{"id":101725,"date":"2021-10-22T16:22:55","date_gmt":"2021-10-22T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave"},"modified":"2021-10-22T16:22:55","modified_gmt":"2021-10-22T14:22:58","slug":"ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","title":{"rendered":"Atacul asupra Intel SGX permite extragerea de date confiden\u021biale sau executarea de cod \u00een enclave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Universitatea Tehnic\u0103 de Ap\u0103rare a Armatei Populare din China, Universitatea Na\u021bional\u0103 din Singapore \u0219i Institutul Federal de Tehnologie din Zurich au dezvoltat o nou\u0103 metod\u0103 de atac asupra enclavei izolate Intel SGX (Software Guard eXtensions). Atacul a fost denumit SmashEx \u0219i este cauzat de probleme de reentrabilitate \u00een gestionarea excep\u021biilor \u00een cadrul componentelor de runtime pentru Intel SGX. Metoda de atac propus\u0103 permite, \u00een condi\u021biile unui control asupra sistemului de operare, identificarea datelor confiden\u021biale stocate \u00een enclave sau copierea \u0219i executarea propriului cod \u00een memoria enclavei. <\/p>\n

Protocoalele de exploatare au fost preg\u0103tite pentru enclavele cu runtime bazat pe Intel SGX SDK (CVE-2021-0186) \u0219i Microsoft Open Enclave (CVE-2021-33767). \u00cen primul caz, a fost demonstrat\u0103 posibilitatea extragerii unei chei RSA, utilizat\u0103 pe serverul web pentru HTTPS, iar \u00een al doilea a fost posibil\u0103 identificarea con\u021binutului ob\u021binut cu utilitarul cURL, executat \u00een interiorul enclavei. Vulnerabilitatea a fost deja remediat\u0103 prin actualiz\u0103ri \u00een versiunile Intel SGX SDK 2.13 \u0219i Open Enclave 0.17.1. Pe l\u00e2ng\u0103 pachetele Intel SGX SDK \u0219i Microsoft Open Enclave, vulnerabilitatea se manifest\u0103 \u0219i \u00een SDK-uri precum Google Asylo, EdgelessRT, Apache Teaclave, Rust SGX SDK, SGX-LKL, CoSMIX \u0219i Veracruz. <\/p>\n

Amintim c\u0103 tehnologia SGX (Software Guard Extensions) a fost introdus\u0103 \u00een procesoarele Intel Core de a \u0219asea genera\u021bie (Skylake) \u0219i ofer\u0103 o serie de instruc\u021biuni care permit alocarea unor zone de memorie \u00eenchise pentru aplica\u021biile la nivel de utilizator - enclavuri, al c\u0103ror con\u021binut nu poate fi citit sau modificat chiar de c\u0103tre nucleu \u0219i codul care ruleaz\u0103 \u00een modurile ring0, SMM \u0219i VMM. Controlul codului din enclav\u0103 nu poate fi transferat prin func\u021bii tradi\u021bionale de tranzi\u021bie \u0219i manipul\u0103ri cu registrele \u0219i stiva - pentru a transfera controlul \u00een enclav\u0103 se utilizeaz\u0103 instruc\u021biuni noi special create, EENTER, EEXIT \u0219i ERESUME, care efectueaz\u0103 verific\u0103ri de autorizare. \u00cen acela\u0219i timp, codul plasat \u00een enclav\u0103 poate utiliza metodele clasice de apel pentru a accesa func\u021bii \u00een interiorul enclavului \u0219i o instruc\u021biune special\u0103 pentru a apela func\u021bii externe. Pentru a proteja \u00eempotriva atacurilor hardware, cum ar fi conectarea la modul DRAM, este utilizat\u0103 criptarea memoriei enclavului.

\"Atacul<\/center> <\/p>\n

Problema este legat\u0103 de faptul c\u0103 tehnologia SGX permite sistemului de operare s\u0103 \u00eentrerup\u0103 execu\u021bia enclavei prin generarea unei excep\u021bii hardware, iar \u00een enclave nu sunt implementate corespunz\u0103tor primitivele pentru procesarea atomic\u0103 a acestor excep\u021bii. Spre deosebire de nucleul sistemului de operare \u0219i aplica\u021biile obi\u0219nuite, codul din interiorul enclavei nu are acces la primitivele necesare pentru organizarea ac\u021biunilor atomice \u00een timpul proces\u0103rii excep\u021biilor care apar asincron. F\u0103r\u0103 aceste primitive atomice, enclava poate fi \u00eentrerupt\u0103 oric\u00e2nd \u0219i poate fi reluat\u0103, chiar \u0219i \u00een momentele \u00een care se execut\u0103 sec\u021biuni critice \u0219i se afl\u0103 \u00eentr-o stare nesigur\u0103 (de exemplu, c\u00e2nd registrele CPU nu sunt salvate\/restaurate).

