{"id":53866,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx"},"modified":"2020-02-18T14:01:48","modified_gmt":"2020-02-18T11:01:48","slug":"plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","title":{"rendered":"Plundervolt \u2014 uus Intel'i protsessorite r\u00fcnnaku meetod, mis m\u00f5jutab SGX tehnoloogiat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Intel Corporation vabastas<\/a><\/noindex> mikrokoodi v\u00e4rskendus, mis k\u00f5rvaldab haavatavus<\/a><\/noindex> (CVE-2019-14607), mis v\u00f5imaldab<\/a><\/noindex> manipuleerimise kaudu CPU d\u00fcnaamilise pinge ja sageduse juhtimise mehhanismiga algatada andmealaga rakkude sisu kahjustamist, sealhulgas piirkondades, mida kasutatakse Intel SGX isoleeritud anklavites arvutamisel. R\u00fcnnakut nimetatakse Plundervolt'iks ning see v\u00f5imaldab potentsiaalselt kohalikul kasutajal saada s\u00fcsteemis k\u00f5rgemaid \u00f5igusi, p\u00f5hjustada teenusekatkestusi ja p\u00e4\u00e4seda ligi lukustatud andmetele.<\/p>\n

R\u00fcnnak kujutab ohtu ainult SGX anklavites toimuva arvutamise manipuleerimise kontekstis, kuna selleks on vajalik root-\u00f5iguste olemasolu s\u00fcsteemis. Lihtsaimal juhul v\u00f5ib r\u00fcndaja saavutada v\u00e4\u00e4rinfo sisestamise, mis t\u00f6\u00f6deldakse anklaavis, kuid keerukamate stsenaariumite korral ei v\u00e4listata v\u00f5imalust rekonstrueerida anklavis talletatud sulgemisv\u00f5tmeid, mida kasutatakse RSA-CRT ja AES-NI kr\u00fcpteerimise algoritmide abil. Tehnikat saab kasutada ka algselt korrektsete algoritmide vigade genereerimiseks, et p\u00f5hjustada m\u00e4luga seotud haavatavuste tekkimist, n\u00e4iteks et korraldada juurdep\u00e4\u00e4s m\u00e4lu piire \u00fcletavale alale.
\nR\u00fcnnaku kodeerimise protot\u00fc\u00fcp avaldati<\/a><\/noindex> GitHubis<\/p>\n

Meetodi olemus seisneb asjaolu loomises, et ilmnevad etten\u00e4gematud andmete moonutused SGX arvutuste k\u00e4igus, mille eest ei kaitse m\u00e4lu kr\u00fcpteerimise ja autentimise rakendamine anklavis. Moonutuste tekitamiseks on v\u00f5imalik kasutada tavalisi liideseid, mis kontrollivad sagedust ja pinget, mida tavaliselt rakendatakse s\u00fcsteemi energiatarbimise v\u00e4hendamiseks ootere\u017eiimis ja maksimaalse j\u00f5udluse aktiveerimiseks intensiivsete t\u00f6\u00f6de ajal. Sageduse ja pinge omadused katab kogu kiibi, sealhulgas m\u00f5jutavad arvutuste tegemist isoleeritud anklavis. <\/p>\n

Pinge muutmisega saab luua tingimusi, kus koormus ei ole piisav CPU sees oleva m\u00e4luraku taastamiseks, mis muudab selle v\u00e4\u00e4rtust. Peamine erinevus r\u00fcnnakust RowHammer<\/a><\/noindex> on RowHammer v\u00f5imaldab muuta DRAMi m\u00e4lu individuaalsete bittide sisu, lugedes andmeid naaberlahtritest ts\u00fckliliselt, samas kui Plundervolt v\u00f5imaldab bitsi muutmist CPU sees, kui andmed on juba m\u00e4lust loetud arvutuste teostamiseks. Selline omadus v\u00f5imaldab ringi hiilida SGX-i rakendatud andmete terviklikkuse ja kr\u00fcpteerimise kontrollmehhanismidest, kuna m\u00e4lus olevad v\u00e4\u00e4rtused j\u00e4\u00e4vad \u00f5igeks, kuid v\u00f5ivad operatsioonide k\u00e4igus olla moonutatud enne, kui tulemus salvestatakse m\u00e4llu.<\/p>\n

