{"id":52649,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel"},"modified":"2020-02-18T14:00:26","modified_gmt":"2020-02-18T11:00:26","slug":"vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","title":{"rendered":"Avastatud on uus Zombieload r\u00fcnne Intel'i protsessorite vastu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grazi Tehnika \u00dclikooli teadlased (Austraalia) avaldasid<\/a><\/noindex> teave uue r\u00fcnnaku meetodi kohta k\u00f5rvalkanalite kaudu ZombieLoad 2.0<\/a><\/noindex> (CVE-2019-11135<\/a><\/noindex>), mis v\u00f5imaldab v\u00e4lja t\u00f5mmata konfidentsiaalset teavet teistest protsessidest, operatsioonis\u00fcsteemist, virtuaalmasinatest ja kaitstud enclave'idest (TEE, Trusted Execution Environment). Probleem m\u00f5jutab ainult Intel'i protsessoreid. Komponendid probleemi blokeerimiseks pakutakse<\/a><\/noindex> eilses mikrokoodi v\u00e4rskenduses<\/a><\/noindex>. <\/p>\n

Probleem kuulub MDS (Microarchitectural Data Sampling) klassi ja on moderniseeritud variant avalikustatud<\/a><\/noindex> mai r\u00fcnnakust ZombieLoad. ZombieLoad 2.0, nagu ka teised MDS klassi r\u00fcnnakud, p\u00f5hinevad k\u00f5rvalkanalite anal\u00fc\u00fcsimeetodite rakendamisel mikroarhitektuuriliste struktuuride andmete suhtes (n\u00e4iteks t\u00e4itebufferites (Line Fill Buffer) ja salvestamisbufferites (Store Buffer), kus ajutiselt hoitakse andmeid, mida kasutatakse Laadi ja Salvestamise operatsioonide t\u00e4itmise k\u00e4igus).<\/p>\n

Uus ZombieLoad r\u00fcnnaku variant p\u00f5hineb<\/a><\/noindex> lekkel, mis tekib operatsioonide as\u00fcnkroonse katkestuse mehhanismi (TAA, TSX Asynchronous Abort) t\u00f6\u00f6tamise ajal, mis on rakendatud TSX-i (Transactional Synchronization Extensions) lisandmoodulis, mis pakub vahendeid tehingum\u00e4luga t\u00f6\u00f6tamiseks, v\u00f5imaldades suurendada mitme kasutajaga rakenduste j\u00f5udlust, v\u00e4listades d\u00fcnaamiliselt liigseid s\u00fcnkroonimisoperatsioone (toetatakse atomaarseid tehinguid, mida v\u00f5ib kas heaks kiita v\u00f5i katkestada). Katkestuse korral t\u00fchistatakse tehingum\u00e4lu piirkonnas tehtud operatsioonid.<\/p>\n

Tehingu katkestamine toimub as\u00fcnkroonselt ning sel ajal v\u00f5ivad teised thread'id p\u00e4\u00e4seda vahem\u00e4lu, mida kasutatakse ka k\u00f5rvaldatud tehingu m\u00e4lupiirkonnas. Ajal, mil tehingu as\u00fcnkroonse katkestamise alguseni ja tegeliku l\u00f5petamiseni, ei saa v\u00e4listada olukordi, kus protsessor spetsiifilise t\u00e4itmise k\u00e4igus v\u00f5ib lugeda andmeid sisemistest mikroarhitektuurilistest bufferitest ja edastada need spetsiifiliselt t\u00e4itmisele suunatud operatsioonile. Seej\u00e4rel avastatakse konflikt ning spetsiifiliselt t\u00e4itmine t\u00fchistatakse, kuid andmed j\u00e4\u00e4vad vahem\u00e4lu ja neid saab v\u00e4lja t\u00f5mmata k\u00f5rvalkanalite j\u00e4rgi taastamise meetoditega. <\/p>\n

R\u00fcnnak koosneb TSX-tehingute avamisest ja tingimuste loomist nende as\u00fcnkroonseks katkestamiseks, mille jooksul v\u00f5ivad ilmneda tingimused sisemiste pufferite sisu lekkimiseks, mis on spekulatiivselt t\u00e4idetud andmetega, mis on seotud sama CPU tuuma poolt teostatavate m\u00e4lu lugemise toimingutega. Leek on piiratud praeguse f\u00fc\u00fcsilise CPU tuumaga (millel r\u00fcndaja kood t\u00f6\u00f6tab), kuid kuna mikroarhitektuurilised puffrid jagavad samaaegselt eri l\u00f5ime, v\u00f5ib Hyper-Threading re\u017eiimis esineda m\u00e4lu toimingute lekkimist, mis toimuvad teistes CPU l\u00f5imedes. <\/p>\n

R\u00fcnnak on altid<\/a><\/noindex> m\u00f5ned Intel Core'i kaheksanda, \u00fcheksanda ja k\u00fcmnenda p\u00f5lvkonna protsessorimudelid, samuti Intel Pentium Gold, Intel Celeron 5000, Intel Xeon E, Intel Xeon W ja II p\u00f5lvkonna Intel Xeon Scalable. R\u00fcnnakule on vastuv\u00f5tlikud ka uued Intel protsessorid, mis p\u00f5hinevad aprillis esitatud mikroarhitektuuril Cascade Lake, mis algselt ei olnud r\u00fcnnakutele RIDL ja Fallout vastuv\u00f5tlikud. Lisaks Zombieload 2.0 on teadlased avastanud ka v\u00f5imaluse Varasemate MDS-r\u00fcnnakute ohjeldamise meetodite ringkihistamiseks, mis p\u00f5hinevad VERW k\u00e4su kasutamisel mikroarhitektuuriliste puhverite sisu puhastamiseks kernelist kasutajaruumi tagasip\u00f6\u00f6rdumise ajal v\u00f5i aegumise juhtimise \u00fcleandmisel k\u00fclg s\u00fcsteemile.<\/p>\n

