{"id":114955,"date":"2024-04-09T21:31:00","date_gmt":"2024-04-09T19:31:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux"},"modified":"2024-04-09T21:31:00","modified_gmt":"2024-04-09T19:31:00","slug":"novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","title":{"rendered":"Nova BHI napada na Intel CPU, koji omogu\u0107ava zaobila\u017eenje za\u0161tite u Linux jezgri","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupa istra\u017eiva\u010da sa Slobodnog univerziteta u Amsterdamu otkrila je novu metodu napada \u201eNative BHI\u201c (CVE-2024-2201), koja omogu\u0107ava odre\u0111ivanje sadr\u017eaja memorije jezgra Linux na sistemima s Intel procesorima prilikom izvr\u0161avanja eksploita u prostoru korisnika. U slu\u010daju primene napada na sisteme virtualizacije, napada\u010d iz gostuju\u0107e ma\u0161ine mo\u017ee utvrditi sadr\u017eaj memorije host okru\u017eenja ili drugih gostuju\u0107ih sistema. <\/p>\n

Metoda Native BHI nudi druga\u010diju tehniku iskori\u0161tavanja ranjivosti BHI (Branch History Injection, CVE-2022-0001), koja zaobilazi prethodno implementirane na\u010dine za\u0161tite. Metoda napada BHI predlo\u017eena 2022. godine podrazumijevala je iskori\u0161tavanje ranjivosti unutar jednog nivoa privilegija, pri \u010demu se eksploit temeljio na izvo\u0111enju eBPF programa u\u010ditanog od strane korisnika u jezgru. Da bi se blokirala ranjivost, dovoljno je bilo ograni\u010diti pristup izvo\u0111enju koda eBPF za obi\u010dne korisnike. <\/p>\n

Nova metoda Native BHI ne zahteva pristup eBPF-u i omogu\u0107ava napad nepriviligovanom korisniku iz prostora korisnika. Metoda se oslanja na izvr\u0161avanje postoje\u0107ih gadgeta u jezgru \u2014 sekvenci instrukcija koje dovode do spekulativnog izvr\u0161avanja instrukcija. Za pronala\u017eenje odgovaraju\u0107ih gadgeta u jezgru razvijen je poseban alat InSpectre Gadget, koji je prilikom analize jezgra 6.6-rc4 otkrio 1511 Spectre gadgeta i 2105 pomo\u0107nih gadgeta za upravljanje.

\"Nova<\/center> <\/p>\n

Na temelju prona\u0111enih gadgets istra\u017eiva\u010di su pripremili exploit, koji omogu\u0107uje izvla\u010denje iz bafera jezgre niza s he\u0161om lozinke korisnika root, u\u010ditanog iz datoteke \/etc\/shadow. Brzina izvla\u010denja podataka iz memorije jezgre iznosi pribli\u017eno 3.5 Kb u sekundi.

\r\n \"Pogledajte\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Metoda BHI predstavlja pro\u0161irenu varijantu napada Spectre-v2, u kojoj se za zaobila\u017eenje dodanih za\u0161tita (Intel eIBRS i Arm CSV2) i organizaciju curenja podataka koristi umetanje vrijednosti u bafer s globalnom povijesti prijelaza (Branch History Buffer), koji se koristi u CPU-u za pove\u0107anje to\u010dnosti predikcije grananja uzimaju\u0107i u obzir povijest pro\u0161lih prijelaza. Tijekom napada, manipulacijom s povijesti prijelaza stvaraju se uvjeti za neto\u010dne predikcije prijelaza i spekulativno izvr\u0161avanje potrebnih instrukcija, \u010diji rezultati ostaju u predmemoriji. <\/p>\n

Razlike izme\u0111u napada Spectre-v2 svode se na kori\u0161tenje bafer s povije\u0161\u0107u grana (Branch History Buffer) umjesto bafera za prediktivno grananje (Branch Target Buffer). Da bi napada\u010d izvukao podatke iz memorije, mora stvoriti uvjete pod kojima \u0107e se pri izvo\u0111enju spekulativne operacije adresa uzeti iz podru\u010dja koje je potrebno odrediti. Nakon izvo\u0111enja spekulativnog neizravnog skoka, adresa skoka pro\u010ditana iz memorije ostaje u predmemoriji, a za njezino izvla\u010denje mo\u017ee se primijeniti jedan od na\u010dina odre\u0111ivanja sadr\u017eaja predmemorije na temelju analize promjene vremena pristupa predmemoriranim i nepredmemoriranim podacima. <\/p>\n

Protiv napada Native BHI ne \u0161titi primjena instrukcija Intel IBT (Indirect Branch Tracking) i implementirani hibridni mehanizam za\u0161tite tijeka izvr\u0161avanja FineIBT u Linux jezgru, koji kombinira primjenu hardverskih instrukcija IBT i softverske za\u0161tite kCFI (kernel Control Flow Integrity) za blokiranje kr\u0161enja normalnog redoslijeda izvr\u0161avanja (control flow). FineIBT dopu\u0161ta izvo\u0111enje putem neizravne granice samo u slu\u010daju prelaska na instrukciju ENDBR, koja se postavlja na samom po\u010detku funkcije. Dodatno (po analogiji s mehanizmom kCFI) nakon toga se provodi provjera hashova, koja jam\u010di nepromijenjenost pokaziva\u010da. <\/p>\n

Za za\u0161titu od novog varijante napada, u Linux jezgru dodana su pobolj\u0161anja s implementacijom dodatnog re\u017eima za\u0161tite, koji koristi predlo\u017eena hardverska sredstva za\u0161tite tvrtke Intel (BHI_DIS_S) ili alternativnu softversku za\u0161titu, implementiranu za za\u0161titu hipervizora. KVM<\/a>Razvijatelji hipervizora Xen tako\u0111er su objavili ispravak, temeljen na kori\u0161tenju re\u017eima BHI_DIS_S, koji ograni\u010dava predikcije temeljen na povijesti grananja. Podr\u0161ka BHI_DIS_S dostupna je u procesorima, po\u010dev\u0161i od Intel Alder Lake, kao i u poslu\u017eiteljskim CPU-ima, po\u010dev\u0161i od Intel Sapphire Rapids. Dostupan je i softverski re\u017eim za\u0161tite, temeljen na kori\u0161tenju sekvenci za \u010di\u0161\u0107enje bafera povijesti grana, ali on dovodi do izra\u017eenijeg smanjenja performansi.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 «Native BHI» (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u043e\u0436\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0433\u043e\u0441\u0442\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041c\u0435\u0442\u043e\u0434 Native BHI \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u043d\u0443\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114956,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nova varijanta napada BHI na Intel CPU, koja omogu\u0107ava zaobila\u017eenje za\u0161tite u Linux jezgru | ProHoster","description":"Grupa istra\u017eiva\u010da sa Slobodnog sveu\u010dili\u0161ta u Amsterdamu otkrila je novu metodu napada \"Native BHI\" (CVE-2024-2201), koja omogu\u0107ava na sustavima s Intel procesorima odre\u0111ivanje sadr\u017eaja memorije Linux jezgra pri.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 BHI \u043d\u0430 CPU Intel, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 "Native BHI" (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-09T19:31:00+00:00","article:modified_time":"2024-04-09T19:31:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114955","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 21:54:46","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:54:46","updated":"2026-01-22 21:54:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=114955"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114955\/revisions"}],"predecessor-version":[{"id":164266,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114955\/revisions\/164266"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/114956"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=114955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=114955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=114955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}