{"id":52649,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel"},"modified":"2020-02-18T14:00:26","modified_gmt":"2020-02-18T11:00:26","slug":"vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","title":{"rendered":"Otkrivena nova varijanta napada Zombieload na Intel procesore","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Istra\u017eiva\u010di s Tehni\u010dkog sveu\u010dili\u0161ta u Grazu (Austrija) otkrili su<\/a><\/noindex> informacije o novoj metodi napada putem bo\u010dnih kanala ZombieLoad 2.0<\/a><\/noindex> (CVE-2019-11135<\/a><\/noindex>), koja omogu\u0107uje izvla\u010denje povjerljivih informacija iz drugih procesa, operativnog sustava, virtualnih strojeva i za\u0161ti\u0107enih okru\u017eenja (TEE, Trusted Execution Environment). Problem se odnosi isklju\u010divo na Intel procesore. Komponente za blokiranje problema predlo\u017eene<\/a><\/noindex> u ju\u010dera\u0161njem a\u017euriranju mikrokoda<\/a><\/noindex>. <\/p>\n

Problem pripada klasi MDS (Microarchitectural Data Sampling) i predstavlja moderniziranu verziju objavljene<\/a><\/noindex> u svibnju napada ZombieLoad. ZombieLoad 2.0, kao i drugi napadi iz klase MDS, temelji se na primjeni metoda analize putem bo\u010dnih kanala na podacima u mikroarhitektonskim strukturama (na primjer, u baferima za punjenje (Line Fill Buffer) i pohranu (Store Buffer), gdje se privremeno \u010duvaju podaci koji se koriste tijekom izvo\u0111enja operacija Load i Store).<\/p>\n

Nova verzija napada Zombieload se temelji<\/a><\/noindex> na curenju koje nastaje tijekom rada mehanizma asinkronog prekida operacija (TAA, TSX Asynchronous Abort), implementiranog u pro\u0161irenju TSX (Transactional Synchronization Extensions), koji pru\u017ea sredstva za rad s transakcijskom memorijom, omogu\u0107uju\u0107i pove\u0107anje performansi vi\u0161edretvenih aplikacija isklju\u010divanjem suvi\u0161nih operacija sinkronizacije (podr\u017eavaju se atomarne transakcije koje mogu biti ili prihva\u0107ene ili prekinute). U slu\u010daju prekida, operacije izvedene s transakcijskim dijelom memorije se vra\u0107aju natrag.<\/p>\n

Prekid transakcije se izvodi asinkrono, a u to vrijeme drugi procesi mogu pristupiti predmemoriji koja se tako\u0111er koristi u odbijenom transakcijskom dijelu memorije. U trenutku od po\u010detka do stvarnog zavr\u0161etka asinkronog prekida transakcije nisu isklju\u010dene situacije u kojima procesor tijekom spekulativnog izvo\u0111enja operacije mo\u017ee pro\u010ditati podatke iz unutarnjih mikroarhitektonskih bafera i prenijeti ih u spekulativno izvr\u0161enu operaciju. Zatim \u0107e se otkriti sukob, a spekulativna operacija \u0107e biti odba\u010dena, ali \u0107e podaci ostati u predmemoriji i mogu se izvu\u0107i kori\u0161tenjem metoda obnavljanja predmemorije putem bo\u010dnih kanala. <\/p>\n

Napad se svodi na otvaranje TSX transakcija i stvaranje uvjeta za njihovo asinhrono prekidanje, pri \u010demu nastaju uvjeti za curenje sadr\u017eaja unutarnjih bafera, spekulativno ispunjenih podacima iz operacija o\u010ditavanja memorije koje se izvode na istom CPU jezgru. Curenje je ograni\u010deno na trenutno fizi\u010dko CPU jezgro (na kojem se izvr\u0161ava napada\u010dev kod), ali budu\u0107i da se mikroarhitektonski baferi zajedni\u010dki koriste me\u0111u razli\u010ditim nitima u re\u017eimu Hyper-Threading, mo\u017ee do\u0107i do curenja operacija s memorijom koje se izvode u drugim CPU nitima. <\/p>\n

Napadu su podlo\u017eni<\/a><\/noindex> neki modeli osme, devete i desete generacije Intel Core procesora, kao i Intel Pentium Gold, Intel Celeron 5000, Intel Xeon E, Intel Xeon W i drugo generacije Intel Xeon Scalable. U to spadaju i novi procesori Intel zasnovani na mikroarhitekturi Cascade Lake, predstavljeni u aprilu, koja prvotno nije bila podlo\u017ena napadima RIDL i Fallout. Osim Zombieload 2.0, istra\u017eiva\u010di su tako\u0111er otkrili mogu\u0107nost zaobila\u017eenja ranije predlo\u017eenih metoda za\u0161tite od MDS napada, koje se temelje na upotrebi instrukcije VERW za \u010di\u0161\u0107enje sadr\u017eaja mikroarhitektonskih bafera prilikom povratka iz kernela u korisni\u010dki prostor ili prilikom prenosa kontrole gostuju\u0107em sistemu.<\/p>\n

