{"id":111523,"date":"2023-11-15T15:10:13","date_gmt":"2023-11-15T13:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization"},"modified":"2023-11-15T15:10:13","modified_gmt":"2023-11-15T13:10:13","slug":"uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","title":{"rendered":"Vulnerabilitate \u00een CPU AMD care permite ocolirea mecanismului de protec\u021bie SEV (Virtualizare Securizat\u0103 Criptat\u0103)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Centrul Helmholtz pentru Securitatea Informa\u021biei (CISPA) au publicat o nou\u0103 metod\u0103 de atac numit\u0103 CacheWarp, care permite compromiterea mecanismului de protec\u021bie AMD SEV (Secure Encrypted Virtualization), utilizat \u00een sistemele de virtualizare pentru a proteja ma\u0219inile virtuale \u00eempotriva interven\u021biei din partea hipervizorului sau a administratorului sistemului gazd\u0103. Metoda propus\u0103 permite unui atacator, care are acces la hipervizor, s\u0103 execute cod str\u0103in \u0219i s\u0103 ob\u021bin\u0103 privilegii crescute \u00eentr-o ma\u0219in\u0103 virtual\u0103 protejat\u0103 prin AMD SEV. <\/p>\n

Atacul se bazeaz\u0103 pe exploatarea unei vulnerabilit\u0103\u021bi (CVE-2023-20592), cauzat\u0103 de o manipulare incorect\u0103 a cache-ului \u00een timpul execu\u021biei instruc\u021biunii procesorului INVD, prin care se poate ob\u021bine necorelarea datelor \u00een memorie \u0219i cache, ocolind mecanismele de men\u021binere a integrit\u0103\u021bii memoriei pentru ma\u0219inile virtuale, implementate pe baza extensiilor SEV-ES \u0219i SEV-SNP. Vulnerabilitatea afecteaz\u0103 procesoarele AMD EPYC de la prima p\u00e2n\u0103 la a treia genera\u021bie. <\/p>\n

Pentru procesoarele AMD EPYC de a treia genera\u021bie (Zen 3), problema a fost rezolvat\u0103 \u00een actualizarea de microcod din noiembrie, lansat\u0103 ieri de AMD (corec\u021bia nu duce la sc\u0103derea performan\u021bei). Pentru prima \u0219i a doua genera\u021bie de procesoare AMD EPYC (Zen 1 \u0219i Zen 2), nu exist\u0103 protec\u021bie, deoarece aceste CPU nu suport\u0103 extensia SEV-SNP, care asigur\u0103 controlul integrit\u0103\u021bii. ma\u0219ini virtuale<\/a>A patra genera\u021bie de procesoare AMD AMD EPYC \u201eGenoa\u201d bazate pe microarhitectura \u201eZen 4\u201d nu este vulnerabil\u0103. <\/p>\n

Tehnologia AMD SEV este utilizat\u0103 pentru izolarea ma\u0219inilor virtuale de c\u0103tre furnizori de cloud precum Amazon Web Services (AWS), Google Cloud, Microsoft Azure \u0219i Oracle Compute Infrastructure (OCI). Protec\u021bia AMD SEV este realizat\u0103 prin criptarea la nivel de hardware a memoriei ma\u0219inilor virtuale. \u00cen plus, prin intermediul extensiei SEV-ES (Encrypted State), se protejeaz\u0103 registrele CPU. Accesul la datele decriptate este permis doar sistemului gazd\u0103 curent, iar celelalte ma\u0219ini virtuale<\/a> \u0219i hipervizorul, \u00een cazul \u00een care \u00eencearc\u0103 s\u0103 acceseze aceast\u0103 memorie, primesc un set de date criptat. <\/p>\n

\u00cen a treia genera\u021bie a procesorului AMD EPYC a fost implementat un extensie suplimentar\u0103 SEV-SNP (Secure Nested Paging), care asigur\u0103 func\u021bionarea sigur\u0103 cu tabelele de pagini de memorie \u00eennodat. Pe l\u00e2ng\u0103 criptarea general\u0103 a memoriei \u0219i izolarea registrelor, SEV-SNP include mijloace suplimentare pentru protejarea integrit\u0103\u021bii memoriei, care \u00eempiedic\u0103 modific\u0103rile \u00een VM din partea hypervisor-ului. Managementul cheilor de criptare se face de partea procesorului PSP (Platform Security Processor) \u00eencorporat \u00een cip, realizat pe baza arhitecturii ARM. <\/p>\n

