{"id":120977,"date":"2024-12-13T21:46:00","date_gmt":"2024-12-13T19:46:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd"},"modified":"2024-12-13T21:46:00","modified_gmt":"2024-12-13T19:46:02","slug":"ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","title":{"rendered":"Atacul BadRAM, care permite ocolirea mecanismului de certificare SEV-SNP \u00een CPU AMD.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universit\u0103\u021bile Leuven, L\u00fcbeck \u0219i Birmingham a dezvoltat o metod\u0103 de atac BadRAM (CVE-2024-21944), care permite ocolirea mecanismului de autentificare \u0219i compromiterea mediiurilor protejate prin utilizarea extensiei SEV-SNP \u00een procesoarele AMD. Pentru a efectua atacul, atacatorul, cu rare excep\u021bii, trebuie s\u0103 ob\u021bin\u0103 acces fizic la modulele de memorie, precum \u0219i s\u0103 aib\u0103 capacitatea de a executa cod la nivelul inelului 0 (ring0) pe serverul care ruleaz\u0103 medii virtuale protejate. <\/p>\n

Extensiile AMD SEV (Secure Encrypted Virtualization) sunt concepute pentru a oferi garan\u021bii de integritate a memoriei ma\u0219inilor virtuale, precum \u0219i pentru a le proteja de interven\u021bia \u0219i analiza din partea administratorului sistemului gazd\u0103 capabil s\u0103 execute cod la nivelul hipervizorului. Ini\u021bial, protec\u021bia AMD SEV se limita la criptarea con\u021binutului memoriei sistemului gazd\u0103 \u0219i la izolarea registrelor, dar ulterior, \u00een procesoarele AMD EPYC a fost implementat\u0103 extensia SEV-SNP (Secure Nested Paging) pentru o func\u021bionare sigur\u0103 cu tabelele de pagini imbricate, garant\u00e2nd integritatea memoriei \u0219i \u00eempiedic\u00e2nd modificarea memoriei sistemului gazd\u0103 din partea hipervizorului. <\/p>\n

Mecanismul AMD SEV-SNP a fost creat pentru a \u00eempiedica agen\u021biile de securitate sau personalul din centrele de date \u0219i furnizorii de cloud, \u00een care ruleaz\u0103 sistemele gazd\u0103 protejate, s\u0103 se interpun\u0103 \u00een func\u021bionarea sistemului gazd\u0103. Metoda de atac BadRAM propus\u0103 permite ocolirea garan\u021biilor furnizate prin modificarea metadatelor SPD (Serial Presence Detect) \u00een modulele de memorie DDR4 sau DDR5. Dac\u0103 atacul reu\u0219e\u0219te, atacatorul poate rescrie datele criptate din memoria sistemului gazd\u0103 (la nivel de text criptat, f\u0103r\u0103 posibilitate de decriptare) \u0219i ocoli mecanismul de atestare, de exemplu, pentru a ascunde implantarea unui backdoor \u00eentr-o ma\u0219in\u0103 virtual\u0103 protejat\u0103 prin tehnologia SEV-SNP. <\/p>\n

Atacul se bazeaz\u0103 pe prezentarea de parametri fictivi \u00een SPD-ul modulului de memorie, determin\u00e2nd procesorul s\u0103 acceseze adrese inexistente, reflectate \u00een zonele de memorie existente. Atacatorul poate ajusta SPD-ul astfel \u00eenc\u00e2t modulul de memorie s\u0103 returneze procesorului o dimensiune care dep\u0103\u0219e\u0219te specifica\u021biile reale ale modulului. Dup\u0103 aceea, atacatorul poate realiza o mapare a memoriei fictive inexistente pe o zon\u0103 real\u0103 din DRAM, care este deja utilizat\u0103 \u00een mod criptat \u00een sistemele virtualizate protejate. Ca urmare, apare situa\u021bia \u00een care adrese diferite indic\u0103 aceea\u0219i memorie fizic\u0103 (dou\u0103 zone reflectate pe o zon\u0103 din cipul DRAM), adic\u0103 se poate accesa memoria real\u0103 deja utilizat\u0103 pe adresa zonei fictive reflectate, ocolind astfel mecanismele de protec\u021bie a memoriei din CPU.

\"Atacul<\/center> <\/p>\n

Pentru a efectua atacul, este suficient s\u0103 se asambleze un programator simplu, cu un cost de aproximativ 10 dolari, const\u00e2nd dintr-un microcontroler Raspberry Pi Pico, un conector pentru modulele DDR4\/DD5 \u0219i o surs\u0103 de alimentare. Utilitary folosite pentru realizarea atacului, modulul kernel \u0219i prototipurile exploit-urilor sunt disponibile pe GitHub.

\"Atacul<\/center> <\/p>\n

Pentru cipurile unor produc\u0103tori, \u00een care nu a fost implementat\u0103 blocarea rescrierii SPD, atacul poate fi realizat prin metode software, f\u0103r\u0103 acces fizic la server. De exemplu, parametrii modulelor de memorie de la Corsair cu iluminare RGB pot fi modifica\u021bi programatic. \u00cen cazul unui atac complet software, sistemul poate fi compromis, de exemplu, prin utilizarea unei actualiz\u0103ri BIOS mali\u021bioase sau prin o diversie din partea administratorilor. servere<\/a> \u00een serviciile de cloud.

