{"id":107877,"date":"2023-04-16T12:48:13","date_gmt":"2023-04-16T10:48:13","guid":{"rendered":"https:\/\/prohoster.info\/?p=107877"},"modified":"2023-04-17T17:50:38","modified_gmt":"2023-04-17T15:50:38","slug":"uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","title":{"rendered":"Vulnerabilit\u00e0 nel kernel Linux 6.2 che consente di eludere la protezione contro gli attacchi Spectre v2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nel kernel Linux 6.2 \u00e8 stata identificata una vulnerabilit\u00e0 (CVE-2023-1998) che disattiva la protezione contro attacchi di tipo Spectre v2, consentendo l'accesso alla memoria di altri processi eseguiti in thread SMT o Hyper Threading diversi, ma su uno stesso nucleo fisico del processore. Questa vulnerabilit\u00e0, tra l'altro, pu\u00f2 essere sfruttata per organizzare perdite di dati tra macchine virtuali nei sistemi cloud. Il problema riguarda solo il kernel Linux 6.2 ed \u00e8 causato da un'implementazione errata delle ottimizzazioni destinate a ridurre significativamente i costi associati all'applicazione della protezione contro Spectre v2. La vulnerabilit\u00e0 \u00e8 stata risolta in un ramo sperimentale del kernel Linux 6.3. <\/p>\n

Nello spazio utente, per proteggersi da attacchi di tipo Spectre, i processi possono disattivare selettivamente l'esecuzione speculativa delle istruzioni utilizzando prctl PR_SET_SPECULATION_CTRL o impiegare un filtro sulle chiamate di sistema basato sul meccanismo seccomp. Secondo i ricercatori che hanno identificato il problema, l'ottimizzazione errata nel kernel 6.2 ha lasciato senza protezione. macchine virtuali<\/a> almeno un grande fornitore di cloud, nonostante l'attivazione della modalit\u00e0 di blocco degli attacchi spectre-BTI tramite prctl. La vulnerabilit\u00e0 si manifesta anche su normali server<\/a> con il kernel 6.2, durante il caricamento del quale viene utilizzata l'impostazione \u2018spectre_v2=ibrs\u2019. <\/p>\n

Il problema della vulnerabilit\u00e0 \u00e8 che, scegliendo le modalit\u00e0 di protezione IBRS o eIBRS, le ottimizzazioni apportate disattivano l'uso del meccanismo STIBP (Single Thread Indirect Branch Predictors), necessario per bloccare le perdite in caso di utilizzo della tecnologia di multi-threading simultaneo (SMT o Hyper-Threading). In questo caso, solo la modalit\u00e0 eIBRS offre protezione dalle perdite tra i thread, mentre la modalit\u00e0 IBRS non lo fa, poich\u00e9 in essa il bit IBRS, che garantisce la protezione dalle perdite tra i core logici, viene ripulito per motivi di prestazioni al ritorno al controllo nello spazio utente, rendendo i thread nello spazio utente non protetti dagli attacchi di tipo Spectre v2.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper Threading, \u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u044f\u0434\u0440\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0442\u0435\u0447\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107877","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nel kernel Linux 6.2 che consente di bypassare la protezione contro gli attacchi Spectre v2 | ProHoster","description":"Nel kernel Linux 6.2 \u00e8 stata scoperta una vulnerabilit\u00e0 (CVE-2023-1998) che disabilita la protezione contro gli attacchi di tipo Spectre v2, consentendo l'accesso alla memoria di altri processi eseguiti in thread SMT o Hyper Threading, ma su un unico core fisico del processore. Questa vulnerabilit\u00e0 pu\u00f2, tra l'altro, essere sfruttata per organizzare la fuga di dati tra macchine virtuali nei sistemi cloud. Il problema riguarda solo","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux 6.2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0430\u0442\u0430\u043a Spectre v2 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper Threading, \u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u044f\u0434\u0440\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0442\u0435\u0447\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-16T10:48:13+00:00","article:modified_time":"2023-04-17T15:50:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=107877"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107877\/revisions"}],"predecessor-version":[{"id":164434,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107877\/revisions\/164434"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=107877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=107877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=107877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}