{"id":100636,"date":"2021-06-30T22:23:10","date_gmt":"2021-06-30T20:23:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy"},"modified":"2021-06-30T22:23:10","modified_gmt":"2021-06-30T20:23:10","slug":"uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","title":{"rendered":"Uma vulnerabilidade no c\u00f3digo KVM espec\u00edfico para CPU AMD permite executar c\u00f3digo fora do sistema convidado.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pesquisadores da equipe do Google Project Zero identificaram uma vulnerabilidade (CVE-2021-29657) no hipervisor KVM, inclu\u00eddo no n\u00facleo do Linux, que permite contornar a isola\u00e7\u00e3o do sistema convidado e executar seu c\u00f3digo no ambiente host. O problema est\u00e1 presente no c\u00f3digo utilizado em sistemas com processadores AMD (m\u00f3dulo kvm-amd.ko) e n\u00e3o se manifesta em processadores Intel. <\/p>\n

Pesquisadores desenvolveram um prot\u00f3tipo funcional de exploit que permite iniciar um shell root no ambiente do host a partir do ambiente convidado em um sistema com processador AMD Epyc 7351P e kernel Linux 5.10. Observa-se que esta \u00e9 a primeira vulnerabilidade do tipo «guest-to-host» no pr\u00f3prio hipervisor. KVM<\/a>, n\u00e3o relacionada a erros em componentes que operam no espa\u00e7o do usu\u00e1rio, como o QEMU. A corre\u00e7\u00e3o foi aceita no n\u00facleo no final de mar\u00e7o. O problema se manifesta a partir do n\u00facleo Linux 5.10-rc1 at\u00e9 o v5.12-rc6, ou seja, abrange apenas os n\u00facleos 5.10 e 5.11 (a maioria dos ramos est\u00e1veis das distribui\u00e7\u00f5es n\u00e3o foi afetada pelo problema). <\/p>\n

O problema est\u00e1 presente no mecanismo nested_svm_vmrun, realizado com o uso da extens\u00e3o AMD SVM (Secure Virtual Machine) e que permite organizar a execu\u00e7\u00e3o aninhada de sistemas convidados. Para uma implementa\u00e7\u00e3o correta dessa funcionalidade, o hipervisor deve interceptar todas as instru\u00e7\u00f5es SVM executadas nos sistemas convidados, emulando seu comportamento e sincronizando o estado com o hardware, o que \u00e9 uma tarefa bastante complexa. Ao analisar a implementa\u00e7\u00e3o proposta no KVM, os pesquisadores encontraram um erro l\u00f3gico que permite influenciar o conte\u00fado dos registradores MSR (Model-Specific Register) do host a partir do sistema convidado, o que pode ser usado para executar c\u00f3digo em n\u00edvel de host. <\/p>\n

Em particular, a execu\u00e7\u00e3o da opera\u00e7\u00e3o VMRUN a partir do sistema convidado de segundo n\u00edvel (L2, executado a partir de outro sistema convidado) leva a uma segunda chamada de nested_svm_vmrun e \u00e0 corrup\u00e7\u00e3o da estrutura svm->nested.hsave, que \u00e9 sobreposta por dados da vmcb do sistema convidado L2. Como resultado, surge uma situa\u00e7\u00e3o em que, no n\u00edvel do sistema convidado L2, \u00e9 poss\u00edvel liberar mem\u00f3ria na estrutura svm->nested.msrpm, onde o bit MSR \u00e9 armazenado, apesar de ainda estar em uso, permitindo o acesso ao MSR do ambiente do host.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29657) \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u044f\u0434\u0440\u0430 Linux \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD (\u043c\u043e\u0434\u0443\u043b\u044c kvm-amd.ko) \u0438 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100636","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade no c\u00f3digo KVM espec\u00edfico para CPU AMD, permitindo a execu\u00e7\u00e3o de c\u00f3digo fora do sistema convidado | ProHoster","description":"Pesquisadores da equipe Google Project Zero descobriram uma vulnerabilidade (CVE-2021-29657) no hipervisor KVM inclu\u00eddo no n\u00facleo do Linux, que permite contornar a isola\u00e7\u00e3o do sistema operacional convidado e executar seu c\u00f3digo na m\u00e1quina host.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u043e\u043c \u0434\u043b\u044f CPU AMD \u043a\u043e\u0434\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432\u043d\u0435 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29657) \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u044f\u0434\u0440\u0430 Linux \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 KVM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-speczifichnom-dlya-cpu-amd-kode-kvm-pozvolyayushhaya-vypolnit-kod-vne-gostevoj-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-30T20:23:10+00:00","article:modified_time":"2021-06-30T20:23:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100636","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-30 20:28:56","updated":"2022-10-01 07:58:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=100636"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100636\/revisions"}],"predecessor-version":[{"id":164274,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100636\/revisions\/164274"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=100636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=100636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=100636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}