{"id":105506,"date":"2022-11-09T03:36:39","date_gmt":"2022-11-09T01:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm"},"modified":"2022-11-09T03:36:39","modified_gmt":"2022-11-09T01:36:39","slug":"uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","title":{"rendered":"Sebezhet\u0151s\u00e9g az UEFI firmware-ekben, amely lehet\u0151v\u00e9 teszi a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t SMM szinten","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Felkelt adatok a (CVE-2021-33164) UEFI firmware-keres\u00e9sekr\u0151l, amelyek lehet\u0151v\u00e9 teszik a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t az SMM (System Management Mode) szintj\u00e9n, amely priorit\u00e1sosabb, mint a hypervisor m\u00f3d \u00e9s a nulladik v\u00e9delmi gy\u0171r\u0171, \u00e9s korl\u00e1tlan hozz\u00e1f\u00e9r\u00e9st biztos\u00edt a teljes rendszer mem\u00f3ri\u00e1j\u00e1hoz. A RingHopper k\u00f3dn\u00e9ven elh\u00edres\u00fclt s\u00e9r\u00fcl\u00e9kenys\u00e9g a DMA (Direct Memory Access) id\u0151alap\u00fa t\u00e1mad\u00e1sainak lehet\u0151s\u00e9g\u00e9hez kapcsol\u00f3dik, amelyek s\u00e9rtik az SMM szinten fut\u00f3 k\u00f3d mem\u00f3ri\u00e1j\u00e1t. A s\u00e9r\u00fcl\u00e9kenys\u00e9g meger\u0151s\u00edt\u00e9st nyert az Intel, Dell \u00e9s Insyde Software firmware-\u00e9ben (\u00e1ll\u00edt\u00f3lag 8 gy\u00e1rt\u00f3t \u00e9rint a probl\u00e9ma, de a m\u00e1sik 5 m\u00e9g nem nyilv\u00e1nos). Az AMD, Phoenix \u00e9s Toshiba firmware-ek nem \u00e9rintettek a probl\u00e9m\u00e1ban. <\/p>\n

A s\u00e9r\u00fcl\u00e9kenys\u00e9gek kihaszn\u00e1l\u00e1sa v\u00e9grehajthat\u00f3 az oper\u00e1ci\u00f3s rendszeren bel\u00fcl, s\u00e9r\u00fcl\u00e9keny SMI-k\u00e9zl\u00e9seket (System Management Interrupt) alkalmazva, amelyekhez adminisztr\u00e1tori jogosults\u00e1gok sz\u00fcks\u00e9gesek. A t\u00e1mad\u00e1s akkor is v\u00e9grehajthat\u00f3, ha fizikai hozz\u00e1f\u00e9r\u00e9s \u00e1ll rendelkez\u00e9sre a rendszer ind\u00edt\u00e1s\u00e1nak korai szakasz\u00e1ban, m\u00e9g az oper\u00e1ci\u00f3s rendszer inicializ\u00e1l\u00e1sa el\u0151tt. A probl\u00e9ma blokkol\u00e1sa \u00e9rdek\u00e9ben a Linux felhaszn\u00e1l\u00f3knak javasolt friss\u00edteni a firmware-t az LVFS (Linux Vendor Firmware Service) szolg\u00e1ltat\u00e1son kereszt\u00fcl, a fwupdmgr (fwupdmgr get-updates; fwupdmgr update) seg\u00e9dprogramot haszn\u00e1lva a fwupd csomagb\u00f3l. <\/p>\n

