{"id":116613,"date":"2024-06-18T12:05:50","date_gmt":"2024-06-18T10:05:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag"},"modified":"2024-06-18T12:05:50","modified_gmt":"2024-06-18T10:05:50","slug":"tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","title":{"rendered":"TikTag \u2014 atac asupra mecanismului de execu\u021bie speculativ\u0103 \u00een CPU ARM, care permite ocolirea protec\u021biei MemTag.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea din Seul \u0219i compania Samsung a dezvoltat o tehnic\u0103 de atac asupra procesorilor ARM, numit\u0103 TikTag, care poate fi utilizat\u0103 pentru a ocoli mecanismul hardware de protec\u021bie MemTag (MTE, Memory Tagging Extension) existent \u00een cipurile bazate pe arhitectura ARMv8.5-A. Atacul permite determinarea con\u021binutului etichetelor TikTag pentru adrese aleatorii de memorie, din cauza scurgerilor de date care apar \u00een urma execu\u021biei speculative a instruc\u021biunilor CPU. <\/p>\n

Tehnologia MemTag ofer\u0103 posibilitatea de a asocia etichete cu zone din memorie \u0219i de a organiza verificarea corectitudinii utiliz\u0103rii pointer-ilor pentru a preveni exploatarea vulnerabilit\u0103\u021bilor cauzate de accesarea blocurilor de memorie deja eliberate, suprascrierea buffer-ului \u0219i accesarea \u00eenainte de ini\u021bializare. C\u00e2nd se folose\u0219te MemTag, pentru fiecare 16 octe\u021bi de memorie fizic\u0103 se genereaz\u0103 o etichet\u0103 de 4 bi\u021bi, care serve\u0219te ca un fel de cheie pentru accesarea acelei memorii. Eticheta poate fi generat\u0103 de aplica\u021bie pentru zona de memorie alocat\u0103 prin instruc\u021biuni speciale ale CPU \u0219i apoi stocat\u0103 \u00een bi\u021bii superiori neutiliza\u021bi ai pointer-ului. Atunci c\u00e2nd se acceseaz\u0103 memoria utiliz\u00e2nd un pointer etichetat, procesorul verific\u0103 potrivirea etichetei asociate pointer-ului cu etichetele asociate blocurilor de memorie \u0219i permite accesul doar dac\u0103 etichetele coincid. <\/p>\n

Metoda de atac propus\u0103 permite determinarea etichetelor asociate blocurilor de memorie \u0219i ocolirea protec\u021biei MemTag. Cercet\u0103torii au demonstrat posibilitatea de a executa atacul TikTag prin exploatarea vulnerabilit\u0103\u021bilor din nucleul Linux \u0219i browserul Chrome, utiliz\u00e2nd secven\u021bele de instruc\u021biuni existente \u00een aceste produse (gadgets) care duc la execu\u021bia speculativ\u0103 a codului. Astfel de gadgets, atunci c\u00e2nd sunt executate \u00een modul de execu\u021bie speculativ al codului care lucreaz\u0103 cu pointer-e, provoac\u0103 citirea metadatelor MemTag \u00een func\u021bie de condi\u021biile externe, asupra c\u0103rora atacatorul poate influen\u021ba. Dup\u0103 determinarea unei previziuni gresite, rezultatul execu\u021biei speculative este abandonat, dar datele ob\u021binute r\u0103m\u00e2n \u00een cache \u0219i pot fi ulterior extrase prin analiza canalelor laterale. Probabilitatea reu\u0219itei \u00een ocolirea protec\u021biei MemTag \u00een testele efectuate este estimat\u0103 la 95% atunci c\u00e2nd atacul este realizat \u00eentr-un interval de aproximativ 4 secunde.<\/p>\n

