{"id":36892,"date":"2019-10-31T22:14:35","date_gmt":"2019-10-31T19:14:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu\/"},"modified":"2019-10-31T22:14:35","modified_gmt":"2019-10-31T19:14:35","slug":"swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","title":{"rendered":"SWAPGS \u2014 o nou\u0103 vulnerabilitate \u00een mecanismul de execu\u021bie speculativ\u0103 a CPU-ului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la compania Bitdefender au identificat<\/a><\/noindex> o nou\u0103 vulnerabilitate (CVE-2019-1125<\/a><\/noindex>) \u00een mecanismul de execu\u021bie speculativ\u0103 a instruc\u021biunilor procesorului modern, care a primit numele SWAPGS, corespunz\u0103tor denumirii instruc\u021biunii de procesor care cauzeaz\u0103 problema. Vulnerabilitatea permite<\/a><\/noindex> permite unui atacator f\u0103r\u0103 privilegii s\u0103 determine con\u021binutul zonelor de memorie ale nucleului sau al ma\u0219inilor virtuale active. Problema a fost confirmat\u0103<\/a><\/noindex> \u00een procesoarele Intel (x86_64) \u0219i par\u021bial implic\u0103<\/noindex> \u00een procesoarele AMD, pentru care nu se manifest\u0103 vectorul principal de atac. Metodele anterioare de combatere a vulnerabilit\u0103\u021bilor Spectre \u0219i Meltdown nu protejeaz\u0103 \u00eempotriva atacului SWAPGS atunci c\u00e2nd se folosesc procesoare Intel, dar pentru Linux, ChromeOS, Android \u0219i Windows deja au fost propuse remedii.<\/p>\n

Vulnerabilitatea apar\u021bine clasei Spectre v1 \u0219i se bazeaz\u0103 pe ideea de recuperare a datelor din cache-ul procesorului, care r\u0103m\u00e2n dup\u0103 execu\u021bia speculativ\u0103 a instruc\u021biunilor. Blocurile de predic\u021bie a salturilor din procesoarele moderne pentru a \u00eembun\u0103t\u0103\u021bi performan\u021ba aplic\u0103 execu\u021bia anticipat\u0103 a unor instruc\u021biuni care cel mai probabil vor fi executate, f\u0103r\u0103 a a\u0219tepta calcularea tuturor factorilor care determin\u0103 execu\u021bia lor (de exemplu, c\u00e2nd condi\u021biile de salt sau parametrii de acces nu sunt \u00eenc\u0103 calcula\u021bi). Dac\u0103 prognoza nu se confirm\u0103, procesorul renun\u021b\u0103 la rezultatul execu\u021biei speculative, dar datele procesate \u00een timpul acesteia r\u0103m\u00e2n \u00een cache-ul procesorului \u0219i pot fi recuperate prin metode de determinare a con\u021binutului cache-ului prin canale externe, analiz\u00e2nd modificarea timpului de acces la datele cached \u0219i uncached. <\/p>\n

Particularitatea noului atac este utilizarea scurgerii care apare \u00een timpul execu\u021biei speculative a instruc\u021biunii SWAPGS, care este aplicat\u0103 \u00een sistemele de operare pentru a \u00eenlocui valoarea registrului GS la trecerea controlului din spa\u021biul utilizatorului \u00een nucleul sistemului de operare (valoarea GS utilizat\u0103 \u00een spa\u021biul utilizatorului este \u00eenlocuit\u0103 cu valoarea utilizat\u0103 pentru opera\u021biile \u00een nucleu). \u00cen nucleul Linux, \u00een GS este stocat un pointer per_cpu, utilizat pentru a accesa datele nucleului, iar \u00een spa\u021biul utilizatorului, pointerii c\u0103tre TLS (Thread Local Storage). <\/p>\n

Pentru a evita apelul dublu al instruc\u021biunii SWAPGS la o nou\u0103 accesare a nucleului din spa\u021biul kernel sau c\u00e2nd se execut\u0103 cod care nu necesit\u0103 schimbarea registrului GS, se efectueaz\u0103 o verificare \u0219i o ramificare condi\u021bionat\u0103 \u00eenainte de instruc\u021biune. Mecanismul de execu\u021bie speculativ\u0103 trece anticipat la execu\u021bia codului cu instruc\u021biunea SWAPGS, f\u0103r\u0103 a a\u0219tepta rezultatul verific\u0103rii, iar dac\u0103 ramura selectat\u0103 nu se confirm\u0103, rezultatul este abandonat. Astfel, poate ap\u0103rea o situa\u021bie \u00een care ramura speculativ\u0103 este aleas\u0103 f\u0103r\u0103 a prevedea execu\u021bia SWAPGS, dar, \u00een timpul execu\u021biei speculative, valoarea registrului GS va fi modificat\u0103 de instruc\u021biunea SWAPGS \u0219i utilizat\u0103 \u00een opera\u021biuni dependente de memorie, care se acumuleaz\u0103 \u00een cache-ul CPU. <\/p>\n