A t\u00e1mad\u00e1shoz sz\u00fcks\u00e9ges adminisztr\u00e1tori jogosults\u00e1g korl\u00e1tozza a probl\u00e9ma vesz\u00e9lyess\u00e9g\u00e9t, de nem akad\u00e1lyozza meg annak m\u00e1sodlagos s\u00e9r\u00fcl\u00e9kenys\u00e9gk\u00e9nt val\u00f3 kihaszn\u00e1l\u00e1s\u00e1t, hogy meg\u0151rizz\u00e9k a jelenl\u00e9t\u00fcket m\u00e1s s\u00e9r\u00fcl\u00e9kenys\u00e9gek kihaszn\u00e1l\u00e1sa ut\u00e1n, vagy social engineering m\u00f3dszerek alkalmaz\u00e1s\u00e1val. Az SMM (Ring -2) szint\u0171 hozz\u00e1f\u00e9r\u00e9s lehet\u0151v\u00e9 teszi olyan k\u00f3d v\u00e9grehajt\u00e1s\u00e1t, amely felett az oper\u00e1ci\u00f3s rendszer nincs ellen\u0151rz\u00e9si jogk\u00f6rrel, \u00e9s ez felhaszn\u00e1lhat\u00f3 firmware-ek m\u00f3dos\u00edt\u00e1s\u00e1ra, rejtett rosszindulat\u00fa k\u00f3d vagy rootkit SPI Flash-be t\u00f6rt\u00e9n\u0151 elhelyez\u00e9s\u00e9re, amelyeket az oper\u00e1ci\u00f3s rendszer nem \u00e9szlel, valamint a bet\u00f6lt\u00e9s korai szakasz\u00e1ban (UEFI Secure Boot, Intel BootGuard) a valid\u00e1l\u00e1s kikapcsol\u00e1s\u00e1ra \u00e9s hypervisor t\u00e1mad\u00e1sokra a virtu\u00e1lis k\u00f6rnyezetek integrit\u00e1s\u00e1nak ellen\u0151rz\u00e9si mechanizmusainak megker\u00fcl\u00e9s\u00e9hez. <\/p>\n

A probl\u00e9ma a SMI (System Management Interrupt) kezel\u0151j\u00e9ben l\u00e9v\u0151 verseny\u00e1llapotb\u00f3l ered, amely a hozz\u00e1f\u00e9r\u00e9s ellen\u0151rz\u00e9se \u00e9s az SMRAM el\u00e9r\u00e9s\u00e9nek sor\u00e1n l\u00e9p fel. A megfelel\u0151 id\u0151pont meghat\u00e1roz\u00e1s\u00e1ra az ellen\u0151rz\u00e9s \u00e9s az ellen\u0151rz\u00e9s eredm\u00e9ny\u00e9nek felhaszn\u00e1l\u00e1sa k\u00f6z\u00f6tt k\u00fcls\u0151 csatorn\u00e1kon kereszt\u00fcl v\u00e9gzett DMA-elemz\u00e9s haszn\u00e1lhat\u00f3. Ennek eredm\u00e9nyek\u00e9nt, az SMRAM-hoz val\u00f3 DMA-hozz\u00e1f\u00e9r\u00e9s aszinkron jellege miatt a t\u00e1mad\u00f3 meghat\u00e1rozhatja a megfelel\u0151 id\u0151pontot, \u00e9s \u00fajra\u00edrhatja az SMRAM tartalm\u00e1t, megker\u00fclve az SMI kezel\u0151 API-t. Az Intel-VT \u00e9s Intel VT-d mechanizmusokat t\u00e1mogat\u00f3 processzorok v\u00e9delmet ny\u00fajtanak a DMA-t\u00e1mad\u00e1sok ellen, amely az IOMMU (Input-Output Memory Management Unit) alkalmaz\u00e1s\u00e1n alapul, de ez a v\u00e9delem hat\u00e9konyan blokkolja a j\u00f3l el\u0151k\u00e9sz\u00edtett t\u00e1mad\u00f3i eszk\u00f6z\u00f6kkel v\u00e9grehajtott hardveres DMA-t\u00e1mad\u00e1sokat, \u00e9s nem v\u00e9d meg az SMI kezel\u0151k\u00f6n kereszt\u00fcl v\u00e9grehajtott t\u00e1mad\u00e1sokt\u00f3l.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105506","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9g az UEFI firmware-ekben, amely lehet\u0151v\u00e9 teszi k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a SMM szintj\u00e9n | ProHoster","description":"Felt\u00e1rt\u00e1k az UEFI firmware-ekben tal\u00e1lhat\u00f3 (CVE-2021-33164) sebezhet\u0151s\u00e9gi inform\u00e1ci\u00f3t, amely lehet\u0151v\u00e9 teszi k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a SMM (System Management Mode) szintj\u00e9n, amely priorit\u00e1sosabb, mint a hypervisor m\u00f3d \u00e9s a null\u00e1s v\u00e9delmi gy\u0171r\u0171.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-09T01:36:39+00:00","article:modified_time":"2022-11-09T01:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/105506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=105506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/105506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=105506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=105506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=105506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}