{"id":36892,"date":"2019-10-31T22:14:35","date_gmt":"2019-10-31T19:14:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu\/"},"modified":"2019-10-31T22:14:35","modified_gmt":"2019-10-31T19:14:35","slug":"swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","title":{"rendered":"SWAPGS \u2014 uus haavatavus CPU spekulatiivse t\u00e4itmise mehhanismis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bitdefenderi teadlased tuvastasid<\/a><\/noindex> uue haavatavuse (CVE-2019-1125<\/a><\/noindex>) t\u00e4nap\u00e4evaste CPUde spekulatiivse t\u00e4itmise mehhanismis, mis sai nimeks SWAPGS, mis viitab probleemile tekitavale protsessorik\u00e4sklusele. Haavatavus lubab<\/a><\/noindex> v\u00f5imaldab ebautorisatud r\u00fcndajal m\u00e4\u00e4rata tuuma v\u00f5i k\u00e4ivitatud virtuaalmasinate m\u00e4lu alade sisu. Probleem on kinnitatud<\/a><\/noindex> Intel (x86_64) protsessorites ja osaliselt puudutab<\/noindex> AMD protsessorites, mille puhul peamine r\u00fcnnakuvektor ei avaldu. Varasemad meetodid Spectre ja Meltdown haavatavuste vastu ei kaitse SWAPGS r\u00fcnnaku eest Intel protsessoritel, kuid Linuxi, ChromeOS-i, Androidi ja Windowsi jaoks on juba pakutud parandusi.<\/p>\n

Haavatavus kuulub Spectre v1 klassi ja p\u00f5hineb ideel taastada andmeid protsessori vahem\u00e4lust, mis on j\u00e4\u00e4nud p\u00e4rast spetsiifiliste k\u00e4skude spekulatiivset t\u00e4itmist. Kaasaegsete CPU-de harudeprediktsiooniblokid kasutavad j\u00f5udluse suurendamiseks teatud k\u00e4skude eelnevate t\u00e4itmist, mis t\u00f5en\u00e4oliselt t\u00e4idetakse, kuid ei oota, kuni k\u00f5ik t\u00e4itmise m\u00e4\u00e4ravad tegurid on v\u00e4lja arvutatud (n\u00e4iteks siis, kui h\u00fcppeolud v\u00f5i ligip\u00e4\u00e4su parameetrid pole veel v\u00e4lja arvutatud). Kui ennustus ei pea paika, loob protsessor spekulatiivse t\u00e4itmise tulemuse, kuid selle k\u00e4igus t\u00f6\u00f6deldud andmed j\u00e4\u00e4vad protsessori vahem\u00e4lu ja neid saab taastada vahem\u00e4lu sisu kindlaksm\u00e4\u00e4rimise meetodite abil, mis anal\u00fc\u00fcsivad aegade muutust juurde p\u00e4\u00e4semise vahem\u00e4llu salvestatud ja mitte salvestatud andmetele. <\/p>\n

Uue r\u00fcnnaku erip\u00e4ra on seotud lekkega, mis tekib spekulatiivse t\u00e4itmise k\u00e4igus, kus kasutatakse SWAPGS k\u00e4sku. See k\u00e4sk on operatsioonis\u00fcsteemides, et asendada GS registri v\u00e4\u00e4rtus, kui kontrolli suunamine toimub kasutaja ruumist OS-i tuuma (kasutaja ruumis kasutatav GS v\u00e4\u00e4rtus asendatakse tuumaoperatsioonide puhul kasutatava v\u00e4\u00e4rtusega). Linuxi tuumas salvestatakse GS-s per_cpu viit, mida kasutatakse tuumandmete ligip\u00e4\u00e4suks, samas kui kasutaja ruumis on viidatud TLS-ile (Thread Local Storage). <\/p>\n

Kaksikordse SWAPGS-i k\u00e4itamise v\u00e4listamiseks tuumast v\u00e4ljakutse tegemisel tuumaruumi v\u00f5i kui t\u00e4idetakse koodi, mis ei vaja GS registreerimise vahetamist, tehakse kontroll enne k\u00e4sku ja tingimuslik h\u00fcpe. Erakordse t\u00e4itmise mehhanism h\u00fcppab eelnevalt SWAPGS-i k\u00e4skluse koodile, ootamata kontrolli tulemuse kohta, ja kui valitud haru ei kinnitu, visatakse tulemus negatiivselt \u00e4ra. Nii v\u00f5ib tekkida olukord, kus spekulatiivselt valitakse haru, mis ei ole ette n\u00e4htud SWAPGS-i t\u00e4itmiseks, kuid spekulatiivse t\u00e4itmise k\u00e4igus muudetakse GS registri v\u00e4\u00e4rtust SWAPGS k\u00e4skluse kaudu ning seda kasutatakse s\u00f5ltuvates m\u00e4luoperatsioonides, mis j\u00e4\u00e4vad CPU vahem\u00e4llu. <\/p>\n

