\u0434 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 SEV-SNP | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-11T13:05:18+00:00","article:modified_time":"2025-04-11T13:05:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123472","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:44:58","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:10:19","updated":"2026-02-09 17:44:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=123472"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123472\/revisions"}],"predecessor-version":[{"id":159262,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123472\/revisions\/159262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=123472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=123472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=123472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}