Compania AMD a inclus procesoarele bazate pe microarhitectura Zen 5 \u00een lista produselor afectate de vulnerabilitatea EntrySign, care permite ocolirea mecanismului de verificare a semn\u0103turii digitale \u00een timpul actualiz\u0103rii microcodului. Ini\u021bial, se credea c\u0103 vulnerabilitatea afecteaz\u0103 doar CPU-urile AMD din prima p\u00e2n\u0103 \u00een a patra genera\u021bie a microarhitecturii Zen. Astfel, vulnerabilitatea s-a dovedit a fi aplicabil\u0103 procesoarelor precum Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen AI 300 (Strix Halo, Strix Point, Krackan Point) \u0219i Ryzen 9000HX (Fire Range). <\/p>\n
Pe l\u00e2ng\u0103 actualizarea microcodului, pentru a remedia vulnerabilitatea \u00een sistemele care utilizeaz\u0103 certificarea SEV-SNP, este necesar\u0103 \u0219i actualizarea firmware-ului AMD SEV, care este inclus \u00een actualiz\u0103rile BIOS. Se afirm\u0103 c\u0103 AMD a furnizat produc\u0103torilor de echipamente firmware-ul modificat (ComboAM5PI 1.2.0.3c AGESA) necesar pentru a rezolva problema, dar actualiz\u0103rile finale de BIOS disponibile consumatorilor ar putea fi lansate de produc\u0103tori dup\u0103 s\u0103pt\u0103m\u00e2ni sau luni. <\/p>\n
Angaja\u021bii AMD au propus, de asemenea, includerea unui patch \u00een kernelul Linux care blocheaz\u0103 \u00eenc\u0103rcarea actualiz\u0103rilor neoficiale de microcod (se subliniaz\u0103 c\u0103 actualiz\u0103rile corecte de microcod trebuie instalate \u00eempreun\u0103 cu BIOS-ul de la produc\u0103torul echipamentului, dar deja au ap\u0103rut \u00eencerc\u0103ri de a crea corec\u021bii neoficiale de c\u0103tre entuzia\u0219ti, bazate pe fragmente de microcod t\u0103iate din BIOS). Utilizatorilor li se recomand\u0103 s\u0103 a\u0219tepte actualiz\u0103rile oficiale de BIOS. <\/p>\n
Vulnerabilitatea EntrySign ofer\u0103 posibilitatea modific\u0103rii microcodului, permi\u021b\u00e2nd compromiterea mecanismului AMD SEV (Virtualizare Encryptat\u0103 Securizat\u0103), utilizat \u00een sistemele de virtualizare pentru protec\u021bie. ma\u0219ini virtuale<\/a> de interven\u021bia hipercontrollorului sau a administratorului sistemului gazd\u0103. \u00cen cadrul atacului, se poate interfera cu func\u021bionarea sistemelor gazd\u0103, protejate prin extensiile AMD SEV (Virtualizare Encryptat\u0103 Securizat\u0103) \u0219i SEV-SNP (Paging Imbricat Securizat), care ofer\u0103 garan\u021bii de integritate a memoriei ma\u0219inilor virtuale, izol\u00e2nd registrele procesorului \u0219i asigur\u00e2nd o func\u021bionare sigur\u0103 cu tabelele de pagini de memorie \u00eenglobate. <\/p>\n Vulnerabilitatea este cauzat\u0103 de utilizarea \u00een procesul de verificare a microcodului a algoritmului de integrare CMAC \u00een locul unei func\u021bii hash de \u00eencredere. Compania AMD folose\u0219te o cheie privat\u0103 RSA pentru a semna digital microcodul \u00eenc\u0103rcat \u00een procesor, iar \u00een patch-ul cu microcodul distribuie cheia public\u0103. Pentru a verifica c\u0103 cheia public\u0103 corespunde perechii originale de chei RSA, procesorul compar\u0103 hash-ul cheii publice AMD, \u00eencorporat \u00een timpul produc\u021biei \u00een CPU, cu hash-ul cheii publice specificate \u00een patch. <\/p>\n Verificarea autenticit\u0103\u021bii microcodului \u00een patch se realizeaz\u0103 prin compararea hash-ului livrat cu patch-ul, certificat cu semn\u0103tura digital\u0103 (RSASSA-PKCS1-v1_5), \u0219i a hash-ului calculat pe baza microcodului efectiv livrat \u00een patch. Dac\u0103 hash-urile de referin\u021b\u0103 \u0219i cele calculate coincid \u2014 patch-ul este \u00eenc\u0103rcat \u00een memoria intern\u0103 a CPU-ului. Problema este c\u0103, \u00een loc de utilizarea func\u021biilor de hash criptografice recomandate, s-a aplicat algoritmul CMAC, care nu este destinat pentru astfel de opera\u021bii \u0219i nu este protejat \u00eempotriva coliziunilor. <\/p>\n CMAC nu este o func\u021bie hash, ci realizeaz\u0103 o integrare a mesajului (Message Authentication Code), care depinde de cheia de criptare. Func\u021bionarea AES-CMAC const\u0103 \u00een utilizarea algoritmului criptografic AES \u0219i combinarea rezultatului aplic\u0103rii