Uuringutes on v\u00e4lja pakutud kaks r\u00fcnnaku stsenaariumi, mille jaoks on loodud eksploiteerimise protot\u00fc\u00fcbid. Esimene stsenaarium p\u00f5hineb olukorral, kus SWAPGS k\u00e4sklust ei t\u00e4ideta spekulatiivselt, kuigi seda kasutatakse tegelikus t\u00e4itmises, ja teine vastupidine stsenaarium, kus SWAPGS k\u00e4sklus t\u00e4idetakse spekulatiivselt, kuigi see ei peaks tegelikult olema. Iga stsenaariumi jaoks on ette n\u00e4htud kaks r\u00fcnnakuv\u00f5imalust: r\u00fcndaja saab m\u00e4\u00e4rata v\u00e4\u00e4rtuse kindlas aadressis tuumavaldkonnas ja r\u00fcndaja saab otsida kindlat v\u00e4\u00e4rtust juhuslikes aadressides tuumas. R\u00fcnnakute teostamine v\u00f5tab aega ning lekke korral v\u00f5ib eksploiteerimise teostamine kesta mitu tundi. <\/p>\n

\r\n \"Vaata\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Linuxi tuumas on probleem eemaldatud<\/a><\/noindex> SWAPGS-i k\u00e4ivitamise loogika muutmise kaudu (spekulatiivse t\u00e4itmise blokeerimine), sarnaselt muude Spectre v1 klassi haavatavuste parandamisega. Eeldatakse, et lisatud kaitse m\u00f5jutab t\u00fc\u00fcpiliste t\u00f6\u00f6koormuste j\u00f5udlust minimaalselt. Viivitus tekib kasutajaruumi ja kerneliruumi vahetamise etapis, mis v\u00f5ib p\u00f5hjustada j\u00f5udluse langust, n\u00e4iteks rakendusest sagedaste s\u00fcsteemikutsungite t\u00e4itmise v\u00f5i NMI ja katkestuste sagedase genereerimise korral. <\/p>\n

Parandamine n\u00f5uab tuuma uuendamise installimist nii peamises s\u00fcsteemis kui ka k\u00fclalisringkondades, millele j\u00e4rgneb s\u00fcsteemi taask\u00e4ivitamine. Linuxis saab kaitse keelamiseks kasutada suvandit \u00abnospectre_v1\u00bb, mis keelab ka meetmed SWAPGS-i haavatavuse blokeerimiseks. Parandus on saadaval kujul pat\u0161<\/a><\/noindex> Linuxi tuuma jaoks, mis on juba osa versioonidest 4.19.65<\/a><\/noindex>, 5.2.7<\/a><\/noindex>, 4.14.137, 4.9.188 ja 4.4.188. Linuxi jaotiste v\u00e4rskendused pole veel v\u00e4lja antud (Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linuxis<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>). Windowsis lahendati probleem ilma liigse avalikkuse t\u00e4helepanuta juulikuu v\u00e4rskenduses<\/a><\/noindex>. Google valmistas<\/a><\/noindex> parandus 4.19 tuumale, mis on pakitud ChromeOS-i ja Android<\/a><\/noindex>.<\/p>\n

Bitdefenderi teadlaste s\u00f5nul oli Intel probleemist teadlik juba eelmise aasta augustis. Probleem otsustati lahendada tarkvaraliselt, milleks kaasati Microsofti, Google'i ja Linuxi kerneli arendajad. Vanemate Intel'i protsessorite, mis on kuni Ivy Bridge'i p\u00f5lvkonnani, r\u00fcndamine on oluliselt keerulisem, kuna nad ei toeta WRGSBASE k\u00e4sku, mida eksploitis kasutati. ARM, POWER, SPARC, MIPS ja RISC-V s\u00fcsteemid ei ole probleemile vastuv\u00f5tlikud, kuna nad ei toeta SWAPGS k\u00e4sku.<\/p>\n

Probleem ohustab peamiselt Intel protsessorite omanikke \u2014
\n AMD s\u00fcsteemides \u00f5nnestus reprodutseerida ainult teise r\u00fcnnaku stsenaariumi, mis on piiratud spekulatiivse GS registri algv\u00e4\u00e4rtuse t\u00f6\u00f6tlemisega, mida saab kasutada teatud v\u00e4\u00e4rtuste leidmiseks juhuslikes m\u00e4lualadustes. Selle r\u00fcnnakuv\u00f5imaluse blokimisel on piisavalt<\/noindex> on olemasolevad kaitsemeetodid Spectre v1 haavatavuste vastu. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-1125) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 CPU, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0438\u043c\u044f SWAPGS, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043d\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Intel (x86_64) \u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b AMD, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36892","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SWAPGS \u2014 uus haavatavus CPU spekuleeriva teostamise mehhanismis | ProHoster","description":"Bitdefenderi teadlastel on avastanud uue haavatavuse (","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SWAPGS \u2014 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f CPU | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:35+00:00","article:modified_time":"2019-10-31T19:14:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:14:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:22","updated":"2026-01-22 05:14:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}