\"Atacul<\/center> <\/p>\n

\u00cen calitate de confirmare a func\u021bion\u0103rii metodei, sunt demonstrate dou\u0103 atacuri. \u00cen primul atac, se arat\u0103 posibilitatea reproducerii textului criptat \u2014 utiliz\u00e2nd AMD SEV, datele din memorie sunt stocate \u00eentr-o form\u0103 criptat\u0103, iar atacatorul nu poate determina con\u021binutul, dar are capacitatea de a citi datele criptate \u0219i apoi le poate \u00eenlocui cu alte date criptate. <\/p>\n

\u00cen a doua atac\u0103, s-a demonstrat posibilitatea de a ocoli mecanismul de atestare SEV-SNP, care ofer\u0103 o confirmare criptografic\u0103 a integrit\u0103\u021bii ma\u0219inii virtuale rulate \u00eentr-un mediu protejat. Atacatorul poate intercepta raportul de atestare al unei ma\u0219ini virtuale corecte \u0219i apoi s\u0103-l substituie pentru o ma\u0219in\u0103 virtual\u0103 compromis\u0103, de exemplu, ascunz\u00e2nd urmele implant\u0103rii unui backdoor. <\/p>\n

Problema afecteaz\u0103 genera\u021biile 3 \u0219i 4 ale procesorului AMD din seria EPYC, livrate sub numele de cod Milan, Milan-X, Genoa, Bergamo, Genoa-X \u0219i Siena. Pentru a bloca vulnerabilitatea, compania AMD a lansat deja o actualizare a firmware-ului SEV, care implementeaz\u0103 verificarea ALIAS_CHECK, \u00eempiedic\u00e2nd manipularea memoriei caracteristic\u0103 atacului analizat. <\/p>\n

Tehnologiile propuse de Intel, Scalable SGX \u0219i TDX, nu sunt vulnerabile la acest atac, deoarece verific\u0103rile necesare sunt prezente din start. Tehnologia clasic\u0103 Intel SGX, care \u00een 2021 a fost clasat\u0103 de Intel ca fiind \u00eenvechit\u0103, este par\u021bial vulnerabil\u0103 la atac (similar cu atacul MemBuster cunoscut anterior, atacatorul poate analiza acces\u0103rile la memoria criptat\u0103, adic\u0103 este posibil\u0103 doar citirea textului criptat, dar nu \u0219i rescrierea acestuia). Testarea extensiilor CCA (Confidential Compute Architecture) \u00een procesoarele ARM nu a fost efectuat\u0103. <\/p>\n

Se raporteaz\u0103 suplimentar o alt\u0103 vulnerabilitate legat\u0103 de AMD SEV-SNP. Vulnerabilitatea a fost identificat\u0103 \u00een fork-ul AMD al emulatorului QEMU, destinat rularii ma\u0219ini virtuale<\/a> cu SEV-SNP. Problema permite administratorului mediului gazd\u0103 s\u0103 ob\u021bin\u0103 acces root la sistemele g\u0103zduite prin manipularea tabelelor ACPI. Vulnerabilitatea este cauzat\u0103 de faptul c\u0103, la \u00eenc\u0103rcarea sistemului g\u0103zduit, se efectueaz\u0103 o verificare a integrit\u0103\u021bii nucleului Linux, a RAM-disk-ului ini\u021bial \u0219i a parametrilor nucleului, dar tabelele ACPI nu sunt luate \u00een considerare, prin intermediul c\u0103rora hipervizorul poate introduce un cod AML (ACPI Machine Language) special conceput, destinat execut\u0103rii \u00een mediu gazduit. Se afirm\u0103 c\u0103 problema nu este specific\u0103 pentru QEMU \u0219i se manifest\u0103 \u00een toate hipervizoarele \u0219i emulatoarele, deoarece nucleul Linux se bazeaz\u0103 pe orice date ACPI primite de la hipervizor.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center>
\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0438 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 BadRAM (CVE-2024-21944), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f SEV-SNP \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0437\u0430 \u0440\u0435\u0434\u043a\u0438\u043c \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c, \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u043e\u0434\u0443\u043b\u044f\u043c \u043f\u0430\u043c\u044f\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u043a\u043e\u043b\u044c\u0446\u0430 \u0437\u0430\u0449\u0438\u0442\u044b (ring0) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120978,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120977","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacul BadRAM, care permite ocolirea mecanismului de atestare SEV-SNP \u00een CPU AMD | ProHoster","description":"Un grup de cercet\u0103tori de la Universit\u0103\u021bile Leuven, L\u00fcbeck \u0219i Birmingham a dezvoltat o metod\u0103 de atac BadRAM (CVE-2024-21944), care permite ocolirea mecanismului de autentificare \u0219i compromiterea mediilor.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 BadRAM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 SEV-SNP \u0432 CPU AMD | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0438 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 BadRAM (CVE-2024-21944), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-13T19:46:02+00:00","article:modified_time":"2024-12-13T19:46:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120977","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:53:19","updated":"2026-02-09 17:38:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=120977"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120977\/revisions"}],"predecessor-version":[{"id":159437,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120977\/revisions\/159437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/120978"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=120977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=120977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=120977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}