U izvje\u0161taju Intel tvrdi da je u sustavima s heterogenim optere\u0107enjima mogu\u0107nost provo\u0111enja napada ote\u017eana, budu\u0107i da curenje iz mikroarhitektonskih struktura pokriva svu aktivnost u sustavu i napada\u010d ne mo\u017ee utjecati na izvor izvla\u010denih podataka, tj. mo\u017ee samo nakupljati informacije koje se pojavljuju kao rezultat curenja i poku\u0161ati utvrditi me\u0111u tim podacima korisne informacije, bez mogu\u0107nosti da ciljano presretne podatke povezane s odre\u0111enim adresama memorije. Ipak, istra\u017eiva\u010di su objavili prototip exploita<\/a><\/noindex>, koji radi na Linuxu i Windowsu, a tako\u0111er je demonstrirana mogu\u0107nost primjene napada za odre\u0111ivanje he\u0161a lozinke korisnika root.
\nMogu\u0107e<\/a><\/noindex> je provesti napad iz gostuju\u0107eg sistema kako bi se prikupili podaci koji se pojavljuju u operacijama drugih gostuju\u0107ih sistema, host okru\u017eenja, hipervizora i Intel SGX enk leva.<\/p>\n

\r\n \"Pogledajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Ispravke za blokiranje ranjivosti su uklju\u010dene<\/a><\/noindex> su uklju\u010dene u bazu koda Linux kernela i u\u0161le su u izdanje \t5.3.11, 4.19.84, 4.14.154, 4.9.201 i 4.4.201<\/a><\/noindex>. A\u017euriranja s jezgrom i mikrokodom tako\u0111er su ve\u0107 izdata za glavne distribucije (Debian<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>). Problem je otkriven u travnju, a rje\u0161enje je koordinirano s Intelom i programerima operativnih sustava.<\/p>\n

Najjednostavnija metoda blokiranja Zombieload 2.0 je isklju\u010divanje podr\u0161ke za TSX u CPU-u. Predlo\u017eena ispravka za Linux jezgru uklju\u010duje nekoliko opcija za\u0161tite. Prva opcija nudi parametar «tsx=on\/off\/auto», koji omogu\u0107ava upravljanje uklju\u010divanjem TSX pro\u0161irenja u CPU (vrijednost auto isklju\u010duje TSX samo za ranjive CPU-ove). Druga opcija za\u0161tite se aktivira parametrima «tsx_async_abort=off\/full\/full,nosmt» i temelji se na \u010di\u0161\u0107enju mikroarhitektonskih predmemorija tijekom kontekstualnog prebacivanja (oznaka nosmt dodatno isklju\u010duje SMT\/Hyper-Threads). Za provjeru ranjivosti sustava, u sysfs je predvi\u0111en parametar « \/sys\/devices\/system\/cpu\/vulnerabilities\/tsx_async_abort».<\/p>\n

Osim toga, u a\u017euriranju<\/a><\/noindex> mikrokodu rije\u0161ena<\/a><\/noindex> jo\u0161 jedan ranljivost<\/a><\/noindex> (CVE-2018-12207<\/a><\/noindex>) u Intel procesorima, koja je tako\u0111er blokirana u novom a\u017euriranju<\/a><\/noindex> kernela Linux. Ranjivost omogu\u0107ava<\/a><\/noindex> neprivilegiranom napada\u010du omogu\u0107ava iniciranje napada uskra\u0107ivanja usluga, \u0161to dovodi do zamrzavanja sustava u stanju «Machine Check Error».
\n Napad se tako\u0111er mo\u017ee izvr\u0161iti<\/a><\/noindex> iz gostuju\u0107eg sustava.<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u043c \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c ZombieLoad 2.0 (CVE-2019-11135), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u043e\u0432 (TEE, Trusted Execution Environment). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel. \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u044b \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 MDS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Otkrivena nova varijanta Zombieload napada na Intel procesore | ProHoster","description":"Istra\u017eiva\u010di s Tehni\u010dkog sveu\u010dili\u0161ta u Grazu (Austrija)","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 Zombieload \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f)","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:26","updated":"2026-01-24 04:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/52649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=52649"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/52649\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=52649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=52649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=52649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}