{"id":84664,"date":"2020-06-10T01:42:18","date_gmt":"2020-06-09T23:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami"},"modified":"2020-06-10T01:42:18","modified_gmt":"2020-06-09T23:42:18","slug":"crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","title":{"rendered":"CROSSTalk \u2014 uma vulnerabilidade no CPU Intel que leva ao vazamento de dados entre n\u00facleos","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um grupo de pesquisadores da Universidade Livre de Amsterd\u00e3 identificou uma nova uma vulnerabilidade<\/a><\/noindex> (CVE-2020-0543) em estruturas microarquiteturais de processadores Intel, not\u00e1vel porque permite a recupera\u00e7\u00e3o dos resultados da execu\u00e7\u00e3o de certas instru\u00e7\u00f5es realizadas em outro n\u00facleo de CPU. Esta \u00e9 a primeira vulnerabilidade do mecanismo de execu\u00e7\u00e3o especulativa de instru\u00e7\u00f5es que permite o vazamento de dados entre n\u00facleos individuais de CPU (vazamentos anteriores eram limitados a diferentes threads de um \u00fanico n\u00facleo). Os pesquisadores nomearam o problema de CROSSTalk, mas na documenta\u00e7\u00e3o da Intel<\/a><\/noindex> a vulnerabilidade \u00e9 mencionada como SRBDS (Special Register Buffer Data Sampling). <\/p>\n

A vulnerabilidade est\u00e1 relacionada a uma classe de problemas MDS (Microarchitectural Data Sampling) apresentada<\/a><\/noindex> h\u00e1 um ano e baseia-se na aplica\u00e7\u00e3o de m\u00e9todos de an\u00e1lise de canais laterais aos dados em estruturas microarquiteturais. Princ\u00edpio de funcionamento<\/a><\/noindex> CROSSTalk \u00e9 semelhante \u00e0 vulnerabilidade RIDL<\/a><\/noindex>, mas difere na fonte do vazamento.
\nA nova vulnerabilidade manipula o vazamento de um buffer intermedi\u00e1rio anteriormente n\u00e3o documentado, que \u00e9 utilizado em conjunto por todos os n\u00facleos de CPU. <\/p>\n

\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

A ess\u00eancia do problema<\/a><\/noindex> \u00e9 que algumas instru\u00e7\u00f5es do microprocessador, incluindo RDRAND, RDSEED e SGX EGETKEY, s\u00e3o implementadas usando uma opera\u00e7\u00e3o microarquitetural interna chamada SRR (Special Register Reads). Em processadores vulner\u00e1veis, os dados retornados para SRR se acumulam em um buffer intermedi\u00e1rio, compartilhado entre todos os n\u00facleos de CPU, e depois s\u00e3o transferidos para um buffer de preenchimento associado a um n\u00facleo f\u00edsico espec\u00edfico de CPU onde a opera\u00e7\u00e3o de leitura foi iniciada. Em seguida, o valor \u00e9 copiado do buffer de preenchimento para os registradores vis\u00edveis para os aplicativos. <\/p>\n

O tamanho do buffer intermedi\u00e1rio compartilhado corresponde \u00e0 linha de cache, geralmente maior do que o tamanho dos dados lidos, e diferentes opera\u00e7\u00f5es de leitura afetam diferentes deslocamentos no buffer. Como o buffer compartilhado \u00e9 copiado integralmente para o buffer de preenchimento, n\u00e3o s\u00f3 a parte necess\u00e1ria para a opera\u00e7\u00e3o atual \u00e9 movida, mas tamb\u00e9m os dados remanescentes de outras opera\u00e7\u00f5es, incluindo aquelas realizadas em outros n\u00facleos de CPU.
\n

\"CROSSTalk<\/a><\/noindex><\/center>
\n
\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

