{"id":114955,"date":"2024-04-09T21:31:00","date_gmt":"2024-04-09T19:31:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux"},"modified":"2024-04-09T21:31:00","modified_gmt":"2024-04-09T19:31:00","slug":"novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","title":{"rendered":"Nou\u0103 variant\u0103 de atac BHI asupra CPU-urilor Intel, care permite ocolirea protec\u021biei \u00een nucleul Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea Liber\u0103 din Amsterdam a descoperit o nou\u0103 metod\u0103 de atac numit\u0103 \u201eNative BHI\u201d (CVE-2024-2201), care permite determinarea con\u021binutului memoriei kernel-ului Linux pe sisteme cu procesoare Intel, \u00een urma execut\u0103rii unui exploit \u00een spa\u021biul utilizatorului. \u00cen cazul aplic\u0103rii atacului asupra sistemelor de virtualizare, atacatorul din sistemul gazd\u0103 poate determina con\u021binutul memoriei mediului gazd\u0103 sau al altor sisteme gazd\u0103. <\/p>\n

Metoda Native BHI propune o tehnic\u0103 diferit\u0103 de exploatare a vulnerabilit\u0103\u021bii BHI (Branch History Injection, CVE-2022-0001), care ocole\u0219te metodele de protec\u021bie implementate anterior. Metoda de atac BHI, propus\u0103 \u00een 2022, presupunea exploatarea vulnerabilit\u0103\u021bii \u00een cadrul unui nivel unic de privilegii, ceea ce implica utilizarea unui exploit bazat pe executarea unui program eBPF, \u00eenc\u0103rcat de utilizator \u00een nucleu. Pentru a bloca vulnerabilitatea, era suficient s\u0103 se limiteze accesul la executarea codului eBPF pentru utilizatorii obi\u0219nui\u021bi. <\/p>\n

Noua metod\u0103 Native BHI nu necesit\u0103 acces la eBPF \u0219i permite un atac din partea unui utilizator f\u0103r\u0103 privilegii, din spa\u021biul utilizatorului. Metoda se bazeaz\u0103 pe executarea gadget-urilor existente \u00een codul kernel-ului \u2014 secven\u021be de comenzi care conduc la executarea speculativ\u0103 a instruc\u021biunilor. Pentru a identifica gadget-urile adecvate \u00een kernel, a fost dezvoltat un instrument special numit InSpectre Gadget, care, la analiza kernel-ului 6.6-rc4, a identificat 1511 gadget-uri Spectre \u0219i 2105 gadget-uri auxiliare de dispatch.

\"Nou\u0103<\/center> <\/p>\n

Pe baza gadgetilor g\u0103si\u021bi, cercet\u0103torii au preg\u0103tit un exploit care ofer\u0103 posibilitatea de a extrage din buffer-ele nucleului un \u0219ir cu hash-ul parolei utilizatorului root, \u00eenc\u0103rcat din fi\u0219ierul \/etc\/shadow. Viteza de extragere a datelor din memoria nucleului este de aproximativ 3.5 KB pe secund\u0103.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Metoda BHI reprezint\u0103 o variant\u0103 extins\u0103 a atacului Spectre-v2, \u00een care, pentru a ocoli protec\u021bia suplimentar\u0103 (Intel eIBRS \u0219i Arm CSV2) \u0219i a organiza scurgerea de date, se folose\u0219te \u00eenlocuirea valorilor \u00eentr-un buffer cu istoria global\u0103 a ramific\u0103rilor (Branch History Buffer), utilizat \u00een CPU pentru a cre\u0219te acurate\u021bea predic\u021biei ramific\u0103rii prin luarea \u00een considerare a istoricului tranzi\u021biilor anterioare. \u00cen cadrul atacului, prin manevrarea istoriei tranzi\u021biilor, se creeaz\u0103 condi\u021bii pentru o predic\u021bie gre\u0219it\u0103 a tranzi\u021biilor \u0219i executarea speculativ\u0103 a instruc\u021biunilor necesare, ale c\u0103ror rezultate ajung \u00een cache. <\/p>\n

