{"id":53866,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx"},"modified":"2020-02-18T14:01:48","modified_gmt":"2020-02-18T11:01:48","slug":"plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","title":{"rendered":"Plundervolt - o nou\u0103 metod\u0103 de atac asupra procesorului Intel, care afecteaz\u0103 tehnologia SGX","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Intel a lansat<\/a><\/noindex> actualizarea microcodului, care elimin\u0103 vulnerabilitatea<\/a><\/noindex> (CVE-2019-14607), permi\u021b\u00e2nd<\/a><\/noindex> prin manipularea mecanismului de gestionare dinamic\u0103 a tensiunii \u0219i frecven\u021bei din CPU, ini\u021bierea deterior\u0103rii con\u021binutului celulelor de date, inclusiv \u00een zonele utilizate pentru calcul \u00een enclavele izolate Intel SGX. Atacul a fost denumit Plundervolt \u0219i permite poten\u021bial un utilizator local s\u0103 \u00ee\u0219i creasc\u0103 privilegiile \u00een sistem, s\u0103 provoace o indisponibilitate a serviciului \u0219i s\u0103 ob\u021bin\u0103 acces la datele confiden\u021biale.<\/p>\n

Atacul reprezint\u0103 un pericol doar \u00een contextul manipul\u0103rilor cu calculele din enclavele SGX, deoarece pentru a fi efectuat necesit\u0103 existen\u021ba drepturilor root \u00een sistem. \u00cen cel mai simplu caz, atacatorul poate provoca distorsiuni \u00een informa\u021biile procesate \u00een enclave, dar \u00een scenarii mai complexe nu este exclus\u0103 posibilitatea recre\u0103rii cheilor de criptare confiden\u021biale stocate \u00een enclave, utilizate pentru criptare folosind algoritmi RSA-CRT \u0219i AES-NI. Tehnica poate fi folosit\u0103, de asemenea, pentru a genera erori \u00een algoritmi ini\u021bial corec\u021bi pentru a provoca apari\u021bia vulnerabilit\u0103\u021bilor \u00een gestionarea memoriei, de exemplu, pentru a organiza accesul la zone dincolo de bufferul alocat.
\nPrototipul codului pentru efectuarea atacului publicat<\/a><\/noindex> de pe GitHub<\/p>\n

Esenta metodei const\u0103 \u00een crearea condi\u021biilor pentru apari\u021bia distorsiunilor neprev\u0103zute ale datelor \u00een timpul calculelor \u00een SGX, de care nu protejeaz\u0103 utilizarea cript\u0103rii \u0219i autentific\u0103rii memoriei \u00een enclave. Pentru a provoca distorsiuni, s-a constatat c\u0103 se pot utiliza interfe\u021bele software standard pentru gestionarea frecven\u021bei \u0219i tensiunii, aplicate de obicei pentru reducerea consumului de energie \u00een timpul inactivit\u0103\u021bii sistemului \u0219i activarea performan\u021bei maxime \u00een timpul sarcinilor intensive. Caracteristicile frecven\u021bei \u0219i tensiunii acoper\u0103 \u00eentreaga cip, afect\u00e2nd \u0219i execu\u021bia calculelor \u00een enclavele izolate. <\/p>\n

Prin modificarea tensiunii, se pot crea condi\u021bii \u00een care sarcina nu este suficient\u0103 pentru regenerarea celulei de memorie din interiorul CPU-ului, iar valoarea acesteia se schimb\u0103. Principala diferen\u021b\u0103 fa\u021b\u0103 de atac RowHammer<\/a><\/noindex> RowHammer permite modificarea con\u021binutului unor bi\u021bi individuali \u00een memoria DRAM prin citirea repetat\u0103 a datelor din celulele adiacente, \u00een timp ce Plundervolt permite modificarea bi\u021bilor din interiorul CPU, atunci c\u00e2nd datele sunt deja \u00eenc\u0103rcate din memorie pentru executarea calculelor. Aceast\u0103 caracteristic\u0103 permite ocolirea mecanismelor de control al integrit\u0103\u021bii \u0219i cript\u0103rii datelor \u00een memorie implementate de SGX, deoarece valorile din memorie r\u0103m\u00e2n corecte, dar pot fi distorsionate \u00een timpul opera\u021biunilor asupra lor, \u00eenainte ca rezultatul s\u0103 fie scris \u00een memorie.<\/p>\n

