Ofufuza ku Helmholtz Center for Information Security (CISPA) asindikiza njira yatsopano yowukira ya CacheWarp kuti asokoneze njira yachitetezo ya AMD SEV (Secure Encrypted Virtualization) yomwe imagwiritsidwa ntchito m'makina oteteza makina kuti asasokonezedwe ndi hypervisor kapena woyang'anira dongosolo. Njira yomwe ikufunsidwa imalola woukira yemwe ali ndi mwayi wopeza hypervisor kuti apereke ma code a chipani chachitatu ndikukulitsa mwayi pamakina otetezedwa ndi AMD SEV.
Kuwukiraku kumachokera pakugwiritsa ntchito chiwopsezo (CVE-2023-20592) chifukwa cha ntchito yolakwika ya cache panthawi yoperekera malangizo a purosesa a INVD, mothandizidwa ndi zomwe zingatheke kukwaniritsa kusagwirizana kwa data kukumbukira ndi posungira. , ndi njira zodutsamo zosungira kukhulupirika kwa makina okumbukira makina, ogwiritsidwa ntchito potengera zowonjezera SEV-ES ndi SEV-SNP. Kusatetezeka kumakhudza mapurosesa a AMD EPYC kuyambira woyamba mpaka m'badwo wachitatu.
Kwa mapurosesa a AMD EPYC a m'badwo wachitatu (Zen 3), nkhaniyi yathetsedwa pakusinthidwa kwa ma microcode a Novembala kotulutsidwa dzulo ndi AMD (kukonza sikumabweretsa kuwonongeka kulikonse). Kwa m'badwo woyamba ndi wachiwiri wa AMD EPYC (Zen 1 ndi Zen 2), chitetezo sichimaperekedwa, popeza ma CPU awa samathandizira kukulitsa kwa SEV-SNP, komwe kumapereka kuwongolera kukhulupirika kwa makina enieni. Mbadwo wachinayi wa mapurosesa a AMD AMD EPYC "Genoa" kutengera "Zen 4" microarchitecture siwowopsa.
Ukadaulo wa AMD SEV umagwiritsidwa ntchito pakudzipatula kwa makina ndi omwe amapereka mitambo monga Amazon Web Services (AWS), Google Cloud, Microsoft Azure ndi Oracle Compute Infrastructure (OCI). Kutetezedwa kwa AMD SEV kumayendetsedwa kudzera mu encryption ya hardware-level of virtual machine memory. Kuphatikiza apo, kukulitsa kwa SEV-ES (Encrypted State) kumateteza kaundula wa CPU. Ndi makina amakono okha omwe ali ndi mwayi wopeza deta yotsekedwa, ndipo pamene makina ena enieni ndi hypervisor amayesa kupeza kukumbukira uku, amalandira deta yosungidwa.
M'badwo wachitatu wa mapurosesa a AMD EPYC adayambitsa zowonjezera, SEV-SNP (Secure Nested Paging), zomwe zimatsimikizira kugwira ntchito motetezeka kwa matebulo amasamba okumbukira. Kuphatikiza pa kusungitsa kukumbukira komanso kudzipatula kulembetsa, SEV-SNP imagwiritsa ntchito njira zina zotetezera kukhulupirika kwa kukumbukira poletsa kusintha kwa VM ndi hypervisor. Makiyi a encryption amayendetsedwa kumbali ya purosesa yosiyana ya PSP (Platform Security processor) yomangidwa mu chip, yokhazikitsidwa pamaziko a kamangidwe ka ARM.
Chofunikira cha njira yowukira yomwe ikufunsidwa ndikugwiritsa ntchito malangizo a INVD kuti asokoneze midadada (mizere) mu cache yamasamba akuda popanda kutaya zomwe zasonkhanitsidwa mu cache kukumbukira (kulemba-kumbuyo). Chifukwa chake, njirayo imakuthandizani kuti mutulutse zomwe zasinthidwa kuchokera ku cache popanda kusintha kukumbukira. Kuti achite chiwopsezo, akuyenera kugwiritsa ntchito kupatula mapulogalamu (jekeseni wolakwika) kuti asokoneze magwiridwe antchito a makinawo m'malo awiri: poyambira, wowukirayo amatcha malangizo a "wbnoinvd" kuti akhazikitsenso ntchito zonse zolembera kukumbukira zomwe zasonkhanitsidwa. cache, ndipo kachiwiri imayitanira malangizo a "invd" kuti abwerere zolemba zomwe sizinawonetsedwe mu kukumbukira zakale.
Kuti muwone momwe makina anu aliri pachiwopsezo, chojambula chogwiritsa ntchito chasindikizidwa chomwe chimakulolani kuti muyike chosiyana ndi makina otetezedwa kudzera pa AMD SEV ndikubwezeretsanso kusintha kwa VM komwe sikunakhazikitsidwe kukumbukira. Kubweza zosintha kungagwiritsidwe ntchito kusintha mayendedwe a pulogalamu mwa kubweza adilesi yakale yobwerera pa stack, kapena kugwiritsa ntchito magawo olowera gawo lakale lomwe lidatsimikiziridwa kale pobweza mtengo wotsimikizira.
Mwachitsanzo, ofufuza adawonetsa kuthekera kogwiritsa ntchito njira ya CacheWarp kuti achite kuukira kwa Bellcore pakukhazikitsa kwa RSA-CRT aligorivimu mu laibulale ya ipp-crypto, zomwe zidapangitsa kuti zitheke kuyambiranso kiyi yachinsinsi kudzera m'malo olakwika powerengera digito. siginecha. Ikuwonetsanso momwe mungasinthire magawo otsimikizira gawo kukhala OpenSSH mukalumikiza patali ndi kachitidwe ka alendo, ndikusintha mawonekedwe otsimikizira mukamagwiritsa ntchito sudo kuti mupeze ufulu wa mizu ku Ubuntu 20.04. Kugwiritsa ntchito kwayesedwa pamakina omwe ali ndi mapurosesa a AMD EPYC 7252, 7313P ndi 7443.
Source: opennet.ru