{"id":108554,"date":"2023-05-17T00:48:11","date_gmt":"2023-05-16T22:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=108554"},"modified":"2023-05-17T10:40:17","modified_gmt":"2023-05-17T08:40:17","slug":"ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","title":{"rendered":"Atacul PMFault, care poate provoca avarii CPU pe anumite sisteme server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Universitatea din Birmingham, anterior cunoscu\u021bi pentru dezvoltarea atacurilor Plundervolt \u0219i VoltPillager, au descoperit o vulnerabilitate (CVE-2022-43309) \u00een unele pl\u0103ci de baz\u0103 server, care permite distrugerea fizic\u0103 a CPU-ului f\u0103r\u0103 posibilitatea de recuperare ulterioar\u0103. Vulnerabilitatea, care a primit numele de cod PMFault, poate fi folosit\u0103 pentru a deteriora servere la care atacatorul nu are acces fizic, dar are acces privilegiat la sistemul de operare, ob\u021binut, de exemplu, prin exploatarea unei vulnerabilit\u0103\u021bi neremediate sau prin interceptarea acreditivelor de administrator. <\/p>\n

Esenta metodei propuse const\u0103 \u00een utilizarea interfe\u021bei PMBus, care utilizeaz\u0103 protocolul I2C, pentru a cre\u0219te tensiunea aplicat\u0103 pe procesor la valori care provoac\u0103 deteriorarea chip-ului. Interfa\u021ba PMBus este de obicei implementat\u0103 \u00een modulul VRM (Voltage Regulator Module), la care se poate accesa prin manipularea controlerului BMC. Pentru a efectua un atac pe pl\u0103ci care suport\u0103 PMBus, pe l\u00e2ng\u0103 privilegii de administrator \u00een sistemul de operare, este necesar un acces software la BMC (Baseboard Management Controller), de exemplu, prin interfa\u021ba IPMI KCS (Keyboard Controller Style), prin Ethernet sau prin re\u00eenc\u0103rcarea BMC din sistemul actual. <\/p>\n

Existenta problemei care permite efectuarea unui atac f\u0103r\u0103 cunoa\u0219terea parametrilor de autentificare \u00een BMC este confirmat\u0103 \u00een pl\u0103cile de baz\u0103 Supermicro cu suport pentru IPMI (X11, X12, H11 \u0219i H12) \u0219i ASRock, dar vulnerabilit\u0103\u021bile sunt \u0219i \u00een alte pl\u0103ci server, la care se poate ob\u021bine acces la PMBus. \u00cen cadrul experimentelor efectuate, la cre\u0219terea tensiunii la 2.84 vol\u021bi, dou\u0103 procesoare Intel Xeon au fost deteriorate pe aceste pl\u0103ci. Pentru a accesa BMC f\u0103r\u0103 cunoa\u0219terea parametrilor de autentificare, dar av\u00e2nd acces root la sistemul de operare, a fost utilizat\u0103 o vulnerabilitate \u00een mecanismul de verificare a firmware-ului, care a permis \u00eenc\u0103rcarea unei actualiz\u0103ri modificate \u00een controlerul BMC, precum \u0219i posibilitatea accesului neautentificat prin IPMI KCS. <\/p>\n

Metoda de modificare a tensiunii prin PMBus poate fi folosit\u0103 \u0219i pentru a lansa un atac Plundervolt, care permite, prin sc\u0103derea tensiunii la valori minime, s\u0103 cauzeze deteriorarea con\u021binutului celulelor de date din CPU, utilizate \u00een calcule \u00een enclavele izolate Intel SGX, gener\u00e2nd erori \u00een algoritmi ini\u021bial corec\u021bi. De exemplu, dac\u0103 se ob\u021bine modificarea valorii utilizate \u00een \u00eenmul\u021birea din procesul de criptare, rezultatul va fi un text criptat incorect. Av\u00e2nd capacitatea de a accesa procesorul din SGX pentru a-\u0219i cripta datele, atacatorul poate, provoc\u00e2nd erori, acumula statistici despre modific\u0103rile textului criptat \u0219i recupera valoarea cheii stocate \u00een enclavele SGX. <\/p>\n

Uneltele pentru atacul asupra placilor Supermicro \u0219i ASRock, precum \u0219i utilitarul pentru verificarea accesului la PMBus, sunt publicate pe GitHub.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PMFault, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0435\u0442 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacul PMFault, care permite defectarea CPU-ului \u00een unele sisteme server | ProHoster","description":"Cercet\u0103torii de la Universitatea din Birmingham, anterior cunoscu\u021bi pentru dezvoltarea atacurilor Plundervolt \u0219i VoltPillager, au descoperit o vulnerabilitate (CVE-2022-43309) \u00een unele pl\u0103ci de baz\u0103 server care permite extragerea fizic\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 PMFault, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-05-16T22:48:11+00:00","article:modified_time":"2023-05-17T08:40:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/108554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=108554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/108554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=108554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=108554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=108554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}