{"id":107877,"date":"2023-04-16T12:48:13","date_gmt":"2023-04-16T10:48:13","guid":{"rendered":"https:\/\/prohoster.info\/?p=107877"},"modified":"2023-04-17T17:50:38","modified_gmt":"2023-04-17T15:50:38","slug":"uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","title":{"rendered":"Vulnerabilitate \u00een nucleul Linux 6.2, care permite ocolirea protec\u021biei \u00eempotriva atacurilor Spectre v2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen nucleul Linux 6.2 a fost identificat\u0103 o vulnerabilitate (CVE-2023-1998), care duce la dezactivarea protec\u021biei \u00eempotriva atacurilor de tip Spectre v2, permi\u021b\u00e2nd accesul la memoria altor procese, care ruleaz\u0103 \u00een fire diferite SMT sau Hyper Threading, dar pe un singur nucleu fizic al procesorului. Vulnerabilitatea poate fi, printre altele, utilizat\u0103 pentru a facilita scurgeri de date \u00eentre ma\u0219inile virtuale \u00een sistemele cloud. Problema afecteaz\u0103 doar nucleul Linux 6.2 \u0219i este cauzat\u0103 de o implementare incorect\u0103 a optimiz\u0103rilor, destinate s\u0103 reduc\u0103 cheltuielile semnificative asociate cu aplicarea protec\u021biei \u00eempotriva Spectre v2. Vulnerabilitatea a fost corectat\u0103 \u00een ramura experimental\u0103 a nucleului Linux 6.3. <\/p>\n

\u00cen spa\u021biul utilizatorului, pentru a se proteja \u00eempotriva atacurilor de tip Spectre, procesele pot dezactiva selectiv execu\u021bia speculativ\u0103 a instruc\u021biunilor folosind prctl PR_SET_SPECULATION_CTRL sau pot utiliza filtrarea apelurilor de sistem bazat\u0103 pe mecanismul seccomp. Potrivit cercet\u0103torilor care au descoperit problema, optimizarea incorect\u0103 din nucleul 6.2 a l\u0103sat f\u0103r\u0103 ap\u0103rare ma\u0219ini virtuale<\/a> cel pu\u021bin un mare furnizor de cloud, \u00een ciuda activ\u0103rii modului de blocare a atacurilor spectre-BTI prin prctl. Vulnerabilitatea se manifest\u0103, de asemenea, \u0219i pe ma\u0219ini obi\u015fnuite servere<\/a> cu un nucleu de 6.2, la pornirea c\u0103ruia se utilizeaz\u0103 setarea «spectre_v2=ibrs. <\/p>\n

Esenta vulnerabilit\u0103\u021bii const\u0103 \u00een faptul c\u0103, atunci c\u00e2nd se aleg modurile de protec\u021bie IBRS sau eIBRS, optimiz\u0103rile introduse dezactivau aplicarea mecanismului STIBP (Single Thread Indirect Branch Predictors), necesar pentru a bloca scurgerile \u00een aplica\u021bia tehnologiei multiprocesare simultane (SMT sau Hyper-Threading). \u00cen acest caz, protec\u021bia \u00eempotriva scurgerilor \u00eentre fire este asigurat\u0103 doar de modul eIBRS, \u0219i nu de modul IBRS, deoarece \u00een acest caz bitul IBRS, care asigur\u0103 protec\u021bia \u00eempotriva scurgerilor \u00eentre nucleele logice, este \u0219ters din motive de performan\u021b\u0103 la revenirea controlului \u00een spa\u021biul utilizatorului, ceea ce face ca firele din spa\u021biul utilizatorului s\u0103 nu fie protejate \u00eempotriva atacurilor de tip Spectre v2.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper Threading, \u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u044f\u0434\u0440\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0442\u0435\u0447\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107877","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een nucleul Linux 6.2, care permite ocolirea protec\u021biei \u00eempotriva atacurilor Spectre v2 | ProHoster","description":"\u00cen nucleul Linux 6.2 a fost identificat\u0103 o vulnerabilitate (CVE-2023-1998), care duce la dezactivarea protec\u021biei \u00eempotriva atacurilor de tip Spectre v2, permi\u021b\u00e2nd accesul la memoria altor procese, care ruleaz\u0103 \u00een fire diferite SMT sau Hyper.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux 6.2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0430\u0442\u0430\u043a Spectre v2 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-16T10:48:13+00:00","article:modified_time":"2023-04-17T15:50:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/107877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=107877"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/107877\/revisions"}],"predecessor-version":[{"id":164434,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/107877\/revisions\/164434"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=107877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=107877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=107877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}