{"id":119185,"date":"2024-08-08T09:43:01","date_gmt":"2024-08-08T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie"},"modified":"2024-08-08T09:43:01","modified_gmt":"2024-08-08T07:43:01","slug":"uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","title":{"rendered":"Vulnerabilidade GhostWrite, que fornece acesso total \u00e0 mem\u00f3ria f\u00edsica no CPU RISC-V XuanTie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pesquisadores do Centro Helmholtz de Seguran\u00e7a da Informa\u00e7\u00e3o (CISPA) publicaram os resultados de um estudo sobre a seguran\u00e7a de processadores baseados na arquitetura RISC-V e revelaram informa\u00e7\u00f5es sobre uma vulnerabilidade codinome GhostWrite. A vulnerabilidade afeta os processadores RISC-V XuanTie C910, fabricados pela empresa chinesa T-Head (uma subsidi\u00e1ria da Alibaba) e desenvolvidos como projetos abertos. A vulnerabilidade permite que um atacante, com acesso limitado e n\u00e3o privilegiado ao sistema, consiga ler e gravar em quaisquer \u00e1reas da mem\u00f3ria f\u00edsica, al\u00e9m de obter acesso ao controle de dispositivos perif\u00e9ricos, como placas de rede que utilizam MMIO (Mem\u00f3ria Mapeada para Entrada\/Sa\u00edda). <\/p>\n

A vulnerabilidade \u00e9 causada por falhas na arquitetura do processador, relacionadas \u00e0 isola\u00e7\u00e3o das instru\u00e7\u00f5es adicionadas pelo fabricante, que expandem a arquitetura do conjunto de instru\u00e7\u00f5es RISC-V e permitem acesso direto \u00e0 DRAM, contornando os mecanismos de mem\u00f3ria virtual. A opera\u00e7\u00e3o de algumas instru\u00e7\u00f5es expandidas diretamente com a mem\u00f3ria f\u00edsica, em vez da mem\u00f3ria virtual, possibilita contornar a isola\u00e7\u00e3o da mem\u00f3ria entre processos. <\/p>\n

A t\u00e9cnica preparada para a execu\u00e7\u00e3o de ataques \u00e9 100% reproduz\u00edvel e exige a execu\u00e7\u00e3o de seu c\u00f3digo em quest\u00e3o de microssegundos. M\u00e9todos de isolamento, como cont\u00eaineres e ambientes de sandbox, n\u00e3o impedem a explora\u00e7\u00e3o da vulnerabilidade. Para bloquear a vulnerabilidade, \u00e9 necess\u00e1rio desabilitar completamente o suporte para extens\u00f5es vetoriais, o que resulta em uma redu\u00e7\u00e3o de 33% no desempenho em testes rvv-bench (no resumo do relat\u00f3rio \u00e9 mencionado 77%, enquanto na p\u00e1gina de resumo \u2014 33%; detalhes tamb\u00e9m mencionam uma queda de desempenho no memcpy de 33% e no memset de 8%), al\u00e9m de aproximadamente reduzir pela metade o conjunto de instru\u00e7\u00f5es de processador dispon\u00edvel para aplicativos. <\/p>\n

Os processadores CPU XuanTie C910 s\u00e3o alguns dos chips RISC-V de mais alto desempenho dispon\u00edveis no mercado e j\u00e1 est\u00e3o sendo amplamente utilizados em servidores<\/a> sistemas de nuvem e laptops. Por exemplo, o problema se manifesta em servidores Scaleway Elastic Metal RV1, clusters Lichee Cluster 4A, laptop Lichee Book 4A, console de jogos Lichee Console 4A, computador port\u00e1til Lichee Pocket 4A, PCs de placa \u00fanica Sipeed Lichee Pi 4A, Milk-V Meles e BeagleV-Ahead. <\/p>\n

Como exemplo, os pesquisadores prepararam um exploit que permite a um usu\u00e1rio n\u00e3o privilegiado obter acesso root no Linux. O exploit altera o conte\u00fado da tabela de p\u00e1ginas na mem\u00f3ria, usada para traduzir endere\u00e7os virtuais em f\u00edsicos, para obter endere\u00e7os virtuais relacionados a quaisquer endere\u00e7os f\u00edsicos. Um exemplo de exploit tamb\u00e9m foi preparado para ler o conte\u00fado da mem\u00f3ria do kernel e de outros processos, permitindo a extra\u00e7\u00e3o de chaves de criptografia e senhas armazenadas na mem\u00f3ria.

Al\u00e9m disso, os pesquisadores identificaramm duas vulnerabilidades arquitet\u00f4nicas menos perigosas \u2014 uma afeta os processadores T-Head XuanTie C906 e a outra T-Head XuanTie C908. Ambas as vulnerabilidades est\u00e3o limitadas \u00e0 nega\u00e7\u00e3o de servi\u00e7o devido \u00e0 parada do funcionamento da CPU. As vulnerabilidades podem representar um perigo para plataformas em nuvem baseadas em chips T-Head XuanTie, pois, com acesso \u00e0 execu\u00e7\u00e3o de c\u00f3digo em um ambiente de nuvem, existe a possibilidade de interromper o funcionamento de outros usu\u00e1rios atendidos na mesma. servidor<\/a>. <\/p>\n

Os problemas foram identificados com a ajuda do framework RISCVuzz, criado para testes de fuzzing em CPUs. O framework detecta diferen\u00e7as na implementa\u00e7\u00e3o das mesmas instru\u00e7\u00f5es estendidas em diferentes CPUs, com base na suposi\u00e7\u00e3o de que, devido \u00e0 falta de um registro \u00fanico de extens\u00f5es do conjunto de instru\u00e7\u00f5es RISC-V, instru\u00e7\u00f5es codificadas da mesma forma em chips de diferentes fabricantes podem levar a a\u00e7\u00f5es diferentes. A verifica\u00e7\u00e3o consistiu em comparar o comportamento ao processar instru\u00e7\u00f5es de CPU em diferentes CPUs RISC-V e analisar poss\u00edveis vulnerabilidades em situa\u00e7\u00f5es onde discrep\u00e2ncias de comportamento foram observadas.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b RISC-V \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f GhostWrite. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 RISC-V-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b XuanTie C910, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 T-Head (\u043f\u043e\u0434\u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435 Alibaba) \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119185","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade GhostWrite, que fornece acesso completo \u00e0 mem\u00f3ria f\u00edsica no CPU RISC-V XuanTie | ProHoster","description":"Pesquisadores do Centro Helmholtz de Seguran\u00e7a da Informa\u00e7\u00e3o (CISPA) publicaram os resultados de um estudo sobre a seguran\u00e7a de processadores baseados na arquitetura RISC-V e revelaram informa\u00e7\u00f5es sobre uma vulnerabilidade que recebeu o c\u00f3digo.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c GhostWrite, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 CPU RISC-V XuanTie | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b RISC-V \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-08T07:43:01+00:00","article:modified_time":"2024-08-08T07:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119185","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:01:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:35:19","updated":"2026-02-09 22:01:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/119185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=119185"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/119185\/revisions"}],"predecessor-version":[{"id":164438,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/119185\/revisions\/164438"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=119185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=119185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=119185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}