{"id":36892,"date":"2019-10-31T22:14:35","date_gmt":"2019-10-31T19:14:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu\/"},"modified":"2019-10-31T22:14:35","modified_gmt":"2019-10-31T19:14:35","slug":"swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","title":{"rendered":"SWAPGS \u2014 nova ranjivost u mehanizmu spekulativnog izvr\u0161avanja CPU-a","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Istra\u017eiva\u010di iz tvrtke Bitdefender otkrile su<\/a><\/noindex> otkrili novu ranjivost (CVE-2019-1125<\/a><\/noindex>) u mehanizmu spekulativnog izvo\u0111enja instrukcija modernih CPU-a, koja je nazvana SWAPGS, prema nazivnoj procesorskoj instrukciji koja uzrokuje problem. Ranjivost omogu\u0107ava<\/a><\/noindex> omogu\u0107ava neprivilegiranom napada\u010du da odredi sadr\u017eaj podru\u010dja memorije jezgre ili pokrenutih virtualnih strojeva. Problem potvr\u0111ena je<\/a><\/noindex> dodiruje Intel procesore (x86_64) i djelomi\u010dno doti\u010de<\/noindex> procesore AMD, za koje se ne manifestira osnovni vektor napada. Ranije implementirani na\u010dini protiv djelovanja ranjivostima Spectre i Meltdown ne \u0161tite od napada SWAPGS na Intel procesorima, ali su za Linux, ChromeOS, Android i Windows ve\u0107 predlo\u017eene ispravke.<\/p>\n

Ranjivost pripada klasi Spectre v1 i temelji se na ideji oporavka podataka iz procesorskih predmemorija, koji ostaju nakon spekulativnog izvo\u0111enja instrukcija. Blokovi predvi\u0111anja skokova modernih CPU-a za pove\u0107anje performansi koriste odga\u0111ano izvr\u0161enje odre\u0111enih instrukcija za koje se vjerojatno o\u010dekuje da \u0107e biti izvr\u0161ene, ali ne \u010dekaju sve \u010dimbenike koji definiraju njihovo izvr\u0161enje (npr. kada uvjeti skoka ili parametri pristupa jo\u0161 nisu izra\u010dunati). Ako predvi\u0111anje nije potvr\u0111eno, procesor odbacuje rezultat spekulativnog izvr\u0161enja, ali podaci obra\u0111eni tijekom tog izvr\u0161enja ostaju u procesorskoj predmemoriji i mogu se oporaviti pomo\u0107u metoda odre\u0111ivanja sadr\u017eaja predmemorije preko bo\u010dnih kanala, koji analiziraju promjene vremena pristupa predmemoriranim i nepodmirenim podacima. <\/p>\n

Osobitost novog napada le\u017ei u kori\u0161tenju curenja koja nastaju tijekom spekulativnog izvr\u0161enja instrukcije SWAPGS, koja se koristi u operativnim sustavima za zamjenu vrijednosti registra GS prilikom prijenosa kontrole iz prostora korisnika u jezgru OS-a (vrijednost GS koja se koristi u prostoru korisnika zamjenjuje se vrijedno\u0161\u0107u koja se koristi u operacijama unutar jezgre). U Linux jezgri, GS sadr\u017ei per_cpu pokaziva\u010d koji se koristi za pristup podacima jezgre, dok su u prostoru korisnika pokaziva\u010di na TLS (Thread Local Storage). <\/p>\n

Kako bi se isklju\u010dila dvostruka aktivacija instrukcije SWAPGS prilikom ponovnog pristupa jezgru iz kernel prostora ili kada se izvr\u0161ava kod koji ne zahtijeva zamjenu registri GS, prije instrukcije se provodi provjera i uvjetna granica. Mehanizam spekulativnog izvr\u0161avanja unaprijed prelazi na izvr\u0161avanje koda s instrukcijom SWAPGS, ne \u010dekaju\u0107i rezultat provjere, i ako odabrana grana nije potvr\u0111ena, odbacuje rezultat. Tako mo\u017ee nastati situacija u kojoj \u0107e spekulativno biti odabrana grana koja ne predvi\u0111a izvr\u0161avanje SWAPGS, ali \u0107e se tijekom spekulativnog izvr\u0161avanja vrijednost registra GS promijeniti instrukcijom SWAPGS i koristiti u zavisnim operacijama s memorijom koje se zadr\u017eavaju u CPU cacheu. <\/p>\n