Intel teatab, et heterogeensete koormustega s\u00fcsteemides on r\u00fcnnaku l\u00e4biviimine keeruline, kuna mikroarhitektuuriliste struktuuride lekked katavad kogu s\u00fcsteemi aktiivsuse ning r\u00fcndaja ei saa m\u00f5jutada andmete allikat, millelt lekke tulemused saadakse, st ta saa vaid koguda lekete tulemuste p\u00f5hjal v\u00e4lja viskunud teavet ja p\u00fc\u00fcda nende andmete seas kasulikku teavet tuvastada, ilma et tal oleks v\u00f5imalik sihip\u00e4raselt vahelesegada andmetega, mis on seotud konkreetsete m\u00e4luaadressidega. Siiski on teadlased avaldanud exploiti protot\u00fc\u00fcbi<\/a><\/noindex>, mis t\u00f6\u00f6tab Linuxis ja Windowsis, ning on demonstreeritud ka r\u00fcnnaku v\u00f5imalust, et m\u00e4\u00e4rata kasutaja root parooli hashing.
\nV\u00f5imalik<\/a><\/noindex> on r\u00fcnnaku l\u00e4biviimine k\u00fclg-s\u00fcsteemist andmete kogumiseks, mis esinevad teiste k\u00fclg-s\u00fcsteemide, host-keskkonna, h\u00fcpervizori ja Intel SGX enklaavide toimingutes.<\/p>\n

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Parandused haavatavuse blokeerimiseks lisakujunduse truuduse fondid OpenType formaadis, mida saab kasutada programmis gnome-terminal (p\u00e4rast HarfBuzz'i kasutusele v\u00f5tmist on t\u00f5usnud probleeme vanade truuduse fontide kasutamisel gnome-terminalis).<\/a><\/noindex> on kantud Linuxi tuuma koodibaasi ja sisalduvad v\u00e4ljaannetes \t5.3.11, 4.19.84, 4.14.154, 4.9.201 ja 4.4.201<\/a><\/noindex>. Tuumade ja mikrokoodi v\u00e4rskendused on juba v\u00e4lja antud p\u00f5hijagude jaoks (Debian<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>). Probleem avastati aprillis ja lahendus koordineeriti Intel'i ja operatsioonis\u00fcsteemide arendajate vahel.<\/p>\n

Lihtsaim Zombieload 2.0 blokeerimise meetod on CPU-s TSX toe v\u00e4ljal\u00fclitamine. Linuxi tuuma jaoks pakutav parandamine sisaldab mitmeid kaitse variante. Esimene variant pakub parameetrit «tsx=on\/off\/auto», mis v\u00f5imaldab hallata TSX laienduse lubamist CPU-s (v\u00e4\u00e4rtus auto v\u00e4ljal\u00fclitab TSX ainult haavatavatele CPU-dele). Teine kaitse variant aktiveeritakse parameetriga «tsx_async_abort=off\/full\/full,nosmt» ja p\u00f5hineb mikroarhitektuursete puhverde puhastamisel konteksti vahetamise ajal (lipp nosmt l\u00fclitab lisaks v\u00e4lja SMT\/Hyper-Threads). S\u00fcsteemi haavatavuse kontrollimise jaoks on sysfs-is ette n\u00e4htud parameeter «\/sys\/devices\/system\/cpu\/vulnerabilities\/tsx_async_abort».<\/p>\n

Lisaks on v\u00e4rskenduses<\/a><\/noindex> mikrokoodi on k\u00f5rvaldatud<\/a><\/noindex> veel \u00fcks haavatavus<\/a><\/noindex> (CVE-2018-12207<\/a><\/noindex>) Intel'i protsessorites, mis on samuti blokeeritud v\u00e4rskes v\u00e4rskenduses<\/a><\/noindex> Linuxi tuumas. Haavatavus kaugelt sulgeda vahekaarte, mis on avatud teistel seadmetel.<\/a><\/noindex> privilegeeritud r\u00fcndaja korraldab teenuse keelamise, mis viib s\u00fcsteemi seiskumiseni «Machine Check Error» seisundis.
\n R\u00fcnnakut saab teostada ka k\u00fclalis\u00fcsteemist.<\/a><\/noindex> \ud83e\udd47Avastatud uus Zombieloadi r\u00fcnnaku variant Intel'i protsessoritele | ProHoster<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u043c \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c ZombieLoad 2.0 (CVE-2019-11135), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u043e\u0432 (TEE, Trusted Execution Environment). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel. \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u044b \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 MDS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uus Zombieload r\u00fcnnak Intel protsessorite vastu | ProHoster","description":"Grazi Tehnika \u00dclikooli teadlased (Austraalia)","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 Zombieload \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f)","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:26","updated":"2026-01-24 04:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=52649"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52649\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=52649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=52649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=52649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}