{"id":119185,"date":"2024-08-08T09:43:01","date_gmt":"2024-08-08T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie"},"modified":"2024-08-08T09:43:01","modified_gmt":"2024-08-08T07:43:01","slug":"uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","title":{"rendered":"Vulnerabilitatea GhostWrite, care ofer\u0103 acces complet la memoria fizic\u0103 pe CPU RISC-V XuanTie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Centrul Helmholtz pentru Securitate a Informa\u021biei (CISPA) au publicat rezultatele unei cercet\u0103ri privind securitatea procesoarelor bazate pe arhitectura RISC-V \u0219i au dezv\u0103luit informa\u021bii despre o vulnerabilitate cunoscut\u0103 sub numele de GhostWrite. Vulnerabilitatea afecteaz\u0103 procesoarele RISC-V XuanTie C910, produse de compania chinez\u0103 T-Head (o subsidiar\u0103 Alibaba) \u0219i dezvoltate ca proiecte open source. Aceast\u0103 vulnerabilitate permite unui atacator cu acces limitat \u0219i f\u0103r\u0103 privilegii s\u0103 citeasc\u0103 \u0219i s\u0103 scrie \u00een orice zon\u0103 a memoriei fizice, precum \u0219i s\u0103 ob\u021bin\u0103 acces la controlul dispozitivelor periferice, cum ar fi pl\u0103cile de re\u021bea care folosesc MMIO (Input\/Output Mapat \u00een Memorie). <\/p>\n

Vulnerabilitatea este cauzat\u0103 de deficien\u021be \u00een arhitectura procesorului, legate de izolarea instruc\u021biunilor de procesor ad\u0103ugate de produc\u0103tor, care extind arhitectura setului de instruc\u021biuni RISC-V \u0219i permit accesul direct la DRAM, ocolind mecanismele de memorie virtual\u0103. Executarea unor instruc\u021biuni extinse direct cu memoria fizic\u0103 \u00een loc de cea virtual\u0103 permite ocolirea izol\u0103rii memoriei \u00eentre procese. <\/p>\n

Tehnica preg\u0103tit\u0103 de desf\u0103\u0219urare a atacului este 100% reproducibil\u0103 \u0219i necesit\u0103 executarea codului propriu \u00een c\u00e2teva microsecunde. Metodele software de izolare, cum ar fi containerele \u0219i medii sandbox, nu \u00eempiedic\u0103 exploatarea vulnerabilit\u0103\u021bii. Pentru a bloca vulnerabilitatea, este necesar\u0103 dezactivarea complet\u0103 a suportului pentru extensiile vectoriale, ceea ce duce la o sc\u0103dere a performan\u021bei \u00een teste rvv-bench cu 33% (\u00een nota de subsol a raportului este specificat 77%, iar pe pagina de sintez\u0103 \u2014 33%, \u00een detaliile men\u021bion\u00e2ndu-se o sc\u0103dere a performan\u021bei memcpy de 33% \u0219i a memset de 8%), precum \u0219i reduce aproximativ la jum\u0103tate setul de instruc\u021biuni procesor disponibile aplica\u021biilor. <\/p>\n

Procesoarele CPU XuanTie C910 sunt printre cele mai performante cipuri RISC-V disponibile pe pia\u021b\u0103 \u0219i sunt deja utilizate activ \u00een servere<\/a> sisteme cloud \u0219i laptopuri. De exemplu, problema se manifest\u0103 \u00een servere Scaleway Elastic Metal RV1, clustere Lichee Cluster 4A, laptopuri Lichee Book 4A, console de jocuri Lichee Console 4A, computere portabile Lichee Pocket 4A, PC-uri pe o singur\u0103 plac\u0103 Sipeed Lichee Pi 4A, Milk-V Meles \u0219i BeagleV-Ahead. <\/p>\n

Ca exemplu, cercet\u0103torii au preg\u0103tit un exploit care permite unui utilizator f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 drepturi de root \u00een Linux. Exploitul modific\u0103 con\u021binutul tabelului de pagini \u00een memorie, utilizat pentru a traduce adresele virtuale \u00een adrese fizice, pentru a ob\u021bine adrese virtuale asociate cu orice adrese fizice. De asemenea, a fost preg\u0103tit un exemplu de exploit pentru a citi con\u021binutul memoriei nucleului \u0219i al altor procese, permi\u021b\u00e2nd extragerea cheilor de criptare \u0219i a parolelor stocate \u00een memorie.

De asemenea, cercet\u0103torii au identificat \u00eenc\u0103 dou\u0103 vulnerabilit\u0103\u021bi arhitecturale mai pu\u021bin periculoase \u2014 una afecteaz\u0103 procesoarele T-Head XuanTie C906, iar cealalt\u0103 T-Head XuanTie C908. Ambele vulnerabilit\u0103\u021bi sunt limitate la un apel de interzicere a serviciului din cauza opririi func\u021bion\u0103rii CPU-ului. Vulnerabilit\u0103\u021bile pot reprezenta un risc pentru platformele cloud construite pe cipuri T-Head XuanTie, deoarece, \u00een cazul \u00een care exist\u0103 acces la execu\u021bia codului \u00een medii cloud, exist\u0103 posibilitatea de a opri func\u021bionarea altor utilizatori care sunt deservi\u021bi pe acela\u0219i server<\/a>. <\/p>\n

Problemele au fost identificate cu ajutorul framework-ului RISCVuzz, creat pentru testarea fuzzing a CPU-ului. Framework-ul identific\u0103 diferen\u021bele \u00een implementarea acelora\u0219i instruc\u021biuni extinse pe diferite CPU-uri, conform presupunerii c\u0103, din cauza absen\u021bei unui registru unic pentru extensiile setului de instruc\u021biuni RISC-V, instruc\u021biunile codificate identic pe cipuri de la diferi\u021bi produc\u0103tori pot duce la executarea unor ac\u021biuni diferite. Verificarea const\u0103 \u00een compararea comportamentului \u00een procesarea instruc\u021biunilor procesorului pe diferite CPU-uri RISC-V \u0219i analiza posibilelor vulnerabilit\u0103\u021bi \u00een situa\u021biile \u00een care a fost observat un comportament divergent.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b RISC-V \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f GhostWrite. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 RISC-V-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b XuanTie C910, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 T-Head (\u043f\u043e\u0434\u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435 Alibaba) \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432 \u0444\u043e\u0440\u043c\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119185","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea GhostWrite, care ofer\u0103 acces complet la memoria fizic\u0103 pe CPU RISC-V XuanTie | ProHoster","description":"Cercet\u0103torii de la Centrul Helmholtz pentru Securitatea Informa\u021biilor (CISPA) au publicat rezultatele cercet\u0103rii privind securitatea procesoarelor bazate pe arhitectura RISC-V \u0219i au dezv\u0103luit informa\u021bii despre o vulnerabilitate, care a primit un cod.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c GhostWrite, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 CPU RISC-V XuanTie | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b RISC-V \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-08T07:43:01+00:00","article:modified_time":"2024-08-08T07:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119185","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:01:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:35:19","updated":"2026-02-09 22:01:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/119185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=119185"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/119185\/revisions"}],"predecessor-version":[{"id":164438,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/119185\/revisions\/164438"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=119185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=119185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=119185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}