{"id":100636,"date":"2021-06-30T22:23:10","date_gmt":"2021-06-30T20:23:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy"},"modified":"2021-06-30T22:23:10","modified_gmt":"2021-06-30T20:23:10","slug":"uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","title":{"rendered":"Vulnerabilit\u00e0 nel codice KVM specifico per CPU AMD, che consente di eseguire codice al di fuori del sistema guest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I ricercatori del team Google Project Zero hanno identificato una vulnerabilit\u00e0 (CVE-2021-29657) nell'ipervisor KVM fornito con il kernel Linux, che consente di bypassare l'isolamento del sistema guest ed eseguire codice nell'ambiente host. Il problema \u00e8 presente nel codice utilizzato su sistemi con processori AMD (modulo kvm-amd.ko) e non si manifesta su processori Intel. <\/p>\n

I ricercatori hanno sviluppato un prototipo funzionante di exploit, che consente di avviare una shell root nell'ambiente host da un ambiente guest su un sistema con processore AMD Epyc 7351P e kernel Linux 5.10. \u00c8 stato notato che si tratta della prima vulnerabilit\u00e0 di tipo \u00abguest-to-host\u00bb nel hypervisor stesso. KVM<\/a>, non correlata a errori nei componenti eseguiti nello spazio utente, come QEMU. La correzione \u00e8 stata accettata nel kernel a fine marzo. Il problema si manifesta a partire dal kernel Linux 5.10-rc1 e fino a v5.12-rc6, cio\u00e8 riguarda solo i kernel 5.10 e 5.11 (la maggior parte dei rami stabili delle distribuzioni non \u00e8 stata influenzata dal problema). <\/p>\n

Il problema \u00e8 presente nel meccanismo nested_svm_vmrun, implementato utilizzando l'estensione AMD SVM (Secure Virtual Machine) e che consente di organizzare l'esecuzione annidata di sistemi guest. Per realizzare correttamente questa funzionalit\u00e0, l'ipervisor deve intercettare tutte le istruzioni SVM eseguite nei sistemi guest, emulare il loro comportamento e sincronizzare lo stato con l'hardware, il che rappresenta un compito piuttosto complesso. Analizzando l'implementazione proposta in KVM, i ricercatori hanno trovato un errore logico che consente di influenzare il contenuto dei registri MSR (Model-Specific Register) dell'host dal sistema guest, che pu\u00f2 essere utilizzato per eseguire codice a livello di host. <\/p>\n

In particolare, l'esecuzione dell'operazione VMRUN dal sistema guest di secondo livello (L2, avviato da un altro sistema guest) porta a una seconda chiamata a nested_svm_vmrun e al danneggiamento della struttura svm->nested.hsave, sulla quale vengono sovrapposti i dati provenienti dal vmcb del sistema guest L2. Di conseguenza, si crea una situazione tale che a livello del sistema guest L2 \u00e8 possibile liberare memoria nella struttura svm->nested.msrpm, dove \u00e8 memorizzato il bit MSR, nonostante questo continui ad essere utilizzato, e ottenere l'accesso al MSR dell'ambiente host.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29657) \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u044f\u0434\u0440\u0430 Linux \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD (\u043c\u043e\u0434\u0443\u043b\u044c kvm-amd.ko) \u0438 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100636","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u00e0 nel codice KVM specifico per CPU AMD, che consente di eseguire codice al di fuori del sistema ospite | ProHoster","description":"I ricercatori del team Google Project Zero hanno scoperto una vulnerabilit\u00e0 (CVE-2021-29657) nel hypervisor KVM fornito con il kernel Linux, che consente di bypassare l'isolamento del sistema ospite ed eseguire il proprio codice lato client.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u043e\u043c \u0434\u043b\u044f CPU AMD \u043a\u043e\u0434\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432\u043d\u0435 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29657) \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u044f\u0434\u0440\u0430 Linux \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-30T20:23:10+00:00","article:modified_time":"2021-06-30T20:23:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100636","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-30 20:28:56","updated":"2022-10-01 07:58:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=100636"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100636\/revisions"}],"predecessor-version":[{"id":164274,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100636\/revisions\/164274"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=100636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=100636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=100636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}