{"id":112031,"date":"2023-12-06T21:10:26","date_gmt":"2023-12-06T19:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati"},"modified":"2023-12-06T21:10:26","modified_gmt":"2023-12-06T19:10:26","slug":"slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","title":{"rendered":"SLAM \u2014 um ataque a CPUs Intel, AMD e ARM que permite determinar o conte\u00fado da mem\u00f3ria","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um grupo de pesquisadores da Universidade Livre de Amsterd\u00e3 apresentou uma nova t\u00e9cnica de ataque chamada SLAM (Spectre Linear Address Masking), que oferece um novo m\u00e9todo para explorar vulnerabilidades microarquiteturais na classe Spectre. Nesse ataque, a vazamento de dados ocorre durante a tradu\u00e7\u00e3o de endere\u00e7os n\u00e3o can\u00f4nicos, e as extens\u00f5es para mascaramento de endere\u00e7os lineares, dispon\u00edveis em novos processadores, s\u00e3o utilizadas para contornar as verifica\u00e7\u00f5es de canonicalidade. Os pesquisadores publicaram um conjunto de ferramentas com a implementa\u00e7\u00e3o do m\u00e9todo e propuseram uma demonstra\u00e7\u00e3o mostrando como \u00e9 poss\u00edvel extrair da mem\u00f3ria do n\u00facleo dados correspondentes a uma determinada m\u00e1scara (demonstrado como, em poucos segundos, no Ubuntu, \u00e9 poss\u00edvel extrair da mem\u00f3ria do n\u00facleo uma string com o hash da senha do usu\u00e1rio root).

\r\n \"Por\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

O ataque pode ser realizado em sistemas com processadores Intel que suportam a extens\u00e3o LAM (Linear Address Masking), processadores AMD com a extens\u00e3o UAI (Upper Address Ignore) e processadores ARM com a extens\u00e3o TBI (Top Byte Ignore). Essas extens\u00f5es permitem que parte dos bits de ponteiros de 64 bits seja utilizada para armazenar metadados n\u00e3o relacionados ao endere\u00e7amento (programas convencionais n\u00e3o exigem tanta mem\u00f3ria e conseguem endere\u00e7ar ponteiros de 64 bits, portanto, os bits superiores podem ser utilizados, por exemplo, para verifica\u00e7\u00f5es relacionadas \u00e0 seguran\u00e7a). \u00c9 interessante notar que os processadores Intel, AMD e ARM com suporte para LAM, UAI e TBI foram apenas anunciados, mas ainda n\u00e3o est\u00e3o sendo produzidos em massa, o que torna o SLAM o primeiro ataque especulativo contra CPUs futuras. O ataque tamb\u00e9m pode ser realizado em CPUs antigas da AMD Zen+ e Zen 2, vulner\u00e1veis \u00e0 falha CVE-2020-12965. <\/p>\n

Assim como na explora\u00e7\u00e3o de vulnerabilidades Spectre, para realizar um ataque SLAM \u00e9 necess\u00e1rio que o n\u00facleo tenha determinadas sequ\u00eancias de instru\u00e7\u00f5es (gadgets) que levam \u00e0 execu\u00e7\u00e3o especulativa de instru\u00e7\u00f5es. Essas instru\u00e7\u00f5es provocam a leitura especulativa de dados da mem\u00f3ria, dependendo das condi\u00e7\u00f5es externas, que podem ser influenciadas pelo atacante. Ap\u00f3s a determina\u00e7\u00e3o de uma previs\u00e3o incorreta, o resultado da execu\u00e7\u00e3o especulativa \u00e9 descartado, mas os dados processados permanecem no cache e podem ser extra\u00eddos posteriormente atrav\u00e9s da an\u00e1lise por canais externos. Para extrair dados que ficaram no cache, os pesquisadores utilizam o m\u00e9todo Evict+Reload, que se baseia na cria\u00e7\u00e3o de condi\u00e7\u00f5es para expulsar dados do cache (por exemplo, uma atividade \u00e9 gerada para preencher uniformemente o cache com conte\u00fado t\u00edpico) e na execu\u00e7\u00e3o de opera\u00e7\u00f5es cujo tempo de execu\u00e7\u00e3o indica a presen\u00e7a de dados no cache do processador. <\/p>\n

Para realizar um ataque SLAM, s\u00e3o utilizados gadgets baseados em c\u00f3digo, onde os dados controlados pelo atacante (abaixo a vari\u00e1vel \u00absecret\u00bb) s\u00e3o usados como ponteiro. Por exemplo: void unmasked_gadget(long **secret) { **secret; } <\/p>\n

Observa-se que tais padr\u00f5es de c\u00f3digo s\u00e3o frequentemente utilizados em programas, por exemplo, no n\u00facleo do Linux foram identificados dezenas de milhares desses gadgets, dos quais pelo menos algumas centenas s\u00e3o adequados para uso em exploits. A fuga pode ser bloqueada atrav\u00e9s da adi\u00e7\u00e3o de instru\u00e7\u00f5es adicionais a esses gadgets que bloqueiam a execu\u00e7\u00e3o especulativa. A Intel planeja fornecer um m\u00e9todo de bloqueio de vazamentos antes do in\u00edcio da entrega de processadores com suporte ao LAM. A AMD recomendou o uso de m\u00e9todos existentes para bloquear ataques do tipo Spectre v2. Os desenvolvedores do n\u00facleo do Linux, para prote\u00e7\u00e3o contra ataques, decidiram desativar por padr\u00e3o o suporte ao LAM at\u00e9 a publica\u00e7\u00e3o das recomenda\u00e7\u00f5es da Intel sobre como bloquear a vulnerabilidade.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u043d\u0435\u043a\u0430\u043d\u043e\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u043a\u0430\u043d\u043e\u043d\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0432 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043b\u0438\u043d\u0435\u0439\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0442\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112031","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SLAM \u2014 ataque em CPUs Intel, AMD e ARM, permitindo determinar o conte\u00fado da mem\u00f3ria | ProHoster","description":"Um grupo de pesquisadores da Vrije Universiteit Amsterdam apresentou uma nova t\u00e9cnica de ataque SLAM (Spectre Linear Address Masking), oferecendo uma nova forma de explorar vulnerabilidades microarquiteturais.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SLAM \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 CPU Intel, AMD \u0438 ARM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-06T19:10:26+00:00","article:modified_time":"2023-12-06T19:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/112031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=112031"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/112031\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=112031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=112031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=112031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}