\"Atacul<\/center> <\/p>\n

Pentru a func\u021biona corect, tehnologia SGX permite \u00eentreruperea execu\u021biei enclavei prin excep\u021bii hardware configurabile. Aceast\u0103 caracteristic\u0103 permite mediilor de runtime ale enclavei s\u0103 implementeze procesarea excep\u021biilor interne ale enclavei sau procesarea semnalelor, dar poate provoca \u0219i erori de reentran\u021b\u0103. Atacul SmashEx se bazeaz\u0103 pe exploatarea deficien\u021belor din SDK din cauza c\u0103rora nu se proceseaz\u0103 corect situa\u021bia unui apel repetat al handler-ului de excep\u021bie. Este important ca, pentru a exploata vulnerabilitatea, atacatorul s\u0103 aib\u0103 capacitatea de a \u00eentrerupe execu\u021bia enclavei, adic\u0103 trebuie s\u0103 controleze func\u021bionarea mediului de sistem. <\/p>\n

Dup\u0103 generarea excep\u021biei, atacatorul ob\u021bine o fereastr\u0103 temporar\u0103 mic\u0103 \u00een care poate intercepta fluxul de execu\u021bie prin manipularea parametrilor de intrare. \u00cen special, av\u00e2nd acces la sistem (mediul din afara enclavei), se poate genera o nou\u0103 excep\u021bie imediat dup\u0103 executarea instruc\u021biunii de intrare \u00een enclav\u0103 (EENTER), ceea ce va duce la returnarea controlului sistemului \u00eentr-o etap\u0103 \u00een care configura\u021bia stivei pentru enclav\u0103 nu a fost \u00eenc\u0103 finalizat\u0103, inclusiv starea registrelor CPU fiind salvat\u0103. <\/p>\n

Sistemul poate apoi s\u0103 returneze controlul \u00eenapoi \u00een enclav\u0103, dar deoarece stiva enclavei nu a fost configurat\u0103 \u00een timpul \u00eentreruperii, enclava va fi executat\u0103 cu stiva care se afl\u0103 \u00een memoria sistemului, ceea ce poate fi exploatat pentru a aplica metode de exploatare bazate pe programarea orientat\u0103 pe \u00eentoarcere (ROP - Return-Oriented Programming). Folosind tehnica ROP, atacatorul nu caut\u0103 s\u0103 plaseze codul s\u0103u \u00een memorie, ci opereaz\u0103 cu fragmente deja existente \u00een bibliotecile \u00eenc\u0103rcate de instruc\u021biuni ma\u0219in\u0103, care se termin\u0103 cu o instruc\u021biune de \u00eentoarcere a controlului (de obicei, acestea sunt capetele func\u021biilor din biblioteci). Func\u021bionarea exploit-ului se rezum\u0103 la construirea unei secven\u021be de apeluri la astfel de module (\u201egadgets\u201d) pentru a ob\u021bine func\u021bionalitatea dorit\u0103.

\"Atacul<\/center>
\"Atacul<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u043d\u043a\u043b\u0430\u0432\u044b Intel SGX (Software Guard eXtensions). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 SmashEx \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441 \u0440\u0435\u0435\u043d\u0442\u0435\u0440\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u044b runtime-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f Intel SGX. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atac asupra Intel SGX, care permite extragerea datelor confiden\u021biale sau executarea codului \u00een enclav\u0103 | ProHoster","description":"Cercet\u0103torii de la Universitatea Tehnico-Militar\u0103 a Armatei Populare de Eliberare din China, Universitatea Na\u021bional\u0103 din Singapore \u0219i ETH Z\u00fcrich au dezvoltat o nou\u0103 metod\u0103 de atac.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Intel SGX, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432\u0435 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-22T14:22:58+00:00","article:modified_time":"2021-10-22T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-22 14:25:41","updated":"2022-09-28 00:18:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/101726"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}