{"id":105506,"date":"2022-11-09T03:36:39","date_gmt":"2022-11-09T01:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm"},"modified":"2022-11-09T03:36:39","modified_gmt":"2022-11-09T01:36:39","slug":"uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","title":{"rendered":"O vulnerabilitate \u00een firmware-urile UEFI permite executarea de cod \u00een modul SMM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Informa\u021biile despre vulnerabilitatea (CVE-2021-33164) din firmware-urile UEFI au fost dezv\u0103luite, permi\u021b\u00e2nd executarea codului la nivel SMM (System Management Mode), mai prioritar dec\u00e2t modul hipervizor \u0219i cercul de protec\u021bie zero, oferind acces nelimitat la \u00eentreaga memorie a sistemului. Vulnerabilitatea, cunoscut\u0103 sub numele de RingHopper, este legat\u0103 de posibilitatea efectu\u0103rii unui atac temporar folosind DMA (Direct Memory Access) pentru a deteriora memoria \u00een codul executat la nivel SMM. Prezen\u021ba vulnerabilit\u0103\u021bii a fost confirmat\u0103 \u00een firmware-urile Intel, Dell \u0219i Insyde Software (se afirm\u0103 c\u0103 problema afecteaz\u0103 8 produc\u0103tori, dar ceilal\u021bi 5 nu sunt dezv\u0103lui\u021bi deocamdat\u0103). Firmware-urile AMD, Phoenix \u0219i Toshiba nu sunt afectate de problem\u0103. <\/p>\n

Exploatarea vulnerabilit\u0103\u021bilor poate fi realizat\u0103 din sistemul de operare, utiliz\u00e2nd gestionarii SMI (System Management Interrupt) vulnerabili, pentru a accesa care necesit\u0103 drepturi de administrator. Atacul poate fi, de asemenea, efectuat \u00een cazul \u00een care exist\u0103 acces fizic \u00eentr-o etap\u0103 timpurie a boot-ului, \u00eenainte de ini\u021bializarea sistemului de operare. Pentru a preveni problema, utilizatorilor Linux li se recomand\u0103 s\u0103 actualizeze firmware-ul folosind serviciul LVFS (Linux Vendor Firmware Service), utiliz\u00e2nd utilitarul fwupdmgr (fwupdmgr get-updates; fwupdmgr update) din pachetul fwupd. <\/p>\n

Necesitatea de a avea drepturi de administrator pentru a efectua atacul limiteaz\u0103 pericolul problemei, dar nu \u00eempiedic\u0103 utilizarea acesteia ca vulnerabilitate de al doilea nivel, pentru a-\u0219i men\u021bine prezen\u021ba dup\u0103 exploatarea altor vulnerabilit\u0103\u021bi din sistem sau aplicarea metodelor de inginerie social\u0103. Accesul la SMM (Ring -2) permite executarea codului la un nivel care nu este controlat de sistemul de operare, ceea ce poate fi folosit pentru a modifica firmware-urile \u0219i a insera cod mali\u021bios ascuns sau rootkits \u00een SPI Flash, care nu sunt detectabile din sistemul de operare, precum \u0219i pentru a dezactiva verificarea \u00een timpul boot-ului (UEFI Secure Boot, Intel BootGuard) \u0219i atacuri asupra hipervizoarelor pentru ocolirea mecanismelor de verificare a integrit\u0103\u021bii mediilor virtuale. <\/p>\n

Problema este cauzat\u0103 de o stare de competi\u021bie \u00een handlerul SMI (System Management Interrupt), care apare \u00een momentul dintre verificarea accesului \u0219i interac\u021biunea cu SMRAM. Pentru a determina momentul corect \u00eentre verificarea st\u0103rii \u0219i utilizarea rezultatului verifica\u021biei, se poate folosi analiza prin canale externe cu ajutorul DMA. Drept urmare, din cauza caracterului asincron al accesului la SMRAM prin DMA, atacatorul poate determina momentul potrivit \u0219i poate suprascrie con\u021binutul SMRAM, folosind DMA pentru a oh ocoli API-ul handlerului SMI. Procesoarele care suport\u0103 mecanismele Intel-VT \u0219i Intel VT-d includ protec\u021bie \u00eempotriva atacurilor DMA, bazat\u0103 pe utilizarea IOMMU (Input-Output Memory Management Unit), dar aceast\u0103 protec\u021bie este eficient\u0103 pentru blocarea atacurilor hardware DMA efectuate cu dispozitive preg\u0103tite de atacator \u0219i nu protejeaz\u0103 \u00eempotriva atacurilor prin intermediul handlerelor SMI.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105506","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een firmware-urile UEFI, care permite executarea de cod la nivel SMM | ProHoster","description":"A fost divulgat\u0103 informa\u021bia despre vulnerabilitatea (CVE-2021-33164) \u00een firmware-urile UEFI, care permite executarea de cod la nivel SMM (System Management Mode), mai prioritar dec\u00e2t modul hipervizor \u0219i nivelul zero de protec\u021bie, \u0219i.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-09T01:36:39+00:00","article:modified_time":"2022-11-09T01:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=105506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=105506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=105506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=105506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}