Kui seda muudetud v\u00e4\u00e4rtust kasutatakse korrutamise k\u00e4igus kr\u00fcpteerimise protsessis, siis tagatakse v\u00e4ljundina vale kr\u00fcpteeritud tekst. Omades ligip\u00e4\u00e4su SGX-i t\u00f6\u00f6tlejale oma andmete kr\u00fcpteerimiseks, saab r\u00fcndaja, p\u00f5hjustades t\u00f5rkeid, koguda statistikat v\u00e4ljundkr\u00fcpteeritud teksti muutuste kohta ja m\u00f5ne minutiga taastada anklaavi salvestatud v\u00f5tme v\u00e4\u00e4rtuse. Sisendtekst ja \u00f5ige kr\u00fcpteeritud tekst v\u00e4ljundis on teada, v\u00f5tmega ei muudeta, ja vale kr\u00fcpteeritud teksti v\u00e4ljund n\u00e4itab, et mingi bitt on moonutatud vastupidiseks v\u00e4\u00e4rtuseks. <\/p>\n

Anal\u00fc\u00fcsides erinevate t\u00f5rkede ajal kogutud korrektsete ja moonutatud kr\u00fcpteeritud tekstide v\u00e4\u00e4rtuste paare, on v\u00f5imalik kasutada t\u00f5rgete differentiaalanal\u00fc\u00fcsi (DFA) meetodeid, Differential Fault Analysis<\/a><\/noindex>) et ennustada<\/a><\/noindex> t\u00f5en\u00e4olisi v\u00f5tmeid, mida kasutatakse AES-i s\u00fcmmeetrilises kr\u00fcpteerimises, ning seej\u00e4rel, anal\u00fc\u00fcsides v\u00f5tmete \u00fchisusi erinevates komplektides, tuvastada otsitav v\u00f5tme.<\/p>\n

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Probleem on seotud erinevate Intel'i protsessorite mudelitega, sealhulgas 6. kuni 10. p\u00f5lvkonna Intel Core CPU-dega, samuti 5. ja 6. p\u00f5lvkonna Xeon E3, 1. ja 2. p\u00f5lvkonna Intel Xeon Scalable, Xeon D,
\n Xeon W ja Xeon E.
\nTuletame meelde, et SGX tehnoloogia (<\/p>\n

Software Guard Extensions) ilmus Intel Core'i protsessorites 6. p\u00f5lvkonna (Skylake) juures ja<\/a><\/noindex>) ilmus Intel Core kuute p\u00f5lvkonda (Skylake) ja pakub<\/a><\/noindex> juhiseid, mis v\u00f5imaldavad kasutaja taseme rakendustele eraldi m\u00e4lupiirkondi - enclaves, mille sisu ei saa lugeda ega muuta isegi kernel ja kood, mis t\u00f6\u00f6tab ring0, SMM ja VMM re\u017eiimides. Anklavisse edastamine ei ole v\u00f5imalik traditsiooniliste \u00fcleminekufunktsioonide ja registrite ning punumistehnikate abil - juhtimise edastamiseks anklavisse kasutatakse spetsiaalselt loodud uut k\u00e4sklust, mis teeb \u00f5iguslikkuse kontrolli. Samuti v\u00f5ib anklavis asuv kood kasutada klassikalisi meetodeid funktsioonide kutsumiseks anklavis ja spetsiaalset k\u00e4sklust v\u00e4liste funktsioonide kutsumiseks. Riistvaraliste r\u00fcnnakute, nagu DRAM mooduli \u00fchendamine, kaitseks kasutatakse anklavi m\u00e4lu kr\u00fcpteerimist.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-14607), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u0435\u043c \u0438 \u0447\u0430\u0441\u0442\u043e\u0442\u043e\u0439 \u0432 CPU \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u044f\u0447\u0435\u0435\u043a \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044f\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u0430\u0445 Intel SGX. \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Plundervolt, \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0437\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53866","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Plundervolt \u2014 uus r\u00fcnnakumeetod Intel'i protsessoritele, mis m\u00f5jutab SGX tehnoloogiat | ProHoster","description":"Intelilt on v\u00e4lja antud mikrokoode uuendus, mis k\u00f5rvaldab","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Plundervolt \u2014 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e SGX | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53866","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:05:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:28","updated":"2026-01-24 09:05:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53866"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53866\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}