{"id":100636,"date":"2021-06-30T22:23:10","date_gmt":"2021-06-30T20:23:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy"},"modified":"2021-06-30T22:23:10","modified_gmt":"2021-06-30T20:23:10","slug":"uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","title":{"rendered":"Vulnerabilit\u00e0 nel codice KVM specifico per CPU AMD che consente l'esecuzione di codice al di fuori del sistema guest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I ricercatori del team Google Project Zero hanno identificato una vulnerabilit\u00e0 (CVE-2021-29657) nel hypervisor KVM fornito con il kernel Linux, che consente di eludere l'isolamento del sistema ospite e di eseguire codice nel contesto dell'ambiente host. Il problema \u00e8 presente nel codice utilizzato su sistemi con processori AMD (modulo kvm-amd.ko) e non si manifesta per i processori Intel. <\/p>\n

I ricercatori hanno sviluppato un prototipo operativo di exploit che consente, da un ambiente guest, di avviare una shell root nell'ambiente host su un sistema con processore AMD Epyc 7351P e kernel Linux 5.10. Si segnala che si tratta della prima vulnerabilit\u00e0 di tipo 'guest-to-host' nel hypervisor stesso. KVM<\/a>, non correlata a difetti nei componenti eseguiti nello spazio utente, come QEMU. La correzione \u00e8 stata accettata nel kernel alla fine di marzo. Il problema si manifesta a partire dal kernel Linux 5.10-rc1 fino a v5.12-rc6, coprendo quindi solo i kernel 5.10 e 5.11 (la maggior parte delle branche stabili dei distributori non ha risentito del problema). <\/p>\n

Il problema \u00e8 presente nel meccanismo nested_svm_vmrun, implementato utilizzando l'estensione AMD SVM (Secure Virtual Machine), che consente di organizzare l'esecuzione nidificata di sistemi ospiti. Per una corretta attuazione di questa funzionalit\u00e0, l'ipervisor deve interceptare tutte le istruzioni SVM eseguite nei sistemi ospiti, emulare il loro comportamento e sincronizzare lo stato con l'hardware, il che rappresenta una sfida piuttosto complessa. Analizzando l'implementazione proposta in KVM, i ricercatori hanno trovato un errore logico che consente di influenzare il contenuto dei registri MSR (Model-Specific Register) dell'host dal sistema ospite, cosa che pu\u00f2 essere utilizzata per eseguire codice a livello di host. <\/p>\n

In particolare, l'esecuzione dell'operazione VMRUN da un sistema guest di secondo livello (L2, avviato da un altro sistema guest) porta a una seconda invocazione di nested_svm_vmrun e alla corruzione della struttura svm->nested.hsave, sulla quale vengono sovrapposti i dati dal vmcb del sistema guest L2. Di conseguenza, si verifica una situazione in cui, a livello del sistema guest L2, \u00e8 possibile liberare memoria nella struttura svm->nested.msrpm, dove \u00e8 memorizzato il bit MSR, nonostante continui a essere utilizzato, e ottenere accesso al MSR dell'ambiente host.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29657) \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u044f\u0434\u0440\u0430 Linux \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD (\u043c\u043e\u0434\u0443\u043b\u044c kvm-amd.ko) \u0438 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100636","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nel codice KVM specifico per CPU AMD, che consente di eseguire codice al di fuori del sistema guest | ProHoster","description":"I ricercatori del team Google Project Zero hanno identificato una vulnerabilit\u00e0 (CVE-2021-29657) nel hypervisor KVM fornito con il kernel Linux, che consente di eludere l'isolamento del sistema guest e di eseguire codice nel lato host. Il problema \u00e8 presente nel codice utilizzato su sistemi con processori AMD (modulo kvm-amd.ko) e non si manifesta sui processori Intel. I ricercatori hanno sviluppato un prototipo funzionante di exploit, che consente di operare dal guest.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u043e\u043c \u0434\u043b\u044f CPU AMD \u043a\u043e\u0434\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432\u043d\u0435 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29657) \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u044f\u0434\u0440\u0430 Linux \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD (\u043c\u043e\u0434\u0443\u043b\u044c kvm-amd.ko) \u0438 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0433\u043e","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-30T20:23:10+00:00","article:modified_time":"2021-06-30T20:23:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100636","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-30 20:28:56","updated":"2022-10-01 07:58:58"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=100636"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100636\/revisions"}],"predecessor-version":[{"id":164274,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100636\/revisions\/164274"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=100636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=100636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=100636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}