Dac\u0103 acest\u0103 valoare modificat\u0103 este utilizat\u0103 \u00een procesul de \u00eenmul\u021bire \u00een cadrul cript\u0103rii, atunci va rezulta un text criptat incorect. Av\u00e2nd posibilitatea de a apela managerul SGX pentru a cripta datele sale, un atacator poate genera erori pentru a acumula statistici referitoare la modific\u0103rile textului criptat la ie\u0219ire \u0219i, \u00een c\u00e2teva minute, poate recupera valoarea cheii stocate \u00een enclava. Textul original la intrare \u0219i textul criptat corect la ie\u0219ire sunt cunoscute, cheia nu se modific\u0103, iar ie\u0219irea unui text criptat incorect indic\u0103 distorsionarea unui bit \u00een valoarea sa opus\u0103. <\/p>\n

Analiz\u00e2nd perechile de valori corecte \u0219i distorsionate ale textelor criptate acumulate \u00een urma diferitelor erori, prin metode de analiz\u0103 diferen\u021bial\u0103 a erorilor (DFA, Analiza diferen\u021bial\u0103 a erorilor<\/a><\/noindex>) se poate anticipa<\/a><\/noindex> cheile probabile utilizate pentru criptarea simetric\u0103 AES, iar apoi, analiz\u00e2nd intersec\u021biile cheilor \u00een diferite seturi, se poate determina cheia c\u0103utat\u0103.<\/p>\n

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Aceast\u0103 problem\u0103 afecteaz\u0103 diverse modele de procesoare Intel, inclusiv CPU Intel Core din genera\u021biile 6
\n p\u00e2n\u0103 la 10, precum \u0219i genera\u021biile 5 \u0219i 6 Xeon E3, prima \u0219i a doua genera\u021bie Intel Xeon Scalable, Xeon D,
\nXeon W \u0219i Xeon E.<\/p>\n

Reamintim c\u0103 tehnologia SGX (Extensii Software Guard<\/a><\/noindex>) a ap\u0103rut \u00een procesoarele Intel Core din a \u0219asea genera\u021bie (Skylake) \u0219i ofer\u0103<\/a><\/noindex> serii de instruc\u021biuni care permit aplica\u021biilor la nivel de utilizator s\u0103 aloce zone de memorie \u00eenchise \u2014 enclave, al c\u0103ror con\u021binut nu poate fi citit sau modificat nici m\u0103car de nucleu \u0219i codul executat \u00een modurile ring0, SMM \u0219i VMM. Transferul controlului c\u0103tre codul din enclave nu este posibil prin func\u021biile tradi\u021bionale de salt \u0219i manipul\u0103rile cu registrele \u0219i stiva \u2014 pentru a transfera controlul \u00een enclave se aplic\u0103 o nou\u0103 instruc\u021biune creat\u0103 special, care efectueaz\u0103 verificarea privilegiilor. La r\u00e2ndul s\u0103u, codul plasat \u00een enclave poate utiliza metodele clasice de apel pentru a accesa func\u021biile din interiorul enclavei \u0219i o instruc\u021biune special\u0103 pentru a apela func\u021bii externe. Pentru a proteja \u00eempotriva atacurilor hardware, cum ar fi conectarea la modulul DRAM, se utilizeaz\u0103 criptarea memoriei enclavei.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-14607), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u0435\u043c \u0438 \u0447\u0430\u0441\u0442\u043e\u0442\u043e\u0439 \u0432 CPU \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u044f\u0447\u0435\u0435\u043a \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044f\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u0430\u0445 Intel SGX. \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Plundervolt, \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0437\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53866","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Plundervolt \u2014 o nou\u0103 metod\u0103 de atac asupra procesoarelor Intel, care afecteaz\u0103 tehnologia SGX | ProHoster","description":"Compania Intel a lansat o actualizare a microcodului care rectific\u0103","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Plundervolt \u2014 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e SGX | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53866","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:05:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:28","updated":"2026-01-24 09:05:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=53866"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53866\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=53866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=53866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=53866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}