{"id":36892,"date":"2019-10-31T22:14:35","date_gmt":"2019-10-31T19:14:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu\/"},"modified":"2019-10-31T22:14:35","modified_gmt":"2019-10-31T19:14:35","slug":"swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","title":{"rendered":"SWAPGS \u2014 uus haavatavus CPU spetsulatiivse t\u00e4itmise mehhanismis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bitdefenderi teadlased tuvastasid<\/a><\/noindex> uue haavatavuse (CVE-2019-1125<\/a><\/noindex>) spetsulatiivse t\u00e4itmise instrutsioonide mehhanismis kaasaegsete CPU-de seas, mille nimi on SWAPGS, mis vastab probleemiks oleva protsessoriinstruktsiooni nimetusele. Haavatavus kaugelt sulgeda vahekaarte, mis on avatud teistel seadmetel.<\/a><\/noindex> v\u00f5imaldab mitteprivileegitud r\u00fcndajal kindlaks teha tuumam\u00e4lu alade v\u00f5i k\u00e4ivitatud virtuaalmasinate sisu. Probleem on kinnitatud<\/a><\/noindex> Intel (x86_64) protsessorites ja osaliselt puudutab<\/noindex> AMD protsessorites, kus peamine r\u00fcndevetor ei avaldu. Varem rakendatud meetodid Spectre ja Meltdown haavatavuste vastu ei kaitse SWAPGS r\u00fcnnaku eest Intel'i protsessoritel, kuid Linuxi, ChromeOS, Androidi ja Windowsi jaoks on juba pakutud parandusi.<\/p>\n

Haavatavus kuulub Spectre v1 klassi ja p\u00f5hineb ideel taastada andmeid protsessorikihist, mis j\u00e4\u00e4b p\u00e4rast spetsulatiivset t\u00e4itmist. Kaasaegsete CPU-de haruennustuse blokid rakendavad teatud instruktsioonide ennetavat t\u00e4itmist, mis t\u00f5en\u00e4oliselt t\u00e4idetakse, kuid ei oota k\u00f5igi t\u00e4itmist m\u00e4\u00e4ravate tegurite arvutamist (n\u00e4iteks kui \u00fclemineku tingimusi v\u00f5i juurdep\u00e4\u00e4suteateid pole veel arvutatud). Kui prognoos ei kinnitu, viskab protsessor v\u00e4lja spekulatiivse t\u00e4itmise tulemuse, kuid selle aja jooksul t\u00f6\u00f6deldud andmed j\u00e4\u00e4vad protsessorikihisse ja neid saab taastada kanalite kaudu, mis anal\u00fc\u00fcsivad vahemaa andmete k\u00e4tte saamise aega. <\/p>\n

Uue r\u00fcnnaku erip\u00e4ra on spekulatiivse t\u00e4itmise instruktsiooni SWAPGS k\u00e4igus tekkiva leke kasutamine, mida kasutatakse operatsioonis\u00fcsteemides registreerija GS v\u00e4\u00e4rtuse asendamiseks, kui juhtimissekkumine toimub kasutajaruumi ja OS tuuma vahel (kasutajaruumi v\u00e4\u00e4rtus GS asendatakse tuuma operatsioonide jaoks kasutatava v\u00e4\u00e4rtusega). Linuxi tuumas hoiab GS per_cpu suunajat, mis on vajalik tuuma andmetele juurdep\u00e4\u00e4suks, ning kasutajaruumi suunajad TLS (Thread Local Storage) jaoks. <\/p>\n

Kaksikordse SWAPGS-k\u00e4skluse v\u00e4ljakutse v\u00e4ltimiseks tuumast ruumi juurde p\u00e4\u00e4semisel v\u00f5i siis, kui t\u00e4idetakse koodi, mis ei n\u00f5ua GS-registeri vahetamist, teostatakse enne k\u00e4skluse kontrollimine ja tingimuslik h\u00fcpe. Spekulatiivse t\u00e4itmise mehhanism l\u00e4heb ette \u00e4ra SWAPGS-k\u00e4su t\u00e4itmisele, ootamata kontrolli tulemusi, ning kui valitud haru ei kinnitu, t\u00f5ukab see tulemuse k\u00f5rvale. Seega v\u00f5ib juhtuda, et spekulatiivselt valitakse haru, mis ei h\u00f5lma SWAPGS-i t\u00e4itmist, kuid spekulatiivse t\u00e4itmise k\u00e4igus muudetakse GS-registeri v\u00e4\u00e4rtust SWAPGS-k\u00e4suga ja seda kasutatakse m\u00e4lu s\u00f5ltuvates operatsioonides, mis j\u00e4\u00e4vad CPU vahem\u00e4llu. <\/p>\n

