{"id":182817,"date":"2026-08-10T19:49:35","date_gmt":"2026-08-10T17:49:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2"},"modified":"2026-08-10T19:49:35","modified_gmt":"2026-08-10T17:49:35","slug":"tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","title":{"rendered":"TONTOU \u2014 un atac asupra CPU-urilor Intel \u0219i AMD, care permite ocolirea protec\u021biei \u00eempotriva vulnerabilit\u0103\u021bilor Spectre v2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Institutul Tehnologic din Massachusetts au identificat tehnica de atac TONTOU (Time-of-Neutralization to Time-of-Use), care propune o nou\u0103 metod\u0103 de exploatare a vulnerabilit\u0103\u021bilor arhitecturale de tip Spectre v2. Vulnerabilitatea ofer\u0103 posibilitatea de a determina con\u021binutul memoriei nucleului \u00een timpul execut\u0103rii unei exploat\u0103ri \u00een spa\u021biul utilizatorului. Codul pentru blocarea exploat\u0103rii vulnerabilit\u0103\u021bii a fost inclus \u00een nucleul Linux pe 5 august \u0219i este parte integrant\u0103 a versiunilor 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214 \u0219i 5.10.263. <\/p>\n

Cercet\u0103torii au demonstrat posibilitatea de a efectua un atac de c\u0103tre un utilizator local f\u0103r\u0103 privilegii pentru a determina hash-ul parolei utilizatorului root, stocat \u00een fi\u0219ierul \/etc\/shadow \u0219i \u00eenc\u0103rcat \u00een memorie \u00een timpul autentific\u0103rii \u00een sistem. Cercet\u0103torii au reu\u0219it s\u0103 ob\u021bin\u0103 o scurgere de date din memoria nucleului cu o rat\u0103 de 5.47 octe\u021bi pe secund\u0103 \u0219i o precizie de 91.97%. Dintre cele 10 runde de testare a exploat\u0103rii, care au durat \u00een medie 18 minute, \u00een jum\u0103tate din cazuri a fost posibil s\u0103 se determine existen\u021ba fi\u0219ierului \/etc\/shadow \u00een memorie \u0219i s\u0103 se extrag\u0103 con\u021binutul acestuia. <\/p>\n

Exploatarea a fost demonstrat\u0103 pe sisteme cu procesoare AMD \u0219i poate fi utilizat\u0103 cu CPU-uri AMD din familiile Zen 1-4. Pe sistemele Intel, atacul este de asemenea realizabil, dar exploatarea este mai complex\u0103. Pentru a proteja \u00eempotriva dep\u0103\u0219irii stivei adreselor de returnare \u0219i pentru a bloca vulnerabilitatea SRSO (Speculative Return Stack Overflow), procesoarele AMD utilizeaz\u0103 mecanismul de protec\u021bie Safe-RET, care \u0219terge bufferul de predic\u021bie a ramific\u0103rilor dup\u0103 fiecare utilizare \u0219i restric\u021bioneaz\u0103 fereastra de atac la 2 instruc\u021biuni, executate \u00een c\u00e2teva zeci de nanosecunde. <\/p>\n

Pentru a ocoli aceast\u0103 protec\u021bie \u0219i a extinde fereastra de atac, a fost implementat\u0103 o tehnic\u0103 de \u00eencetinire a CPU-ului, care permite finalizarea \u00eenlocuirii \u00eentreruperii la momentul oportun pentru a redirec\u021biona fluxul de execu\u021bie \u00een kernel \u0219i a utiliza handler-ul de \u00eentrerupere pentru a distorsiona \u00eenregistrarea \u00een buffer-ul de predic\u021bie a ramifica\u021biilor. Pentru a exploata vulnerabilitatea SRSO, atacatorul poate crea condi\u021bii \u00een care blocul de predic\u021bie a ramifica\u021biilor va efectua \u00een mod speculativ un num\u0103r mare de apeluri CALL incorect prezise, suficiente pentru a umple stiva adreselor de returnare \u0219i a rescrie punctele de retur corect prezise, plasate la \u00eenceputul stivei. Prin urmare, elementele ini\u021biale ale stivei pot fi rescrise cu valori alese de atacator, ceea ce va duce ulterior la utilizarea acestor valori \u00eenlocuite \u00een execu\u021bia speculativ\u0103 a instruc\u021biunii RET \u00een contextul altui proces. <\/p>\n

Procesorul va determina c\u0103 predic\u021bia ramific\u0103rii nu s-a justificat \u0219i va reveni opera\u021bia la starea ini\u021bial\u0103, dar datele procesate \u00een timpul execu\u021biei speculative vor r\u0103m\u00e2ne \u00een cache \u0219i \u00een buffer-urile microarhitecturale. Dac\u0103 blocul executat eronat acceseaz\u0103 memoria, atunci execu\u021bia sa speculativ\u0103 va duce la sedimente \u00een cache-ul comun \u0219i la date citite din memorie. Pentru extragerea informa\u021biilor din cache poate fi folosit\u0103 una dintre metodele de determinare a con\u021binutului cache-ului pe baza analizei modific\u0103rii timpului de acces la datele \u00eenchise \u0219i cele ne\u00eenchise.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043c\u0430\u0441\u0441\u0430\u0447\u0443\u0441\u0435\u0442\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 TONTOU (Time-of-Neutralization to Time-of-Use), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041a\u043e\u0434 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043d\u044f\u0442 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 7.1.7, 6.18.43, 6.12.102, 6.6.149, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182817","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TONTOU \u2014 atac asupra CPU-urilor Intel \u0219i AMD, care permite ocolirea protec\u021biei \u00eempotriva vulnerabilit\u0103\u021bilor Spectre v2 | ProHoster","description":"Cercet\u0103torii de la Institutul Tehnologic din Massachusetts au identificat tehnica de atac TONTOU (Time-of-Neutralization to Time-of-Use), care ofer\u0103 o nou\u0103 modalitate de a exploata vulnerabilit\u0103\u021bile microarhitecturale din clasa Spectre.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47TONTOU \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 CPU Intel \u0438 AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Spectre v2 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043c\u0430\u0441\u0441\u0430\u0447\u0443\u0441\u0435\u0442\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 TONTOU (Time-of-Neutralization to Time-of-Use), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0443\u044e \u043d\u043e\u0432\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-10T17:49:35+00:00","article:modified_time":"2026-08-10T17:49:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182817","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=182817"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182817\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=182817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=182817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=182817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}