\"TikTag<\/center><\/p>\n

Au fost descoperite dou\u0103 tipuri de gadgeturi care duc la scurgeri de informa\u021bii despre etichetele MemTag. \u00cen primul caz, execu\u021bia speculativ\u0103 apare dintr-o predic\u021bie gre\u0219it\u0103 a saltului, iar condi\u021biile pentru rularea gadgetului pot fi create prin manipularea apelurilor de sistem. \u00cen al doilea caz
\nExecutarea speculativ\u0103 apare din cauza unei erori \u00een prezicerea interac\u021biunii dintre opera\u021biunile de citire \u0219i scriere \u00een timpul utiliz\u0103rii optimiz\u0103rii STLF (Store-To-Load-Forwarding), care permite asocierea etichetei evalu\u00e2nd starea memoriei cache (dac\u0103 eticheta se potrive\u0219te, valoarea va fi redirec\u021bionat\u0103 direct din comanda anterioar\u0103 \u201estore\u201d \u00een opera\u021bia \u201eload\u201d, modific\u00e2nd astfel starea memoriei cache). Prima categorie de dispozitive este adaptat\u0103 pentru atacarea nucleului Linux, iar a doua pentru motorul JavaScript V8, utilizat \u00een browserele bazate pe Chromium. Prototipul setului de instrumente pentru realizarea atacului a fost publicat pe GitHub.<\/p>\n

\"TikTag\"TikTag<\/center><\/p>\n

Compania ARM a confirmat posibilitatea de a efectua un atac pe sistemele cu procesoare Cortex-X2, Cortex-X3, Cortex-A510, Cortex-A520, Cortex-A710, Cortex-A715 \u0219i Cortex-A720, dar nu inten\u021bioneaz\u0103 s\u0103 fac\u0103 modific\u0103ri la CPU pentru a bloca problema, deoarece arhitectura MemTag presupune c\u0103 etichetele nu sunt date secrete pentru aplica\u021bii. \u00cen codul surs\u0103 Chromium, problema r\u0103m\u00e2ne, de asemenea, nerezolvat\u0103, deoarece \u00een browserul Chrome protec\u021bia bazat\u0103 pe MemTag nu este aplicat\u0103 implicit. Echipa responsabil\u0103 pentru securitatea platformei Android a recunoscut posibilitatea unui atac asupra dispozitivelor Pixel 8, care utilizeaz\u0103 protec\u021bia MemTag, a ad\u0103ugat remedieri pentru a bloca scurgerile \u0219i \u0219i-a exprimat disponibilitatea de a pl\u0103ti recompense pentru vulnerabilit\u0103\u021bile g\u0103site.<\/p>\n

Ca metode de ocolire pentru a bloca atacul, cercet\u0103torii sugereaz\u0103 utilizarea instruc\u021biunilor sb sau isb pentru a interzice execu\u021bia speculativ\u0103 \u00een timpul desf\u0103\u0219ur\u0103rii opera\u021biunilor critice cu memoria sau introducerea unui umplutur\u0103 \u00eentre instruc\u021biunile de ramificare \u0219i instruc\u021biunile de acces la memorie din alte instruc\u021biuni.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0435\u0443\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Samsung \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b ARM, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TikTag, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b MemTag (MTE, Memory Tagging Extension), \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0432 \u0447\u0438\u043f\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b ARMv8.5-A. \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0442\u0435\u0433\u043e\u0432 TikTag \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u0437-\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0438\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":116614,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TikTag \u2014 un atac la mecanismul de execu\u021bie speculativ\u0103 \u00een CPU ARM, care permite ocolirea protec\u021biei MemTag | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea din Seul \u0219i compania Samsung a dezvoltat o tehnic\u0103 de atac asupra procesoarelor ARM, av\u00e2nd numele de cod TikTag, care poate fi folosit\u0103 pentru a ocoli mecanismul de protec\u021bie hardware.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47TikTag \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 CPU ARM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 MemTag | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0435\u0443\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Samsung \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b ARM, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TikTag, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/tiktag-ataka-na-mehanizm-spekulyativnogo-vypolneniya-v-cpu-arm-pozvolyayushhaya-obojti-zashhitu-memtag","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-18T10:05:50+00:00","article:modified_time":"2024-06-18T10:05:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116613","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 02:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 02:28:19","updated":"2026-01-23 02:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=116613"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116613\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/116614"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=116613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=116613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=116613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}