{"id":52649,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel"},"modified":"2020-02-18T14:00:26","modified_gmt":"2020-02-18T11:00:26","slug":"vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","title":{"rendered":"A fost identificat\u0103 o nou\u0103 variant\u0103 a atacului Zombieload asupra procesoarelor Intel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Universitatea Tehnic\u0103 din Graz (Austria) au dezv\u0103luit<\/a><\/noindex> informa\u021bii despre noua metod\u0103 de atac prin canale secundare ZombieLoad 2.0<\/a><\/noindex> (CVE-2019-11135<\/a><\/noindex>), care permite extragerea informa\u021biilor confiden\u021biale din alte procese, sistemul de operare, ma\u0219ini virtuale \u0219i enclave securizate (TEE, Trusted Execution Environment). Problema afecteaz\u0103 doar procesoarele Intel. Componentele pentru blocarea problemei sunt oferite<\/a><\/noindex> \u00een actualizarea de ieri a microcodului<\/a><\/noindex>. <\/p>\n

Problema se \u00eencadreaz\u0103 \u00een clasa MDS (Microarchitectural Data Sampling) \u0219i este o variant\u0103 modernizat\u0103 a f\u0103cute publice<\/a><\/noindex> \u00een luna mai a atacului ZombieLoad. ZombieLoad 2.0, la fel ca \u0219i alte atacuri din clasa MDS, se bazeaz\u0103 pe utilizarea metodelor de analiz\u0103 prin canale secundare asupra datelor din structurile microarhitecturale (de exemplu, \u00een buffer-ele de umplere (Line Fill Buffer) \u0219i de stocare (Store Buffer), \u00een care sunt temporar p\u0103strate datele utilizate \u00een timpul desf\u0103\u0219ur\u0103rii opera\u021biunilor Load \u0219i Store).<\/p>\n

Noua variant\u0103 a atacului Zombieload se bazeaz\u0103<\/a><\/noindex> pe scurgerile care apar \u00een timpul func\u021bion\u0103rii mecanismului de \u00eentrerupere asincron\u0103 a opera\u021biunilor (TAA, TSX Asynchronous Abort), implementat \u00een extensia TSX (Transactional Synchronization Extensions), care ofer\u0103 mijloace pentru a lucra cu memoria tranzac\u021bional\u0103, permi\u021b\u00e2nd \u00eembun\u0103t\u0103\u021birea performan\u021bei aplica\u021biilor multi-threaded prin excluderea dinamic\u0103 a opera\u021biunilor inutile de sincronizare (sunt sus\u021binute tranzac\u021bii atomice care pot fi fie acceptate, fie anulate). \u00cen cazul \u00eentreruperii, opera\u021biunile efectuate \u00een regiunea de memorie tranzac\u021bional\u0103 sunt r\u0103sturnate.<\/p>\n

\u00centreruperea tranzac\u021biei se realizeaz\u0103 asincron, iar \u00een acest timp alte fire pot accesa cache-ul, care este folosit de asemenea \u00een regiunea de memorie tranzac\u021bional\u0103 anihilat\u0103. \u00cen intervalul dintre \u00eenceputul \u0219i finalizarea efectiv\u0103 a \u00eentreruperii asincrone a tranzac\u021biei, nu este exclus ca procesorul, \u00een timpul desf\u0103\u0219ur\u0103rii speculative a opera\u021biunii, s\u0103 poat\u0103 citi date din buffer-urile interne microarhitecturale \u0219i s\u0103 le transmit\u0103 \u00eentr-o opera\u021biune desf\u0103\u0219urat\u0103 speculativ. Apoi va fi identificat conflictul, iar opera\u021biunea speculativ\u0103 va fi anulat\u0103, dar datele vor r\u0103m\u00e2ne \u00een cache \u0219i pot fi extrase folosind metode de recuperare a cache-ului prin canale secundare. <\/p>\n

Atacul se refer\u0103 la deschiderea tranzac\u021biilor TSX \u0219i crearea condi\u021biilor pentru \u00eentreruperea lor asincron\u0103, moment \u00een care apar condi\u021bii pentru scurgeri de con\u021binut din buffer-ele interne, umplute speculativ cu date din opera\u021biunile de citire a memoriei ce se desf\u0103\u0219oar\u0103 pe acela\u0219i nucleu al CPU. Scurgerea este limitat\u0103 la nucleul fizic curent al CPU (pe care se execut\u0103 codul atacatorului), \u00eens\u0103 av\u00e2nd \u00een vedere c\u0103 buffer-ele microarhitecturale sunt utilizate \u00een comun de diferite fire \u00een modul Hyper-Threading, este posibil\u0103 apari\u021bia scurgerilor de opera\u021biuni cu memoriile efectuate \u00een alte fire ale CPU. <\/p>\n