acestuia cu urm\u0103torul bloc de date prin opera\u021bia XOR. Aceast\u0103 schem\u0103 garanteaz\u0103 c\u0103 modificarea datelor de intrare va conduce la o modificare imprevizibil\u0103 a datelor de ie\u0219ire. Totu\u0219i, CMAC nu trebuie folosit ca func\u021bie hash, deoarece oricine cunoa\u0219te cheia de criptare ini\u021bial\u0103 poate descoperi st\u0103rile intermediare de criptare \u0219i poate calcula valori care pot compensa modificarea datelor de intrare, astfel \u00eenc\u00e2t rezultatul aplic\u0103rii CMAC s\u0103 r\u0103m\u00e2n\u0103 neschimbat. <\/p>\n AMD folose\u0219te o cheie de criptare unic\u0103 pentru AES-CMAC, furnizat\u0103 pe toate procesoarele CPU \u00eencep\u00e2nd de la Zen 1. Prin urmare, este suficient s\u0103 extragi aceast\u0103 cheie din orice CPU AMD, iar aceasta va fi aplicabil\u0103 tuturor celorlalte CPU. Cercet\u0103torii au descoperit c\u0103, pentru criptarea AES-CMAC, AMD a folosit o cheie cunoscut\u0103, extras\u0103 dintr-un exemplu men\u021bionat \u00een recomand\u0103rile pentru utilizarea algoritmilor de criptare bloc NIST SP 800-38B. Deoarece AES-CMAC este utilizat pentru hashingul cheii RSA \u00eencorporate \u00een patch \u0219i a con\u021binutului microcodului, identific\u00e2nd cheia de criptare AES-CMAC, s-a deschis posibilitatea de a substitui un alt cheia RSA deschis\u0103 \u00een patch-ul respectiv \u0219i de a modifica con\u021binutul microcodului. <\/p>\n Pentru a crea un patch fals, este suficient s\u0103 generezi o nou\u0103 cheie public\u0103 care s\u0103 produc\u0103 acela\u0219i hash ca cel generat de cheia public\u0103 autentic\u0103 AMD \u0219i s\u0103 se identifice coliziunile pentru semn\u0103tura digital\u0103. Coliziunile sunt create prin ata\u0219area unui bloc suplimentar la microcod, care arat\u0103 ca un set de date aleatorii. \u00cen mod similar, se poate preg\u0103ti un patch modificat cu microcod care s\u0103 corespund\u0103 semn\u0103turii digitale cu care a fost certificat patch-ul original de la AMD. Uneltele Zentool, care includ utilitare pentru analiza microcodului \u0219i crearea de patch-uri pentru modificarea microcodului, sunt disponibile sub licen\u021ba Apache 2.0. Pentru a schimba microcodul, este necesar\u0103 ob\u021binerea dreptului de a executa cod la nivelul Ring 0 (tehnologiile VT-x \u0219i AMD-V permit sistemului gazd\u0103 s\u0103 ruleze cu drepturi Ring 0). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e CPU AMD \u043d\u0430 \u0431\u0430\u0437\u0435 1-4 \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u0430 \u043a \u0442\u0430\u043a\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c, \u043a\u0430\u043a Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123472","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 procesoarele AMD Zen 5 sunt vulnerabile, permi\u021b\u00e2nd modificarea microcodului \u0219i ocolirea izol\u0103rii SEV-SNP | ProHoster","description":"Compania AMD a inclus procesoarele bazate pe microarhitectura Zen 5 \u00een lista produselor susceptibile la vulnerabilitatea EntrySign, care permite ocolirea mecanismului de verificare a semn\u0103turii digitale \u00een timpul actualiz\u0103rii microcodului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CPU AMD Zen 5 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0445\u043e\u0434 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 SEV-SNP | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-11T13:05:18+00:00","article:modified_time":"2025-04-11T13:05:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123472","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:44:58","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:10:19","updated":"2026-02-09 17:44:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=123472"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123472\/revisions"}],"predecessor-version":[{"id":159262,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123472\/revisions\/159262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=123472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=123472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=123472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"