{"id":182817,"date":"2026-08-10T19:49:35","date_gmt":"2026-08-10T17:49:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2"},"modified":"2026-08-10T19:49:35","modified_gmt":"2026-08-10T17:49:35","slug":"tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","title":{"rendered":"TONTOU \u2014 t\u00e1mad\u00e1s az Intel \u00e9s AMD CPU-kon, amely lehet\u0151v\u00e9 teszi a Spectre v2 sebezhet\u0151s\u00e9gek elleni v\u00e9delem megker\u00fcl\u00e9s\u00e9t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Massachusetts Institute of Technology researcher has identified the TONTOU (Time-of-Neutralization to Time-of-Use) attack technique, which offers a new way to exploit microarchitectural vulnerabilities of the Spectre v2 class. The vulnerability allows for the determination of kernel memory content while executing exploits in user space. The code to block the vulnerability has been incorporated into the Linux kernel as of August 5 and included in the releases 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214, and 5.10.263. <\/p>\n
The researchers demonstrated the ability of a local unprivileged user to carry out an attack to determine the hash of the root user's password stored in the \/etc\/shadow file and loaded into memory during system authentication. The researchers managed to leak data from kernel memory at a rate of 5.47 bytes per second with an accuracy of 91.97%. Out of 10 test runs of the exploit, which lasted an average of 18 minutes, in half of the cases they were able to successfully determine the presence of the \/etc\/shadow file in memory and extract its contents. <\/p>\n
The exploit has been demonstrated on AMD processor systems and can be applied with AMD CPU families Zen 1-4. On Intel systems, the attack is also feasible, but the exploit is more complex. To protect against stack overflow of return addresses and block the SRSO (Speculative Return Stack Overflow) vulnerability, AMD processors use the Safe-RET protection mechanism, which clears the branch prediction buffer after each use and narrows the attack window to 2 instructions, executed over the course of several tens of nanoseconds. <\/p>\n
A v\u00e9delem megker\u00fcl\u00e9s\u00e9re \u00e9s a t\u00e1mad\u00e1si ablak kib\u0151v\u00edt\u00e9s\u00e9re CPU lass\u00edt\u00f3 technik\u00e1t val\u00f3s\u00edtottak meg, amely lehet\u0151v\u00e9 tette, hogy a megszak\u00edt\u00f3 helyettes\u00edt\u00e9se a megfelel\u0151 pillanatban v\u00e9grehajt\u00f3djon, \u00edgy ir\u00e1ny\u00edtva a v\u00e9grehajt\u00e1si \u00e1raml\u00e1st a kernelben, \u00e9s a megszak\u00edt\u00f3 kezel\u0151j\u00e9nek felhaszn\u00e1l\u00e1s\u00e1val eltorz\u00edtva a becsl\u00e9si \u00e1tmenet buffer\u00e9nek \u00edr\u00e1s\u00e1t. Az SRSO s\u00e9r\u00fcl\u00e9kenys\u00e9g kiakn\u00e1z\u00e1s\u00e1hoz a t\u00e1mad\u00f3 olyan k\u00f6r\u00fclm\u00e9nyeket teremthet, amelyek sor\u00e1n a becsl\u00e9si \u00e1tmenetek blokkja spekulat\u00edvan sz\u00e1mos helytelen\u00fcl becs\u00fclt CALL h\u00edv\u00e1st hajt v\u00e9gre, el\u00e9g ahhoz, hogy t\u00falcsorduljon a visszat\u00e9r\u00e9si c\u00edmek stack-je, \u00e9s fel\u00fcl\u00edrja a helyesen becs\u00fclt visszat\u00e9r\u00e9si pontokat, amelyek a stack elej\u00e9n tal\u00e1lhat\u00f3k. Ennek eredm\u00e9nyek\u00e9nt a stack kezdeti elemei a t\u00e1mad\u00f3 \u00e1ltal v\u00e1lasztott \u00e9rt\u00e9kekre lesznek fel\u00fcl\u00edrva, ami k\u00e9s\u0151bb a spekulat\u00edv RET utas\u00edt\u00e1s v\u00e9grehajt\u00e1s\u00e1hoz haszn\u00e1lja ezeket a helyettes\u00edtett \u00e9rt\u00e9keket egy m\u00e1sik folyamat kontextus\u00e1ban. <\/p>\n
A processzor \u00e9szleli, hogy a branch prediction nem v\u00e1lt val\u00f3ra, \u00e9s visszag\u00f6rb\u00edti a m\u0171veletet az eredeti \u00e1llapot\u00e1ba, de a spekulat\u00edv v\u00e9grehajt\u00e1s sor\u00e1n feldolgozott adatok a cache-ben \u00e9s a mikroarchitekt\u00far\u00e1s buferben maradnak. Ha a hib\u00e1san v\u00e9grehajtott blokk mem\u00f3riahozz\u00e1f\u00e9r\u00e9st hajt v\u00e9gre, akkor spekulat\u00edv v\u00e9grehajt\u00e1sa az \u00e1ltal\u00e1nos cache-ben \u00e9s a mem\u00f3ri\u00e1b\u00f3l olvasott adatokban ker\u00fcl t\u00e1rol\u00e1sra. Az inform\u00e1ci\u00f3 kinyer\u00e9s\u00e9re a cache-b\u0151l alkalmazhat\u00f3 a cache tartalm\u00e1nak meghat\u00e1roz\u00e1s\u00e1ra szolg\u00e1l\u00f3 egyik m\u00f3dszer, amely a cache-elt \u00e9s nem cache-elt adatokhoz val\u00f3 hozz\u00e1f\u00e9r\u00e9si id\u0151 v\u00e1ltoz\u00e1s\u00e1nak elemz\u00e9s\u00e9n alapul. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"