No caso de uma organiza\u00e7\u00e3o bem-sucedida do ataque, um usu\u00e1rio local autenticado no sistema pode determinar o resultado da execu\u00e7\u00e3o das instru\u00e7\u00f5es RDRAND, RDSEED e EGETKEY em um processo de terceiros ou dentro de um enclave Intel SGX, independentemente do n\u00facleo da CPU em que o c\u00f3digo est\u00e1 sendo executado.
\nOs pesquisadores que identificaram o problema publicaram<\/a><\/noindex> um prot\u00f3tipo de exploit que demonstra a possibilidade de vazamento de informa\u00e7\u00f5es sobre valores aleat\u00f3rios obtidos atrav\u00e9s das instru\u00e7\u00f5es RDRAND e RDSEED, para a recupera\u00e7\u00e3o de uma chave privada ECDSA, manipulada em um enclave Intel SGX, ap\u00f3s a realiza\u00e7\u00e3o de apenas uma opera\u00e7\u00e3o de assinatura digital no sistema.<\/p>\n


\n
\r\n \"Por\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

O Problema \u00e9 suscet\u00edvel a<\/a><\/noindex> uma ampla gama de processadores Intel para desktops, m\u00f3veis e servidores, incluindo Core i3, i5, i7, i9, m3, Celeron (s\u00e9ries J, G e N), Atom (s\u00e9ries C, E e X), Xeon (fam\u00edlias E3, E5, E7, W e D), Xeon Scalable, etc. Vale ressaltar que a Intel foi notificada sobre a vulnerabilidade em setembro de 2018, e em julho de 2019 foi fornecido um prot\u00f3tipo de exploit que demonstrava vazamento de dados entre n\u00facleos de CPU, mas o desenvolvimento da corre\u00e7\u00e3o se prolongou devido \u00e0 complexidade de sua implementa\u00e7\u00e3o. Na atualiza\u00e7\u00e3o de microc\u00f3digo proposta hoje, o problema foi bloqueado alterando o comportamento das instru\u00e7\u00f5es RDRAND, RDSEED e EGETKEY para uma grava\u00e7\u00e3o excessiva de dados em um buffer compartilhado para evitar a persist\u00eancia de informa\u00e7\u00f5es residuais nele. Al\u00e9m disso, foi aplicada a suspens\u00e3o do acesso ao buffer at\u00e9 que as opera\u00e7\u00f5es de leitura e regrava\u00e7\u00e3o do conte\u00fado fossem conclu\u00eddas. <\/p>\n

Um efeito colateral dessa prote\u00e7\u00e3o \u00e9 o aumento da lat\u00eancia na execu\u00e7\u00e3o das instru\u00e7\u00f5es RDRAND, RDSEED e EGETKEY, e a redu\u00e7\u00e3o da largura de banda ao tentar executar essas instru\u00e7\u00f5es simultaneamente em diferentes processadores l\u00f3gicos. A execu\u00e7\u00e3o das instru\u00e7\u00f5es RDRAND, RDSEED e EGETKEY tamb\u00e9m suspende o acesso \u00e0 mem\u00f3ria de outros processadores l\u00f3gicos. Essas caracter\u00edsticas podem afetar negativamente o desempenho de algumas aplica\u00e7\u00f5es de servidor, portanto, o firmware prev\u00ea um mecanismo (RNGDS_MITG_DIS) para desativar a prote\u00e7\u00e3o das instru\u00e7\u00f5es RDRAND e RDSEED realizadas fora do enclave Intel SGX.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u043c \u044f\u0434\u0440\u0435 CPU. \u042d\u0442\u043e \u043f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0442\u0435\u0447\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u044f\u0434\u0440\u0430\u043c\u0438 CPU (\u0440\u0430\u043d\u0435\u0435 \u0443\u0442\u0435\u0447\u043a\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043f\u043e\u0442\u043e\u043a\u0430\u043c\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u044f\u0434\u0440\u0430). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0438\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84665,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84664","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47CROSSTalk \u2014 uma vulnerabilidade no CPU Intel que resulta em vazamento de dados entre n\u00facleos | ProHoster","description":"Um grupo de pesquisadores da Universidade Livre de Amsterd\u00e3 identificou uma nova vulnerabilidade (CVE-2020-0543) na microarquitetura.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CROSSTalk \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU Intel, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u044f\u0434\u0440\u0430\u043c\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:18+00:00","article:modified_time":"2020-06-09T23:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84664","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:00:17","updated":"2022-09-29 11:12:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/84664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=84664"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/84664\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/84665"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=84664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=84664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=84664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}