Uurijad on v\u00e4lja pakkunud kaks r\u00fcnnaku stsenaariumit, mille jaoks on valmistatud eksploitide protot\u00fc\u00fcbid. Esimene stsenaarium p\u00f5hineb olukorral, kus k\u00e4sk SWAPGS ei t\u00e4itu spekulatiivselt, kuigi seda kasutatakse tegeliku t\u00e4itmise ajal, ja teine vastupidi, kus k\u00e4sk SWAPGS t\u00e4itub spekulatiivselt, kuigi tegelikult ei peaks. Iga stsenaariumi puhul on ette n\u00e4htud kaks ekspluiteerimise v\u00f5imalust: r\u00fcndaja saab m\u00e4\u00e4rata v\u00e4\u00e4rtuse kindlas aadressis tuumas ja r\u00fcndaja saab teostada otsingu kindla v\u00e4\u00e4rtuse j\u00e4rele juhuslikel aadressidel tuumas. R\u00fcnnaku teostamine v\u00f5tab palju aega ning lekke korral v\u00f5ib eksploitide kasutusele v\u00f5tmiseks kuluda mitu tundi. <\/p>\n

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Linuxi tuumas probleem on k\u00f5rvaldatud<\/a><\/noindex> SWAPGS-k\u00e4su v\u00e4ljakutse (spekulatiivse t\u00e4itmise blokeerimine) loogika muutmise kaudu, sarnaselt teiste Spectre v1 klassi haavatavuste parandamisega. Arvatakse, et lisatud kaitse m\u00f5jutab minimaalset t\u00fc\u00fcpiliste t\u00f6\u00f6koormuste j\u00f5udlust. Viivitus toimub kasutaja ja tuuma vahelise vahetuse etapis, mis v\u00f5ib p\u00f5hjustada j\u00f5udluse langust, n\u00e4iteks rakenduse kaudu intensiivsete s\u00fcsteemikutsete tegemisel v\u00f5i sagedase NMI ja katkestuste genereerimise korral. <\/p>\n

Parandamine n\u00f5uab kerneliv\u00e4rskenduste installimist nii peamises s\u00fcsteemis kui ka k\u00fclgkeskkondades ning s\u00fcsteemi j\u00e4rgmist taask\u00e4ivitamist. Linuxis kaitse v\u00e4ljal\u00fclitamiseks saab kasutada valikut \u201enospectre_v1\u201d, mis keelab ka meetmed SWAPGS haavatavuse blokeerimiseks. Parandus on saadaval kujul patch<\/a><\/noindex> Linuxi tuuma, mis on juba lisatud v\u00e4ljaannete koosseisu 4.19.65<\/a><\/noindex>, 5.2.7<\/a><\/noindex>, 4.14.137, 4.9.188 ja 4.4.188. V\u00e4rskendusi Linuxi distributsioonide jaoks ei ole veel v\u00e4lja antud (Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>). Windowsis lahendati probleem ilma suurema t\u00e4helepanuta juuli v\u00e4rskenduses<\/a><\/noindex>. Google valmistas<\/a><\/noindex> parandus tuumale 4.19, mis tarnitakse ChromeOS-iga ja Android<\/a><\/noindex>.<\/p>\n

Bitdefenderi teadlaste s\u00f5nul teavitati Intelit probleemist juba eelmisel aastal augustis. Probleemi lahendamine otsustati teha tarkvaraliselt, mille jaoks kaasati koordineeritud parandusprotsessi Microsofti, Google'i ja Linuxi tuuma arendajad. Vanade Intel'i protsessorite, kuni Ivy Bridge'ini, r\u00fcndamine on oluliselt keerulisem WRGSBASE k\u00e4su toetamise puudumise t\u00f5ttu, mis kasutati eksploitides. ARM, POWER, SPARC, MIPS ja RISC-V s\u00fcsteemid ei ole probleemile vastuv\u00f5tlikud, kuna nad ei toeta SWAPGS k\u00e4sku.<\/p>\n

Probleem ohustab peamiselt Intel protsessorite omanikke -
\n AMD s\u00fcsteemides suudeti taastada ainult teine r\u00fcnnaku stsenaarium, mis on piiratud spekulatiivse p\u00f5hregistri GS t\u00f6\u00f6tlemisega, mida saab kasutada teatud v\u00e4\u00e4rtuste leidmiseks juhuslikes m\u00e4lu piirkondades. Selle r\u00fcndevariandi blokeerimiseks piisab<\/noindex> on olemas meetodid, et kaitsta Spectre v1 haavatavuste eest. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-1125) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 CPU, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0438\u043c\u044f SWAPGS, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043d\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Intel (x86_64) \u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b AMD, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SWAPGS \u2014 uus haavatavus CPU spekulatiivse t\u00e4itmise mehhanismis | ProHoster","description":"Bitdefenderi teadlased tuvastasid uue haavatavuse (","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SWAPGS \u2014 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f CPU | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:35+00:00","article:modified_time":"2019-10-31T19:14:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:14:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:22","updated":"2026-01-22 05:14:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}