{"id":112031,"date":"2023-12-06T21:10:26","date_gmt":"2023-12-06T19:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati"},"modified":"2023-12-06T21:10:26","modified_gmt":"2023-12-06T19:10:26","slug":"slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","title":{"rendered":"SLAM \u2014 napad na CPU Intel, AMD i ARM koji omogu\u0107ava odre\u0111ivanje sadr\u017eaja memorije","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupa istra\u017eiva\u010da sa Sveu\u010dili\u0161ta u Amsterdamu predstavila je novu tehniku napada SLAM (Spectre Linear Address Masking), koja nudi novi na\u010din iskori\u0161tavanja mikroarhitekturnih ranjivosti klase Spectre, pri \u010demu dolazi do curenja podataka tijekom prevo\u0111enja nekanonicalnih adresa, a za zaobila\u017eenje provjera kanoni\u010dnosti koriste se pro\u0161irenja za maskiranje linearnih adresa dostupna u novim procesorima. Istra\u017eiva\u010di su objavili alat s implementacijom metode i predlo\u017eili demonstraciju koja pokazuje kako se iz memorije jezgre mogu izvu\u0107i podaci koji odgovaraju odre\u0111enoj maski (prikazano je kako u nekoliko desetaka sekundi u Ubuntuu izdvojiti iz memorije jezgre niz s hashom lozinke korisnika root).

\r\n \"Pogledajte\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Napad mo\u017ee biti izvr\u0161en na sustavima s Intel procesorima koji podr\u017eavaju pro\u0161irenje LAM (Linear Address Masking), AMD procesorima s pro\u0161irenjem UAI (Upper Address Ignore) i ARM procesorima s pro\u0161irenjem TBI (Top Byte Ignore). Ta pro\u0161irenja omogu\u0107avaju kori\u0161tenje dijela bitova 64-bitnih pokaziva\u010da za pohranu metapodataka koji nisu povezani s adresiranjem (za obi\u010dne programe nije potrebna tolika memorija da bi mogli adresirati 64-bitne pokaziva\u010de, stoga se gornji bitovi mogu iskoristiti, na primjer, za provjere povezane s osiguranjem sigurnosti). Zanimljivo je da su Intel, AMD i ARM procesori s podr\u0161kom za LAM, UAI i TBI jo\u0161 samo najavljeni, ali se masovno ne proizvode, \u0161to \u010dini SLAM prvim spekulativnim napadom na budu\u0107e CPU-e. Napad se tako\u0111er mo\u017ee izvr\u0161iti na starijim AMD CPU-ima Zen+ i Zen 2, koji su podlo\u017eni ranjivosti CVE-2020-12965. <\/p>\n

Na temelju eksploatacije ranjivosti Spectre, za provo\u0111enje SLAM napada potrebno je da jezgro sadr\u017ei odre\u0111ene nizove instrukcija (gad\u017eete) koji dovode do spekulativnog izvr\u0161avanja instrukcija. Takve instrukcije omogu\u0107uju spekulativno \u010ditanje podataka iz memorije, ovisno o vanjskim uvjetima koje napada\u010d mo\u017ee utjecati. Nakon definiranja pogre\u0161nog predvi\u0111anja, rezultat spekulativnog izvr\u0161avanja se odbacuje, ali obra\u0111eni podaci ostaju u predmemoriji i mogu se kasnije izvu\u0107i analizom putem alternativnih kanala. Za va\u0111enje podataka koji su se zadr\u017eali u predmemoriji, istra\u017eiva\u010di koriste metodu Evict+Reload, koja se temelji na stvaranju uvjeta za istiskivanje podataka iz predmemorije (na primjer, generira se aktivnost koja ravnomjerno puni predmemoriju uobi\u010dajenim sadr\u017eajem) te izvr\u0161avanju operacija \u010dije vrijeme trajanja omogu\u0107ava sudjelovanje o prisutnosti podataka u procesorskoj predmemoriji. <\/p>\n

Za izvo\u0111enje SLAM napada koriste se ure\u0111aji temeljeni na kodu, u kojem se podaci koje kontrolira napada\u010d (dolje varijabla \u00absecret\u00bb) koriste kao pokaziva\u010d. Na primjer: void unmasked_gadget(long **secret) { **secret; } <\/p>\n

Primje\u0107uje se da se sli\u010dni uzorci koda \u010desto koriste u programima; na primjer, u Linux kernelu otkriveno je desetke tisu\u0107a takvih gad\u017eeta, od kojih je najmanje nekoliko stotina prikladnih za kori\u0161tenje u eksploatacijama. Curjenje podataka mo\u017ee se blokirati dodavanjem dodatnih instrukcija u takve gad\u017eete koje blokiraju spekulativno izvr\u0161avanje. Tvrtka Intel planira pru\u017eiti softversku metodu blokiranja curenja prije po\u010detka isporuke procesora s podr\u0161kom za LAM. Tvrtka AMD preporu\u010dila je kori\u0161tenje postoje\u0107ih metoda blokiranja napada klase Spectre v2. Razvija\u010di Linux kernela odlu\u010dili su onemogu\u0107iti podr\u0161ku za LAM prema zadanim postavkama do objave preporuka Intela o blokiranju ranjivosti.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u043d\u0435\u043a\u0430\u043d\u043e\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u043a\u0430\u043d\u043e\u043d\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0432 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043b\u0438\u043d\u0435\u0439\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0442\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112031","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SLAM \u2014 napad na CPU Intel, AMD i ARM, koji omogu\u0107uje odre\u0111ivanje sadr\u017eaja memorije | ProHoster","description":"Grupa istra\u017eiva\u010da s Vrije Univerzitet Amsterdam predstavila je tehniku napada SLAM (Spectre Linear Address Masking), koja nudi novi na\u010din eksploatacije mikroarhitektonskih ranjivosti.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SLAM \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 CPU Intel, AMD \u0438 ARM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-06T19:10:26+00:00","article:modified_time":"2023-12-06T19:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=112031"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112031\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=112031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=112031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=112031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}