{"id":103242,"date":"2022-02-08T09:36:38","date_gmt":"2022-02-08T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-uefi-proshivkah-na-baze-frejmvorka-insydeh2o-pozvolyayushhie-vypolnit-kod-na-urovne-smm"},"modified":"2022-02-08T09:36:38","modified_gmt":"2022-02-08T07:36:38","slug":"uyazvimosti-v-uefi-proshivkah-na-baze-frejmvorka-insydeh2o-pozvolyayushhie-vypolnit-kod-na-urovne-smm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-uefi-proshivkah-na-baze-frejmvorka-insydeh2o-pozvolyayushhie-vypolnit-kod-na-urovne-smm","title":{"rendered":"Vulnerabilit\u0103\u021bile \u00een firmware-urile UEFI bazate pe cadru InsydeH2O, care permit executarea codului la nivel SMM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen cadrul arhitecturii InsydeH2O, utilizat\u0103 de mul\u021bi produc\u0103tori pentru a crea firmware UEFI pentru echipamentele lor (cea mai comun\u0103 implementare UEFI BIOS), au fost identificate 23 de vulnerabilit\u0103\u021bi care permit execu\u021bia codului la nivelul SMM (System Management Mode), un nivel mai prioritar (Ring -2) dec\u00e2t modul hypervisor \u0219i nivelul de protec\u021bie zero, av\u00e2nd acces nelimitat la \u00eentreaga memorie. Problema afecteaz\u0103 firmware-urile UEFI utilizate de produc\u0103tori precum Fujitsu, Siemens, Dell, HP, HPE, Lenovo, Microsoft, Intel \u0219i Bull Atos.    <\/p>\n<p>Exploatarea vulnerabilit\u0103\u021bilor necesit\u0103 acces local cu drepturi de administrator, ceea ce face ca aceste probleme s\u0103 fie de interes ca vulnerabilit\u0103\u021bi de nivel secundar utilizate dup\u0103 exploatarea altor vulnerabilit\u0103\u021bi \u00een sistem sau prin utilizarea metodelor de inginerie social\u0103. Accesul la nivelul SMM permite execu\u021bia codului la un nivel care nu este controlat de sistemul de operare, ceea ce poate fi utilizat pentru modificarea firmware-urilor \u0219i l\u0103sarea de cod mali\u021bios sau rootkit-uri ascunse \u00een SPI Flash, nedetectabile din sistemul de operare, precum \u0219i pentru dezactivarea verific\u0103rii la pornire (UEFI Secure Boot, Intel BootGuard) \u0219i atacuri asupra hypervisor-urilor pentru a ocoli mecanismele de verificare a integrit\u0103\u021bii mediilor virtuale.  <center><img decoding=\"async\" alt=\"Vulnerabilit\u0103\u021bile \u00een firmware-urile UEFI bazate pe cadru InsydeH2O, care permit executarea codului la nivel SMM.\" src=\"\/wp-content\/uploads\/2022\/02\/dcf918bee3be0d2788f82d325cd671c7.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>Exploatarea vulnerabilit\u0103\u021bilor poate fi efectuat\u0103 din sistemul de operare prin intermediul SMI-handler-urilor (System Management Interrupt) neverificate, precum \u0219i \u00eentr-o etap\u0103 anterioar\u0103 execut\u0103rii sistemului de operare \u00een timpul etapelor ini\u021biale de boot sau la revenirea din modul de repaus. Toate vulnerabilit\u0103\u021bile sunt cauzate de probleme cu gestionarea memoriei \u0219i sunt \u00eemp\u0103r\u021bite \u00een trei categorii:   <\/p>\n<ul>\n<li class=\"l\"> SMM Callout \u2014 executarea propriului cod cu drepturi SMM prin redirec\u021bionarea execu\u021biei handler-elor de \u00eentrerupere SWSMI c\u0103tre codul din afara SMRAM;\n<li class=\"l\"> Corup\u021bia memoriei, care permite atacatorului s\u0103 scrie propriile date \u00een SMRAM, o zon\u0103 special\u0103 de memorie izolat\u0103 \u00een care se execut\u0103 codul cu drepturi SMM.\n<li class=\"l\"> Corup\u021bia memoriei \u00een codul care se execut\u0103 la nivelul DXE (Driver eXecution Environment).  <\/ul>\n<p>Pentru a demonstra principiile organiza\u021biei unui atac, a fost publicat un exemplu de exploit, care permite, prin realizarea unui atac din al treilea sau primul cerc de ap\u0103rare, accesul la DXE Runtime UEFI \u0219i executarea propriului cod. Exploit-ul manipuleaz\u0103 dep\u0103\u0219irea stivei (CVE-2021-42059) din driverul UEFI DXE. \u00cen cursul atacului, atacatorul poate plasa propriul cod \u00een driverul DXE, care \u00ee\u0219i p\u0103streaz\u0103 activitatea dup\u0103 repornirea sistemului de operare, sau poate modifica aria NVRAM \u00een SPI Flash. \u00cen procesul de execu\u021bie, codul atacatorului poate schimba zone privilegiate din memorie, modifica serviciile EFI Runtime \u0219i influen\u021ba procesul de \u00eenc\u0103rcare.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56656\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 InsydeH2O, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043a \u0441\u0432\u043e\u0435\u043c\u0443 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e (\u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f UEFI BIOS), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 23 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c (Ring -2), \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0442\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438, \u043a\u0430\u043a Fujitsu, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 InsydeH2O, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043a \u0441\u0432\u043e\u0435\u043c\u0443 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e (\u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f UEFI BIOS), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 23 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-uefi-proshivkah-na-baze-frejmvorka-insydeh2o-pozvolyayushhie-vypolnit-kod-na-urovne-smm\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 InsydeH2O, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 InsydeH2O, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043a \u0441\u0432\u043e\u0435\u043c\u0443 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e (\u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f UEFI BIOS), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 23 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-uefi-proshivkah-na-baze-frejmvorka-insydeh2o-pozvolyayushhie-vypolnit-kod-na-urovne-smm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-02-08T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-02-08T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u0103\u021bile din firmware UEFI bazate pe framework-ul InsydeH2O, care permit executarea codului la nivel SMM | ProHoster","description":"\u00cen cadrul framework-ului InsydeH2O, utilizat de mul\u021bi produc\u0103tori pentru a crea firmware UEFI pentru echipamentele lor (cea mai comun\u0103 implementare a UEFI BIOS), au fost identificate 23 de vulnerabilit\u0103\u021bi care permit executarea codului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-uefi-proshivkah-na-baze-frejmvorka-insydeh2o-pozvolyayushhie-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 InsydeH2O, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0412\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 InsydeH2O, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043a \u0441\u0432\u043e\u0435\u043c\u0443 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e (\u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f UEFI BIOS), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 23 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-uefi-proshivkah-na-baze-frejmvorka-insydeh2o-pozvolyayushhie-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-08T07:36:38+00:00","article:modified_time":"2022-02-08T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-08 07:37:23","updated":"2022-09-30 03:48:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/103243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}