Cercet\u0103torii au propus dou\u0103 scenarii de atac, pentru care au fost preg\u0103tite prototipuri de exploatabile. Primul scenariu se bazeaz\u0103 pe situa\u021bia \u00een care instruc\u021biunea SWAPGS nu este executat\u0103 speculativ, de\u0219i este utilizat\u0103 \u00een executarea efectiv\u0103, iar al doilea \u2014 dimpotriv\u0103, c\u00e2nd instruc\u021biunea SWAPGS este executat\u0103 speculativ, de\u0219i nu ar trebui. Pentru fiecare scenariu sunt prev\u0103zute dou\u0103 variante de exploatare: atacatorul poate determina valoarea la o anumit\u0103 adres\u0103 din zona nucleului \u0219i atacatorul poate c\u0103uta o anumit\u0103 valoare la adrese aleatorii din nucleu. Efectuarea atacului necesit\u0103 mult timp \u0219i pentru organizarea scurgerii poate fi necesar\u0103 executarea exploatabilului timp de c\u00e2teva ore. <\/p>\n

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

\u00cen nucleul Linux, problema remediat\u0103<\/a><\/noindex> prin modificarea logicii de apel al instruc\u021biunii SWAPGS (blocarea execu\u021biei speculative), similar cu corect\u0103rile altor vulnerabilit\u0103\u021bi din clasa Spectre v1. Se presupune c\u0103 protec\u021bia ad\u0103ugat\u0103 va avea un impact minim asupra performan\u021bei sarcinilor de lucru obi\u0219nuite. \u00cent\u00e2rzierea apare \u00een etapa de comutare \u00eentre spa\u021biul utilizatorului \u0219i nucleu, ceea ce poate duce la o sc\u0103dere a performan\u021bei, de exemplu, \u00een cazul execu\u021biei intensive a apelurilor de sistem din aplica\u021bie sau generarea frecvent\u0103 de NMI \u0219i \u00eentreruperi. <\/p>\n

Corec\u021bia necesit\u0103 instalarea actualiz\u0103rii nucleului at\u00e2t \u00een sistemul principal, c\u00e2t \u0219i \u00een medii gazd\u0103, urmat\u0103 de repornirea sistemului. Pentru a dezactiva protec\u021bia \u00een Linux poate fi utilizat\u0103 op\u021biunea \u00abnospectre_v1\u00bb, care dezactiveaz\u0103 \u0219i m\u0103surile de blocare a vulnerabilit\u0103\u021bii SWAPGS. Corec\u021bia este disponibil\u0103 sub form\u0103 de patch<\/a><\/noindex> for the Linux kernel, which is already included in the releases 4.19.65<\/a><\/noindex>, 5.2.7<\/a><\/noindex>, 4.14.137, 4.9.188, and 4.4.188. Updates for Linux distributions have not yet been released (Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>). In Windows, the issue was resolved discreetly in the July update<\/a><\/noindex>. Google preg\u0103tit\u0103<\/a><\/noindex> provided the fix for kernel 4.19, delivered in ChromeOS and Android<\/a><\/noindex>.<\/p>\n

According to researchers from Bitdefender, Intel was informed about the issue as early as August last year. The problem was resolved programmatically, with developers from Microsoft, Google, and the Linux kernel working together to produce a fix. Older Intel processors, prior to Ivy Bridge, are significantly harder to attack due to the lack of support for the WRGSBASE instruction used in the exploit. ARM, POWER, SPARC, MIPS, and RISC-V systems are not affected by the issue, as they do not support the SWAPGS instruction.<\/p>\n

Problema amenin\u021b\u0103 \u00een principal proprietarii de procesoare Intel \u2014
\n on AMD systems, only the second attack scenario could be reproduced, limited to speculative processing of the base value of the GS register, which can be used to find certain values in random areas of memory. To block this attack variant, suficient<\/noindex> existing methods of protection against Spectre v1 vulnerabilities. <\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-1125) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 CPU, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0438\u043c\u044f SWAPGS, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043d\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Intel (x86_64) \u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b AMD, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SWAPGS \u2014 a new vulnerability in the CPU speculative execution mechanism | ProHoster","description":"Researchers from Bitdefender have identified a new vulnerability (","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SWAPGS \u2014 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f CPU | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:35+00:00","article:modified_time":"2019-10-31T19:14:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:14:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:22","updated":"2026-01-22 05:14:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=36892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=36892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=36892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=36892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}