{"id":112031,"date":"2023-12-06T21:10:26","date_gmt":"2023-12-06T19:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati"},"modified":"2023-12-06T21:10:26","modified_gmt":"2023-12-06T19:10:26","slug":"slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","title":{"rendered":"SLAM \u2014 atac asupra CPU-urilor Intel, AMD \u0219i ARM care permite determinarea con\u021binutului memoriei","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea Liber\u0103 din Amsterdam a prezentat o nou\u0103 tehnic\u0103 de atac SLAM (Spectre Linear Address Masking), care ofer\u0103 un mod inovator de a exploata vulnerabilit\u0103\u021bile microarhitecturale din clasa Spectre, \u00een care scurgerile de date apar \u00een timpul traducerii adreselor necanonice, iar pentru a ocoli verific\u0103rile canonice se folosesc extensiile de masc\u0103 a adreselor liniare furnizate de noile procesoare. Cercet\u0103torii au publicat un instrumentar cu implementarea metodei \u0219i au propus o demonstra\u021bie, care arat\u0103 cum se pot extrage date din memoria nucleului corespunz\u0103toare unei anumite m\u0103\u0219ti (ilustrat cum \u00een c\u00e2teva zeci de secunde \u00een Ubuntu se extrage o linie cu hash-ul parolei utilizatorului root din memoria nucleului).

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Atacul poate fi realizat pe sisteme cu procesoare Intel care suport\u0103 extensia LAM (Linear Address Masking), procesoare AMD cu extensia UAI (Upper Address Ignore) \u0219i procesoare ARM cu extensia TBI (Top Byte Ignore). Aceste extensii permit utilizarea unei p\u0103r\u021bi din bi\u021bii pointerilor pe 64 de bi\u021bi pentru stocarea de metadate nespecificate pentru adresare (pentru programele obi\u0219nuite nu este nevoie de at\u00e2ta memorie c\u00e2t s\u0103 poat\u0103 utiliza pointeri pe 64 de bi\u021bi, astfel c\u0103 bi\u021bii superiori pot fi folosi\u021bi, de exemplu, pentru verific\u0103ri legate de securitate). Interesant este c\u0103 procesoarele Intel, AMD \u0219i ARM care suport\u0103 LAM, UAI \u0219i TBI sunt \u00eenc\u0103 doar anun\u021bate, dar nu sunt fabricate pe scar\u0103 larg\u0103, ceea ce face ca SLAM s\u0103 fie prima atac spekulativ asupra viitoarelor CPU-uri. Atacul poate fi realizat, de asemenea, \u0219i pe CPU-urile mai vechi AMD Zen+ \u0219i Zen 2, afectate de vulnerabilitatea CVE-2020-12965. <\/p>\n

Analog cu exploatarea vulnerabilit\u0103\u021bilor Spectre, atacul SLAM necesit\u0103 \u00een kernel anumite secven\u021be de instruc\u021biuni (gadgets) care conduc la execu\u021bia speculativ\u0103 a instruc\u021biunilor. Aceste instruc\u021biuni conduc la citirea speculativ\u0103 a datelor din memorie, \u00een func\u021bie de condi\u021biile externe asupra c\u0103rora atacatorul poate influen\u021ba. Dup\u0103 determinarea unei prognoze gre\u0219ite, rezultatul execu\u021biei speculative este respins, dar datele procesate r\u0103m\u00e2n \u00een cache \u0219i pot fi apoi extrase prin analiza canalelor externe. Pentru a extrage datele acumulate \u00een cache, cercet\u0103torii au utilizat metoda Evict+Reload, bazat\u0103 pe crearea de condi\u021bii pentru eliminarea datelor din cache (de exemplu, se creeaz\u0103 o activitate care umple uniform cache-ul cu con\u021binut standard) \u0219i executarea de opera\u021bii a c\u0103ror durat\u0103 permite judecarea existen\u021bei datelor \u00een cache-ul procesorului. <\/p>\n

Pentru a efectua un atac SLAM, se utilizeaz\u0103 gadgeturi bazate pe cod \u00een care datele controlate de atacator (mai jos variabila \u201esecret\u201d) sunt folosite ca indicator. De exemplu: void unmasked_gadget(long **secret) { **secret; } <\/p>\n

Se remarc\u0103 faptul c\u0103 astfel de \u0219abloane de cod sunt frecvent utilizate \u00een programe, de exemplu, \u00een kernel-ul Linux au fost identificate zeci de mii de astfel de gadgets, dintre care cel pu\u021bin c\u00e2teva sute sunt adecvate pentru utilizare \u00een exploa\u021bii. Scurgerea poate fi blocat\u0103 prin ad\u0103ugarea de instruc\u021biuni suplimentare \u00een astfel de gadgets, care blocheaz\u0103 execu\u021bia speculativ\u0103. Compania Intel inten\u021bioneaz\u0103 s\u0103 ofere o metod\u0103 software pentru blocarea scurgerii \u00eenainte de livrarea procesorului cu suport pentru LAM. Compania AMD a recomandat utilizarea metodele existente pentru blocarea atacurilor de tip Spectre v2. Dezvoltatorii kernel-ului Linux, pentru a se proteja \u00eempotriva atacului, au decis s\u0103 dezactiveze implicit suportul pentru LAM p\u00e2n\u0103 la publicarea recomand\u0103rilor Intel pentru blocarea vulnerabilit\u0103\u021bii.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u043d\u0435\u043a\u0430\u043d\u043e\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u043a\u0430\u043d\u043e\u043d\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0432 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043b\u0438\u043d\u0435\u0439\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0442\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112031","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SLAM \u2014 atac asupra CPU Intel, AMD \u0219i ARM, care permite determinarea con\u021binutului memoriei | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea Liber\u0103 din Amsterdam a prezentat o nou\u0103 tehnic\u0103 de atac SLAM (Spectre Linear Address Masking), care ofer\u0103 o nou\u0103 modalitate de exploatare a vulnerabilit\u0103\u021bilor microarhitecturale.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SLAM \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 CPU Intel, AMD \u0438 ARM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 SLAM (Spectre Linear Address Masking), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/slam-ataka-na-cpu-intel-amd-i-arm-pozvolyayushhaya-opredelit-soderzhimoe-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-06T19:10:26+00:00","article:modified_time":"2023-12-06T19:10:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=112031"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112031\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=112031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=112031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=112031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}