{"id":107141,"date":"2023-03-07T12:48:16","date_gmt":"2023-03-07T10:48:16","guid":{"rendered":"https:\/\/prohoster.info\/?p=107141"},"modified":"2023-03-10T11:57:09","modified_gmt":"2023-03-10T09:57:09","slug":"uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","title":{"rendered":"Vulnerabilit\u0103\u021bile din implementarea de referin\u021b\u0103 TPM 2.0 care permit accesul la date \u00een cipul criptografic","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen codul de referin\u021b\u0103 al specifica\u021biei TPM 2.0 (Trusted Platform Module) au fost identificate vulnerabilit\u0103\u021bi (CVE-2023-1017, CVE-2023-1018) care permit scrierea sau citirea datelor dincolo de bufferul alocat. O atac\u0103 asupra implement\u0103rilor procesorilor criptografici care utilizeaz\u0103 codul vulnerabil poate duce la extragerea sau rescrierea informa\u021biilor stocate pe cip, cum ar fi cheile criptografice. Posibilitatea de a rescrie datele \u00een firmware-ul TPM poate fi utilizat\u0103 de atacatori pentru a organiza execu\u021bia propriului cod \u00een contextul TPM, ceea ce poate fi, de exemplu, utilizat pentru a implementa backdoor-uri care func\u021bioneaz\u0103 pe partea TPM \u0219i nu pot fi detectate din sistemul de operare. <\/p>\n

Vulnerabilit\u0103\u021bile sunt cauzate de verificarea incorect\u0103 a dimensiunii parametrilor func\u021biei CryptParameterDecryption(), care permite scrierea sau citirea a dou\u0103 octe\u021bi dincolo de bufferul transmis \u00een func\u021bia ExecuteCommand() \u0219i care con\u021bine comanda TPM 2.0. \u00cen func\u021bie de implementarea firmware-ului, cei doi octe\u021bi rescria\u021bi pot deteriora fie memoria neutilizat\u0103, fie datele sau indicatorii din stiv\u0103. <\/p>\n

Exploatarea vulnerabilit\u0103\u021bii se realizeaz\u0103 prin trimiterea de comenzi special formate modulului TPM (atacatorul trebuie s\u0103 aib\u0103 acces la interfa\u021ba TPM). Problemele au fost remediate \u00een actualizarea specifica\u021biei TPM 2.0 lansat\u0103 \u00een ianuarie (1.59 Errata 1.4, 1.38 Errata 1.13, 1.16 Errata 1.6). <\/p>\n

Vulnerabilitatea afecteaz\u0103, de asemenea, biblioteca deschis\u0103 libtpms, utilizat\u0103 pentru emularea software a modulelor TPM \u0219i pentru integrarea suportului TPM \u00een hypervisoare. Vulnerabilitatea a fost remediat\u0103 \u00een versiunea libtpms 0.9.6.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 TPM 2.0 (Trusted Platform Module) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-1017, CVE-2023-1018), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0438\u043b\u0438 \u0447\u0442\u0435\u043d\u0438\u044e \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0435\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043a\u043e\u0434, \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044e \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0442\u0430\u043a\u043e\u0439 \u043a\u0430\u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 TPM \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107141","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u0103\u021bi \u00een implementarea de referin\u021b\u0103 a TPM 2.0, care permit accesul la datele din cipul criptografic | ProHoster","description":"\u00cen codul de referin\u021b\u0103 al specifica\u021biei TPM 2.0 (Trusted Platform Module) au fost identificate vulnerabilit\u0103\u021bi (CVE-2023-1017, CVE-2023-1018) care permit scrierea sau citirea datelor dincolo de bufferul alocat.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 TPM 2.0, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0447\u0438\u043f\u0435 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 TPM 2.0 (Trusted Platform Module) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-1017, CVE-2023-1018), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0438\u043b\u0438 \u0447\u0442\u0435\u043d\u0438\u044e \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0435\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-07T10:48:16+00:00","article:modified_time":"2023-03-10T09:57:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/107141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=107141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/107141\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=107141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=107141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=107141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}