Diferente de atacurile Spectre-v2, este utilizarea unui buffer cu istoric de ramifica\u021bii (Branch History Buffer) \u00een locul bufferului de predic\u021bie a ramifica\u021biilor (Branch Target Buffer). Pentru a extrage date din memorie, atacatorul trebuie s\u0103 creeze condi\u021biile \u00een care, \u00een timpul execut\u0103rii unei opera\u021biuni speculative, adresa va fi luat\u0103 dintr-o zon\u0103 care trebuie definit\u0103. Dup\u0103 ce se efectueaz\u0103 o ramifica\u021bie speculativ\u0103 indirect\u0103, adresa citit\u0103 din memorie r\u0103m\u00e2ne \u00een cache, dup\u0103 care poate fi folosit\u0103 una dintre metodele de determinare a con\u021binutului cache-ului pe baza analizei modific\u0103rii timpului de acces la datele cached \u0219i necached. <\/p>\n

Atacul Native BHI nu este protejat prin aplicarea instruc\u021biunilor Intel IBT (Indirect Branch Tracking) \u0219i prin mecanismul hibrid de protec\u021bie a fluxului de execu\u021bie FineIBT, implementat \u00een nucleul Linux, care combin\u0103 utilizarea instruc\u021biunilor hardware IBT \u0219i protec\u021bia software kCFI (kernel Control Flow Integrity) pentru a bloca \u00eenc\u0103lcarea ordinii normale de execu\u021bie (control flow). FineIBT permite executarea prin ramifica\u021bie indirect\u0103 doar \u00een cazul unei tranzi\u021bii c\u0103tre instruc\u021biunea ENDBR, care este plasat\u0103 la \u00eenceputul func\u021biei. \u00cen plus (analog cu mecanismul kCFI), se efectueaz\u0103 o verificare a hash-urilor, care garanteaz\u0103 imutabilitatea pointerilor. <\/p>\n

Pentru a proteja de noul tip de atac, \u00een nucleul Linux a fost ad\u0103ugat un modificat care implementeaz\u0103 un mod suplimentar de protec\u021bie, folosind echipamentele de protec\u021bie hardware propuse de Intel (BHI_DIS_S) sau o alternativ\u0103 de protec\u021bie software, implementat\u0103 pentru a proteja hypervisor-ul. KVM<\/a>. Dezvoltatorii hypervisor-ului Xen au lansat de asemenea o corec\u021bie bazat\u0103 pe utilizarea modului BHI_DIS_S, care limiteaz\u0103 predic\u021biile bazate pe istoria ramifica\u021biilor. Suportul pentru BHI_DIS_S este disponibil \u00een procesoarele \u00eencep\u00e2nd cu Intel Alder Lake, precum \u0219i \u00een CPU-urile servere \u00eencep\u00e2nd cu Intel Sapphire Rapids. Este disponibil \u0219i un mod software de protec\u021bie, bazat pe utilizarea secven\u021belor pentru cur\u0103\u021barea bufferului de istoric al ramifica\u021biilor, dar acesta duce la o sc\u0103dere mai semnificativ\u0103 a performan\u021bei.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 «Native BHI» (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0438\u0437 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u043e\u0436\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0433\u043e\u0441\u0442\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041c\u0435\u0442\u043e\u0434 Native BHI \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u043d\u0443\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114956,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Noua variant\u0103 de atac BHI pe CPU Intel, care permite ocolirea protec\u021biei \u00een nucleul Linux | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea Liber\u0103 din Amsterdam a identificat o nou\u0103 metod\u0103 de atac \"Native BHI\" (CVE-2024-2201), care permite pe sistemele cu procesoare Intel s\u0103 determine con\u021binutul memoriei nucleului Linux.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 BHI \u043d\u0430 CPU Intel, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 "Native BHI" (CVE-2024-2201), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 Intel \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 Linux \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/novyj-variant-ataki-bhi-na-cpu-intel-pozvolyayushhij-obojti-zashhitu-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-09T19:31:00+00:00","article:modified_time":"2024-04-09T19:31:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114955","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 21:54:46","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:54:46","updated":"2026-01-22 21:54:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114955"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114955\/revisions"}],"predecessor-version":[{"id":164266,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114955\/revisions\/164266"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/114956"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}