{"id":35693,"date":"2019-10-31T22:05:48","date_gmt":"2019-10-31T19:05:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya\/"},"modified":"2019-10-31T22:05:48","modified_gmt":"2019-10-31T19:05:48","slug":"uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","title":{"rendered":"Vulnerabilitate \u00een AMD SEV, care permite determinarea cheilor de criptare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii din echipa Google Cloud au identificat<\/a><\/noindex> o vulnerabilitate (CVE-2019-9836) \u00een implementarea tehnologiei AMD SEV (Secure Encrypted Virtualization), care permite compromiterea datelor protejate de aceast\u0103 tehnologie. AMD SEV asigur\u0103 la nivel hardware criptarea transparent\u0103 a memoriei ma\u0219inilor virtuale, prin care accesul la datele decriptate este permis numai sistemului de operare gazd\u0103 curent, iar celelalte ma\u0219ini virtuale \u0219i hipervizorul primesc un set de date criptate \u00een cazul \u00een care \u00eencearc\u0103 s\u0103 acceseze aceast\u0103 memorie.<\/p>\n

Problema identificat\u0103 permite recuperarea complet\u0103 a con\u021binutului cheii PDH \u00eenchise, procesat\u0103 la nivelul unui procesor de securitate protejat PSP (AMD Security Processor), inaccesibil pentru sistemul de operare principal.
\nDispun\u00e2nd de cheia PDH, atacatorul poate apoi recupera cheia de sesiune \u0219i secven\u021ba secret\u0103 stabilit\u0103 la crearea ma\u0219inii virtuale, ob\u021bin\u00e2nd astfel acces la datele criptate. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de neajunsuri \u00een implementarea curbelor eliptice (ECC) utilizate pentru criptare, care permit un atac<\/a><\/noindex> de recuperare a parametrilor curbei. \u00cen timpul execut\u0103rii comenzii de lansare a unei ma\u0219ini virtuale protejate, atacatorul poate trimite parametrii curbei care nu se conformeaz\u0103 parametrilor recomanda\u021bi de NIST, ceea ce va duce la utilizarea valorilor punctelor de ordin mic \u00een opera\u021biunile de multiplicare cu datele cheii \u00eenchise. <\/p>\n

Securitatea protocolului ECDH depinde direct de<\/a><\/noindex> de la ordinul<\/a><\/noindex> punctului ini\u021bial generat al curbei, logaritmarea discret\u0103 a c\u0103reia reprezint\u0103 o sarcin\u0103 extrem de complex\u0103. \u00centr-unul dintre pa\u0219ii ini\u021bializ\u0103rii mediu AMD SEV, \u00een calculele cu cheia \u00eenchis\u0103 se folosesc parametrii ob\u021binu\u021bi de la utilizator. Practic, se efectueaz\u0103 o opera\u021bie de multiplicare a dou\u0103 puncte, unul dintre acestea corespunz\u00e2nd cheii \u00eenchise. Dac\u0103 al doilea punct se refer\u0103 la numere prime de ordin mic, atacatorul poate determina parametrii primului punct (biti modulului utilizat \u00een opera\u021bia de ridicare la putere modulo) prin \u00eencercarea tuturor valorilor posibile. Pentru a determina cheia \u00eenchis\u0103, fragmentele de numere prime selectate pot fi apoi reunite prin Teorema chinez\u0103 a resturilor<\/a><\/noindex>.<\/p>\n

Platformele serverelor AMD EPYC sunt afectate, folosind firmware SEV p\u00e2n\u0103 la versiunea 0.17 build 11. Compania AMD deja a publicat<\/noindex> a lansat o actualizare a firmware-ului, care introduce blocarea utiliz\u0103rii punctelor care nu sunt conforme cu curba NIST. \u00cen acela\u0219i timp, certificatele generate anterior pentru cheile PDH r\u0103m\u00e2n valabile, permi\u021b\u00e2nd unui atacator s\u0103 efectueze un atac de migrare a ma\u0219inilor virtuale din medii protejate de vulnerabilitate \u00een medii expuse problemei. De asemenea, se men\u021bioneaz\u0103 posibilitatea unui atac prin restaurarea versiunii vechi a firmware-ului la o versiune vulnerabil\u0103, dar aceast\u0103 posibilitate nu a fost confirmat\u0103 \u00eenc\u0103.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Cloud \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9836) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 AMD SEV (Secure Encrypted Virtualization), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0435. AMD SEV \u043d\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043a\u0443\u0449\u0430\u044f \u0433\u043e\u0441\u0442\u0435\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0438 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35693","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een AMD SEV care permite determinarea cheilor de criptare | ProHoster","description":"Dezvoltatorii echipei Google Cloud au descoperit o vulnerabilitate (CVE-2019-9836) \u00een implementarea tehnologiei AMD SEV (Secure).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 AMD SEV, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Cloud \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9836) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 AMD SEV (Secure.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:48+00:00","article:modified_time":"2019-10-31T19:05:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35693","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:24:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:57:46","updated":"2026-01-22 00:24:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35693"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35693\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}