Esenta metodei de atac propuse const\u0103 \u00een utilizarea instruc\u021biunii INVD pentru a anula blocurile (liniile) din cache-ul paginilor modificate (dirty) f\u0103r\u0103 a rescrie datele acumulate \u00een cache \u00een memorie (write-back). Astfel, metoda permite eliminarea datelor modificate din cache f\u0103r\u0103 a schimba starea memoriei. Pentru a efectua atacul, se propune utilizarea excep\u021biilor software (fault injection) pentru a \u00eentrerupe func\u021bionarea ma\u0219inii virtuale \u00een dou\u0103 locuri: mai \u00eent\u00e2i, atacatorul apeleaz\u0103 instruc\u021biunea \u201ewbnoinvd\u201d pentru a rescrie toate opera\u021biile de scriere acumulate \u00een cache \u00een memorie, iar apoi invoc\u0103 instruc\u021biunea \u201einvd\u201d pentru a readuce opera\u021biile de scriere care nu au fost reflectate \u00een memorie la o stare anterioar\u0103. <\/p>\n

Pentru a-\u0219i verifica sistemele de vulnerabilitate, a fost publicat un prototip de exploit care permite executarea unei substitu\u021bii de excep\u021bie \u00een ma\u0219ina virtual\u0103 protejat\u0103 prin AMD SEV \u0219i revenirea la starea veche a modific\u0103rilor ne\u00eenregistrate \u00een memorie \u00een VM. Revenirea modific\u0103rii poate fi utilizat\u0103 pentru a schimba fluxul de execu\u021bie al programului prin \u00eentoarcerea la vechea adres\u0103 de \u00eentoarcere \u00een stiv\u0103 sau pentru a fi utilizat\u0103 la introducerea parametrilor dintr-o sesiune anterioar\u0103, pentru care a fost realizat\u0103 anterior autentificarea, prin returnarea valorii semnului de autenticitate. <\/p>\n

De exemplu, cercet\u0103torii au demonstrat posibilitatea aplic\u0103rii metodei CacheWarp pentru a efectua un atac Bellcore asupra implement\u0103rii algoritmului RSA-CRT \u00een biblioteca ipp-crypto, ceea ce a permis recuperarea cheii private prin substituirea erorilor \u00een timpul calculului semn\u0103turii digitale. De asemenea, s-a ar\u0103tat cum pot fi schimbate parametrii de verificare a sesiunii la OpenSSH \u00een timpul unei conexiuni la distan\u021b\u0103 la sistemul gazd\u0103, iar apoi se poate modifica starea de verificare \u00een timpul execu\u021biei utilitarului sudo pentru a ob\u021bine drepturi root \u00een Ubuntu 20.04. Func\u021bionarea exploit-ului a fost verificat\u0103 pe sisteme cu procesoare AMD EPYC 7252, 7313P \u0219i 7443.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 CacheWarp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u043e\u0442 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0443, \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111523","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een CPU AMD, care permite ocolirea mecanismului de protec\u021bie SEV (Secure Encrypted Virtualization) | ProHoster","description":"Cercet\u0103torii de la Centrul Helmholtz pentru Securitate Informa\u021bional\u0103 (CISPA) au publicat o nou\u0103 metod\u0103 de atac CacheWarp, care permite compromiterea mecanismului de protec\u021bie AMD SEV (Secure Encrypted Virtualization), utilizat \u00een.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b SEV (Secure Encrypted Virtualization) | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 CacheWarp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0449\u0438\u0442\u044b AMD SEV (Secure Encrypted Virtualization), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cpu-amd-pozvolyayushhaya-obojti-mehanizm-zashhity-sev-secure-encrypted-virtualization","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-15T13:10:13+00:00","article:modified_time":"2023-11-15T13:10:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111523","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:24","updated":"2026-02-09 17:11:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=111523"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111523\/revisions"}],"predecessor-version":[{"id":164098,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111523\/revisions\/164098"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=111523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=111523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=111523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}