Atacului sunt expuse<\/a><\/noindex> anumite modele de procesoare Intel Core de genera\u021bia a opta, a noua \u0219i a zecea, precum \u0219i Intel Pentium Gold, Intel Celeron 5000, Intel Xeon E, Intel Xeon W \u0219i a doua genera\u021bie de Intel Xeon Scalable. De asemenea, atacului \u00eei sunt expuse \u0219i noile procesoare Intel bazate pe microarhitectura Cascade Lake, prezentat\u0103 \u00een aprilie, care ini\u021bial nu era supus\u0103 atacurilor RIDL \u0219i Fallout. Pe l\u00e2ng\u0103 Zombieload 2.0, cercet\u0103torii au identificat \u0219i o modalitate de a ocoli metodele anterioare de protec\u021bie \u00eempotriva atacurilor MDS, care se bazeaz\u0103 pe utilizarea instruc\u021biunii VERW pentru a cur\u0103\u021ba con\u021binutul buffer-elor microarhitecturale \u00een momentul revenirii din modul kernel \u00een spa\u021biul utilizatorului sau \u00een timpul transferului controlului c\u0103tre sistemul gazd\u0103.<\/p>\n

\u00cen raportul Intel se afirm\u0103 c\u0103, \u00een sistemele cu sarcini heterogene, posibilitatea de a efectua un atac este \u00eengreunat\u0103, deoarece scurgerea din structurile microarhitecturale acoper\u0103 toat\u0103 activitatea din sistem \u0219i atacatorul nu poate influen\u021ba sursa datelor extrase, adic\u0103 poate doar s\u0103 acumuleze informa\u021biile care apar \u00een urma scurgerii \u0219i s\u0103 \u00eencerce s\u0103 identifice printre acestea informa\u021bii utile, f\u0103r\u0103 a avea posibilitatea de a intercepta \u00een mod direc\u021bionat datele legate de adrese specifice de memorie. Cu toate acestea, cercet\u0103torii au publicat un prototip de exploit<\/a><\/noindex>, care func\u021bioneaz\u0103 pe Linux \u0219i Windows, \u0219i a fost demonstrat\u0103 posibilitatea de aplicare a atacului pentru a determina hash-ul parolei utilizatorului root.
\nEste posibil<\/a><\/noindex> s\u0103 se realizeze un atac din sistemul gazd\u0103 pentru a acumula date care figureaz\u0103 \u00een opera\u021biunile altor sisteme gazd\u0103, mediu gazd\u0103, hypervizor \u0219i enclave Intel SGX.<\/p>\n

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Corec\u021biile pentru blocarea vulnerabilit\u0103\u021bii sunt incluse<\/a><\/noindex> au fost incluse \u00een baza de cod a nucleului Linux \u0219i au intrat \u00een versiunile \t5.3.11, 4.19.84, 4.14.154, 4.9.201 \u0219i 4.4.201<\/a><\/noindex>. Actualiz\u0103rile cu kernelul \u0219i microcodul au fost deja lansate pentru principalele distribu\u021bii (Debian<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>). Problema a fost identificat\u0103 \u00een aprilie, iar solu\u021bia a fost coordonat\u0103 de Intel cu dezvoltatorii sistemelor de operare.<\/p>\n

Cea mai simpl\u0103 metod\u0103 de blocare a Zombieload 2.0 este dezactivarea suportului pentru TSX \u00een CPU. Corec\u021bia propus\u0103 pentru nucleul Linux include mai multe op\u021biuni de protec\u021bie. Prima op\u021biune ofer\u0103 parametrul «tsx=on\/off\/auto», care permite gestionarea activ\u0103rii extensiei TSX \u00een CPU (valoarea auto dezactiveaz\u0103 TSX doar pentru CPU-urile vulnerabile). A doua op\u021biune de protec\u021bie se activeaz\u0103 prin parametrul «tsx_async_abort=off\/full\/full,nosmt» \u0219i se bazeaz\u0103 pe cur\u0103\u021barea bufferelor microarhitecturale \u00een timpul schimb\u0103rii de context (flagul nosmt dezactiveaz\u0103 suplimentar SMT\/Hyper-Threads). Pentru a verifica expunerea sistemului la vulnerabilitate, \u00een sysfs este prev\u0103zut parametrul «\\\/sys\\\/devices\\\/system\\\/cpu\\\/vulnerabilities\\\/tsx_async_abort».<\/p>\n

\u00cen plus, \u00een platformei<\/a><\/noindex> microcod remediat\u0103<\/a><\/noindex> \u00eenca o vulnerabilitatea<\/a><\/noindex> (CVE-2018-12207<\/a><\/noindex>) \u00een procesoarele Intel, care este de asemenea blocat \u00een noul platformei<\/a><\/noindex> kernel Linux. Vulnerabilitatea permite<\/a><\/noindex> un atacator f\u0103r\u0103 privilegii poate ini\u021bia un refuz de serviciu, care duce la blocarea sistemului \u00een stare «Machine Check Error».
\n Atacul poate fi realizat dintr-un sistem gazd\u0103.<\/a><\/noindex> din sistemul de oaspe\u021bi.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u043c \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c ZombieLoad 2.0 (CVE-2019-11135), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u043e\u0432 (TEE, Trusted Execution Environment). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel. \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u044b \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 MDS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A fost descoperit\u0103 o nou\u0103 variant\u0103 de atac Zombieload asupra procesoarelor Intel | ProHoster","description":"Cercet\u0103torii de la Universitatea Tehnic\u0103 din Graz (Austria)","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 Zombieload \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f)","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:26","updated":"2026-01-24 04:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=52649"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52649\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=52649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=52649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=52649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}