{"id":112031,"date":"2023-12-06T21:10:26","date_gmt":"2023-12-06T19:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati"},"modified":"2023-12-06T21:10:26","modified_gmt":"2023-12-06T19:10:26","slug":"slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","title":{"rendered":"SLAM \u2014 t\u00e1mad\u00e1s az Intel, AMD \u00e9s ARM CPU-kon, amellyel a mem\u00f3ria tartalma meghat\u00e1rozhat\u00f3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Holland Free University research group has presented a new attack technique called SLAM (Spectre Linear Address Masking), offering a fresh approach to exploit microarchitectural vulnerabilities of the Spectre type, wherein data leakage occurs during the translation of non-canonical addresses, while the provided extensions in new processors for masking linear addresses are leveraged to bypass canonical checks. The researchers have published a toolkit implementing the method and proposed a demonstration showing how, in a matter of seconds on Ubuntu, one could extract from the kernel memory data corresponding to a specific mask (demonstrated by extracting a string containing the root user password hash).

\r\n \"Vide\u00f3\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

The attack can be performed on systems with Intel processors supporting the LAM (Linear Address Masking) extension, AMD processors with the UAI (Upper Address Ignore) extension, and ARM processors with the TBI (Top Byte Ignore) extension. These extensions allow part of the bits in 64-bit pointers to store non-addressing metadata (for standard programs, not enough memory is needed, which would allow addressing 64-bit pointers, thus the upper bits can be utilized, for instance, for security-related checks). Interestingly, Intel, AMD, and ARM processors supporting LAM, UAI, and TBI have only been announced but are not yet mass-produced, making SLAM the first speculative attack on future CPUs. The attack can also be executed on older AMD Zen+ and Zen 2 CPUs that are susceptible to vulnerability CVE-2020-12965. <\/p>\n

Hasonl\u00f3an a Spectre sebezhet\u0151s\u00e9gek kihaszn\u00e1l\u00e1s\u00e1hoz, a SLAM t\u00e1mad\u00e1shoz is sz\u00fcks\u00e9g van bizonyos utas\u00edt\u00e1si sorozatokra (gadgetek) a kernelben, amelyek spekulat\u00edv utas\u00edt\u00e1sv\u00e9grehajt\u00e1st eredm\u00e9nyeznek. Az ilyen utas\u00edt\u00e1sok spekulat\u00edv adatolvas\u00e1st id\u00e9znek el\u0151 a mem\u00f3ri\u00e1b\u00f3l a k\u00fcls\u0151 k\u00f6r\u00fclm\u00e9nyek f\u00fcggv\u00e9ny\u00e9ben, amelyre a t\u00e1mad\u00f3 hat\u00e1ssal lehet. A hib\u00e1s el\u0151rejelz\u00e9s meg\u00e1llap\u00edt\u00e1sa ut\u00e1n a spekulat\u00edv v\u00e9grehajt\u00e1s eredm\u00e9nye elvet\u00e9sre ker\u00fcl, de a feldolgozott adatok a cache-ben maradnak, \u00e9s k\u00e9s\u0151bb harmadik felek \u00e1ltal v\u00e9gzett elemz\u00e9ssel visszanyerhet\u0151k. Az elemz\u0151k \u00e1ltal a cache-ben megmaradt adatok kiolvas\u00e1s\u00e1ra haszn\u00e1lt m\u00f3dszer az Evict+Reload, amely az adatok cache-b\u0151l val\u00f3 kiszor\u00edt\u00e1s\u00e1nak felt\u00e9teleinek megteremt\u00e9s\u00e9re \u00e9p\u00fcl (p\u00e9ld\u00e1ul egy olyan aktivit\u00e1s j\u00f6n l\u00e9tre, amely egyenletesen kit\u00f6lti a cache-t tipikus tartalommal) \u00e9s olyan m\u0171veletek v\u00e9grehajt\u00e1s\u00e1ra, amelyek fut\u00e1si ideje lehet\u0151v\u00e9 teszi az adatok processzorki cache-ben val\u00f3 megl\u00e9t\u00e9nek meg\u00edt\u00e9l\u00e9s\u00e9t. <\/p>\n

