{"id":35693,"date":"2019-10-31T22:05:48","date_gmt":"2019-10-31T19:05:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya\/"},"modified":"2019-10-31T22:05:48","modified_gmt":"2019-10-31T19:05:48","slug":"uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","title":{"rendered":"Haavatavus AMD SEV-is, mis v\u00f5imaldab tuvastada kr\u00fcpteerimisv\u00f5tmeid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google Cloud'i arendajad tuvastasid<\/a><\/noindex> haavatavus (CVE-2019-9836) AMD SEV (Secure Encrypted Virtualization) tehnoloogia rakenduses, mis v\u00f5imaldab kompromiteerida andmeid, mille kaitseks seda tehnoloogiat kasutatakse. AMD SEV tagab riistvaralise taseme kaudu virtuaalmasinate m\u00e4lukaitse, kus juurdep\u00e4\u00e4s dekr\u00fcpteeritud andmetele on ainult praegusel k\u00fclalisoperatsioonis\u00fcsteemil, samas kui muud virtuaalmasinad ja h\u00fcperviisor saavad selle m\u00e4lu juurde p\u00e4\u00e4semisel ainult kr\u00fcpteeritud andmeid.<\/p>\n

Tuvastatud probleem v\u00f5imaldab t\u00e4ielikult taastada suletud PDH-v\u00f5tme sisu, mis t\u00f6\u00f6deldakse eraldi kaitstud protsessoris PSP (AMD Security Processor), mis pole p\u00f5hios\u00fcsteemile k\u00e4ttesaadav.
\nOlles PDH-v\u00f5ti, suudab r\u00fcndaja seej\u00e4rel taastada seansi v\u00f5tme ja salajase j\u00e4rjestuse, mis m\u00e4\u00e4rati virtuaalmasina loomisel, ning p\u00e4\u00e4seda juurde kr\u00fcpteeritud andmetele. <\/p>\n

Haavatavus tuleneb ebapiisavatest t\u00e4iustustest eliptiliste k\u00f5verate (ECC) rakenduses, mida kasutatakse kr\u00fcpteerimisel, mis v\u00f5imaldab l\u00e4bi viia r\u00fcnnaku<\/a><\/noindex> k\u00f5verparameetrite taastamiseks. Turvatud virtuaalse masina k\u00e4ivitamise k\u00e4igus v\u00f5ib r\u00fcndaja saata k\u00f5verparameetreid, mis ei vasta NISTi soovitatud parameetritele, mis v\u00f5ib viia v\u00e4ikese j\u00e4rgu punktide v\u00e4\u00e4rtuste kasutamiseni privaatv\u00f5tme andmetega tehtavates korrutamiste operatsioonides. <\/p>\n

ECDH protokolli turvalisus olenevalt<\/a><\/noindex> alates j\u00e4rg<\/a><\/noindex> algse k\u00f5verapunkti genereerimisest, mille diskreetne logaritmimine on v\u00e4ga keeruline \u00fclesanne. AMD SEV keskkonna algatamise \u00fches etapis kasutatakse privaatv\u00f5tmega seotud arvutustes kasutaja poolt antud parameetreid. P\u00f5him\u00f5tteliselt teostatakse kahe punkti korrutamine, millest \u00fcks vastab privaatv\u00f5tmele. Kui teine punkt kuulub madala j\u00e4rgu algarvudesse, v\u00f5ib r\u00fcndaja m\u00e4\u00e4rata esimese punkti parameetrid (modulaarses astmetsuunas kasutatava mooduli bitid) k\u00f5iki v\u00f5imalikke v\u00e4\u00e4rtusi l\u00e4bides. Privaats\u00f5nniku m\u00e4\u00e4ramiseks saab seej\u00e4rel sobitatud algarvude fragmentide \u00fchendamiseks kasutada Hiina j\u00e4\u00e4kv\u00f5rrandi teoreemi<\/a><\/noindex>.<\/p>\n

Probleemid m\u00f5jutavad AMD EPYC serveriplatvorme, mis kasutavad SEV p\u00fcsivara kuni versioonini 0.17 build 11. AMD on juba avalikustasin<\/noindex> v\u00e4lja andnud p\u00fcsivara uuenduse, milles on lisatud punktide kasutamise blokeerimine, mis ei vasta NIST-i k\u00f5verale. Samas j\u00e4\u00e4vad varem genereeritud sertifikaadid PDH v\u00f5tmete jaoks kehtivaks, mis v\u00f5imaldab kurjategijal r\u00fcnnata virtuaalmasinate migratsiooni keskkondadesse, mis on kaitstud haavatavuse eest, keskkondadesse, mis on probleemile avatud. Samuti mainitakse v\u00f5imalust r\u00fcnnata p\u00fcsivara versioonide tagasiv\u00f5tmise kaudu vanemale haavatavale v\u00e4ljaandele, kuid seda v\u00f5imalust ei ole veel kinnitatud.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Cloud \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9836) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 AMD SEV (Secure Encrypted Virtualization), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0435. AMD SEV \u043d\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043a\u0443\u0449\u0430\u044f \u0433\u043e\u0441\u0442\u0435\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0438 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35693","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Haavatavus AMD SEV-s, mis v\u00f5imaldab tuvastada kr\u00fcpteerimise v\u00f5tmeid | ProHoster","description":"Google Cloudi arendajad tuvastasid haavatavuse (CVE-2019-9836) AMD SEV (Secure Encrypted Virtualization) tehnoloogia rakenduses, mis v\u00f5imaldab selle tehnoloogia abil kaitstud andmete kompromiteerimist. AMD SEV tagab riistvaraliselt virtuaalmasinate m\u00e4lude l\u00e4bin\u00e4htava kr\u00fcptimise, mille k\u00e4igus on juurdep\u00e4\u00e4s dekodeeritud andmetele ainult k\u00e4esoleval k\u00fclalisoperatsioonis\u00fcsteemil, samas kui teised virtuaalmasinad ja h\u00fcperviisor, p\u00fc\u00fcdes sellele juurde p\u00e4\u00e4seda","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 AMD SEV, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Cloud \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9836) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 AMD SEV (Secure Encrypted Virtualization), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0435. AMD SEV \u043d\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043a\u0443\u0449\u0430\u044f \u0433\u043e\u0441\u0442\u0435\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0438 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:48+00:00","article:modified_time":"2019-10-31T19:05:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35693","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:24:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:57:46","updated":"2026-01-22 00:24:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=35693"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35693\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=35693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=35693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=35693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}