Istra\u017eiva\u010di su predlo\u017eili dva scenarija napada, za koja su pripremljeni prototipovi eksploitova. Prvi scenarij se oslanja na situaciju kada se instrukcija SWAPGS ne izvr\u0161ava spekulativno, iako se koristi prilikom stvarnog izvr\u0161avanja, dok se drugi scenarij oslanja na suprotno, kada se instrukcija SWAPGS izvr\u0161ava spekulativno, iako zapravo ne bi trebala. Za svaki scenarij su predvi\u0111ena dva varijante eksploatacije: napada\u010d mo\u017ee odrediti vrednost na odre\u0111enoj adresi u oblasti jezgra, i napada\u010d mo\u017ee pretra\u017eivati odre\u0111enu vrednost po slu\u010dajnim adresama u jezgru. Izvo\u0111enje napada zahteva puno vremena i za organizaciju curenja mo\u017ee biti potrebno izvo\u0111enje eksploitova tokom nekoliko sati. <\/p>\n

\r\n \"Pogledajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

U Linux kernelu problem rije\u0161ena<\/a><\/noindex> kroz promjenu logike poziva instrukcije SWAPGS (blokiranje spekulativnog izvr\u0161avanja), analogno ispravci drugih ranjivosti iz klase Spectre v1. Pretpostavlja se da \u0107e dodana za\u0161tita minimalno utjecati na performanse tipi\u010dnih radnih optere\u0107enja. Ka\u0161njenje se javlja u fazi prebacivanja izme\u0111u korisni\u010dkog i kernel prostora, \u0161to mo\u017ee dovesti do smanjenja performansi, na primjer, tijekom intenzivnog izvr\u0161avanja sistemskih poziva iz aplikacije ili \u010destog generiranja NMI i prekida. <\/p>\n

Ispravka zahteva instalaciju a\u017euriranja jezgra kako u glavnom sistemu, tako i u gostuju\u0107im okru\u017eenjima, uz ponovni pokretanje sistema. Za isklju\u010divanje za\u0161tite u Linuxu mo\u017ee se koristiti opcija \u00abnospectre_v1\u00bb, koja tako\u0111e isklju\u010duje mere za blokiranje ranjivosti SWAPGS. Ispravka je dostupna u obliku zakrpe<\/a><\/noindex> za jezgru Linux, koja je ve\u0107 uklju\u010dena u izdanja 4.19.65<\/a><\/noindex>, 5.2.7<\/a><\/noindex>, 4.14.137, 4.9.188 i 4.4.188. A\u017euriranja za distribucije Linux jo\u0161 uvijek nisu objavljena (Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>). U Windowsima je problem tiho rije\u0161en u srpnjskom a\u017euriranju<\/a><\/noindex>. Tvrtka Google pripremila<\/a><\/noindex> ispravila je jezgru 4.19, isporu\u010denu u ChromeOS i Android<\/a><\/noindex>.<\/p>\n

Prema tvrdnjama istra\u017eiva\u010da iz tvrtke Bitdefender, Intel je bio obavije\u0161ten o problemu jo\u0161 u kolovozu pro\u0161le godine. Problem je odlu\u010deno rije\u0161iti programerski, pri \u010demu su u koordiniranu izradu ispravka uklju\u010deni programeri iz Microsofta, Googlea i jezgre Linux. Stari Intelovi procesori, do Ivy Bridge, znatno su te\u017ei za napad zbog nedostatka podr\u0161ke za instrukciju WRGSBASE, kori\u0161tenu u eksploitu. Sustavi ARM, POWER, SPARC, MIPS i RISC-V nisu pogo\u0111eni problemom, jer ne podr\u017eavaju instrukciju SWAPGS.<\/p>\n

Problem prete\u017eno ugro\u017eava vlasnike Intel procesora \u2014
\n na sustavima AMD uspjelo se reproducirati samo drugi scenarij napada, ograni\u010den na spekulativno procesiranje osnovne vrijednosti registra GS, \u0161to se mo\u017ee iskoristiti za tra\u017eenje odre\u0111enih vrijednosti u slu\u010dajnim podru\u010djima memorije. Za blokiranje ovog napada dovoljno je<\/noindex> postoje\u0107i na\u010dini za\u0161tite od ranjivosti Spectre v1. <\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-1125) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 CPU, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0438\u043c\u044f SWAPGS, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043d\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Intel (x86_64) \u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b AMD, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SWAPGS \u2014 nova ranjivost u mehanizmu spekulativnog izvr\u0161avanja CPU | ProHoster","description":"Istra\u017eiva\u010di iz tvrtke Bitdefender otkrili su novu ranjivost (","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SWAPGS \u2014 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f CPU | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:35+00:00","article:modified_time":"2019-10-31T19:14:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:14:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:22","updated":"2026-01-22 05:14:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/36892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=36892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/36892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=36892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=36892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=36892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}