A SLAM t\u00e1mad\u00e1s v\u00e9grehajt\u00e1s\u00e1hoz a t\u00e1mad\u00f3 \u00e1ltal ir\u00e1ny\u00edtott adatokra (a k\u00f6vetkez\u0151 p\u00e9ld\u00e1ban a \"secret\" v\u00e1ltoz\u00f3ra) \u00e9p\u00fcl\u0151, k\u00f3dalap\u00fa eszk\u00f6z\u00f6ket haszn\u00e1lnak. P\u00e9ld\u00e1ul: void unmasked_gadget(long **secret) { **secret; } <\/p>\n

Megjegyzend\u0151, hogy az ilyen k\u00f3dmint\u00e1k gyakran el\u0151fordulnak programokban, p\u00e9ld\u00e1ul a Linux kernelben t\u00f6bb t\u00edzezer ilyen gadgetet azonos\u00edtottak, amelyek k\u00f6z\u00fcl legal\u00e1bb n\u00e9h\u00e1ny sz\u00e1z alkalmas az exploitokhoz. Az adatsziv\u00e1rg\u00e1s megakad\u00e1lyozhat\u00f3 olyan tov\u00e1bbi utas\u00edt\u00e1sok hozz\u00e1ad\u00e1s\u00e1val ezekhez a gadgetekhez, amelyek blokkolj\u00e1k a spekulat\u00edv v\u00e9grehajt\u00e1st. Az Intel v\u00e1llalat annak \u00e9rdek\u00e9ben, hogy megakad\u00e1lyozza a sziv\u00e1rg\u00e1st, szoftveres m\u00f3dszert k\u00edv\u00e1n biztos\u00edtani a LAM t\u00e1mogat\u00e1sa n\u00e9lk\u00fcli processzorok forgalomba hozatala el\u0151tt. Az AMD arra javasolta, hogy a Spectre v2 t\u00e1mad\u00e1sok blokkol\u00e1s\u00e1ra l\u00e9tez\u0151 m\u00f3dszereket alkalmazzanak. A Linux kernel fejleszt\u0151i a t\u00e1mad\u00e1sok elleni v\u00e9delem \u00e9rdek\u00e9ben a LAM alap\u00e9rtelmezett t\u00e1mogat\u00e1s\u00e1t letiltott\u00e1k, am\u00edg az Intel meg nem adja az adatsziv\u00e1rg\u00e1s blokkol\u00e1s\u00e1ra vonatkoz\u00f3 aj\u00e1nl\u00e1sait.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u043d\u0435\u043a\u0430\u043d\u043e\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u043a\u0430\u043d\u043e\u043d\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0432 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043b\u0438\u043d\u0435\u0439\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0442\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112031","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SLAM \u2014 Intel, AMD \u00e9s ARM CPU elleni t\u00e1mad\u00e1s, amely lehet\u0151v\u00e9 teszi a mem\u00f3ria tartalm\u00e1nak meghat\u00e1roz\u00e1s\u00e1t | ProHoster","description":"Amszterdami Szabadegyetem kutat\u00f3csoportja bemutatta az \u00faj SLAM (Spectre Linear Address Masking) t\u00e1mad\u00e1si technik\u00e1t, amely \u00faj m\u00f3dot k\u00edn\u00e1l a mikroarchitekt\u00far\u00e1kra vonatkoz\u00f3 sebezhet\u0151s\u00e9gek kihaszn\u00e1l\u00e1s\u00e1ra.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SLAM \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 CPU Intel, AMD \u0438 ARM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-06T19:10:26+00:00","article:modified_time":"2023-12-06T19:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/112031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=112031"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/112031\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=112031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=112031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=112031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}