Bola odhalen\u00e1 zranite\u013enos\u0165 (CVE-2021-33164) vo firmv\u00e9roch UEFI, ktor\u00e1 umo\u017e\u0148uje vykona\u0165 k\u00f3d na \u00farovni SMM (System Management Mode), ktor\u00fd m\u00e1 vy\u0161\u0161iu prioritu ako hypervizor a nulov\u00fd ochran\u00fd ring, a poskytuje neobmedzen\u00fd pr\u00edstup k celej syst\u00e9movej pam\u00e4ti. Zranite\u013enos\u0165, ktor\u00e1 dostala k\u00f3dov\u00e9 meno RingHopper, s\u00favis\u00ed s mo\u017enos\u0165ou uskuto\u010dni\u0165 \u010dasov\u00fd \u00fatok pomocou DMA (Direct Memory Access) na po\u0161kodenie pam\u00e4te v k\u00f3de vykon\u00e1vanom na \u00farovni SMM. Existencia zranite\u013enosti bola potvrden\u00e1 vo firmv\u00e9roch Intel, Dell a Insyde Software (tvrd\u00ed sa, \u017ee probl\u00e9m sa t\u00fdka 8 v\u00fdrobcov, ale ostatn\u00fdch 5 zatia\u013e nebolo zverejnen\u00fdch). Firmv\u00e9r AMD, Phoenix a Toshiba nie je zranite\u013en\u00fd. <\/p>\n
Zneu\u017eitie zranite\u013enost\u00ed m\u00f4\u017ee by\u0165 vykonan\u00e9 z opera\u010dn\u00e9ho syst\u00e9mu, pri\u010dom sa vyu\u017eij\u00fa zranite\u013en\u00e9 SMI obsluhova\u010de (System Management Interrupt), na ktor\u00e9 s\u00fa potrebn\u00e9 pr\u00e1va administr\u00e1tora. \u00datok m\u00f4\u017ee by\u0165 taktie\u017e vykonan\u00fd pri fyzickom pr\u00edstupe na za\u010diatku sp\u00fa\u0161\u0165ania, pred inicializ\u00e1ciou opera\u010dn\u00e9ho syst\u00e9mu. Pre ochranu pred probl\u00e9mom sa odpor\u00fa\u010da pou\u017e\u00edvate\u013eom Linuxu aktualizova\u0165 firmv\u00e9r pomocou slu\u017eby LVFS (Linux Vendor Firmware Service) a vyu\u017ei\u0165 n\u00e1stroj fwupdmgr (fwupdmgr get-updates; fwupdmgr update) z bal\u00edka fwupd. <\/p>\n
Potrebnos\u0165 ma\u0165 pr\u00e1va administr\u00e1tora na vykonanie \u00fatoku obmedzuje nebezpe\u010denstvo probl\u00e9mu, ale nebr\u00e1ni jeho vyu\u017eitiu ako zranite\u013enosti druh\u00e9ho stup\u0148a na udr\u017eanie si pr\u00edtomnosti po zneu\u017eit\u00ed in\u00fdch zranite\u013enost\u00ed v syst\u00e9me alebo pri pou\u017eit\u00ed met\u00f3d soci\u00e1lneho in\u017einierstva. Pr\u00edstup k SMM (Ring -2) umo\u017e\u0148uje vykonanie k\u00f3du na \u00farovni, ktor\u00e1 nie je pod kontrolou opera\u010dn\u00e9ho syst\u00e9mu, \u010do m\u00f4\u017ee by\u0165 vyu\u017eit\u00e9 na \u00fapravu firmv\u00e9ru a vlo\u017eenie skryt\u00e9ho \u0161kodliv\u00e9ho k\u00f3du alebo rootkitov do SPI Flash, ktor\u00e9 nie s\u00fa detegovate\u013en\u00e9 z opera\u010dn\u00e9ho syst\u00e9mu, ako aj na vypnutie overovania pri sp\u00fa\u0161\u0165an\u00ed (UEFI Secure Boot, Intel BootGuard) a \u00fatoky na hypervizory na ob\u00eddenie mechanizmov kontroly integrity virtu\u00e1lnych prostred\u00ed. <\/p>\n
Probl\u00e9m je sp\u00f4soben\u00fd stavom pretekania v spracovate\u013eovi SMI (System Management Interrupt), ktor\u00fd sa vyskytuje v okamihu medzi overen\u00edm pr\u00edstupu a pr\u00edstupom k SMRAM. Na ur\u010denie spr\u00e1vneho okamihu medzi overen\u00edm stavu a pou\u017eit\u00edm v\u00fdsledku overenia m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 anal\u00fdza cez extern\u00e9 kan\u00e1ly s pomocou DMA. V d\u00f4sledku asynchr\u00f3nneho charakteru pr\u00edstupu k SMRAM cez DMA m\u00f4\u017ee \u00fato\u010dn\u00edk ur\u010di\u0165 spr\u00e1vny okamih a prep\u00edsa\u0165 obsah SMRAM pomocou DMA obch\u00e1dzaj\u00fac API spracovate\u013ea SMI. Procesory s podporou mechanizmov Intel-VT a Intel VT-d obsahuj\u00fa ochranu proti DMA \u00fatokom, zalo\u017een\u00fa na aplik\u00e1cii IOMMU (Input-Output Memory Management Unit), av\u0161ak t\u00e1to ochrana je efekt\u00edvna len na blokovanie hardv\u00e9rov\u00fdch DMA \u00fatokov vykonan\u00fdch prostredn\u00edctvom pripraven\u00fdch zariaden\u00ed \u00fato\u010dn\u00edka a nechr\u00e1n\u00ed pred \u00fatokmi cez spracovate\u013eov SMI. \u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RingHopper, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DMA (Direct Memory Access) \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105506","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 vo firmv\u00e9roch UEFI, ktor\u00e1 umo\u017e\u0148uje vykon\u00e1va\u0165 k\u00f3d na \u00farovni SMM | ProHoster","description":"Bola odhalen\u00e1 zranite\u013enos\u0165 (CVE-2021-33164) v firmv\u00e9roch UEFI, ktor\u00e1 umo\u017e\u0148uje vykon\u00e1va\u0165 k\u00f3d na \u00farovni SMM (System Management Mode), ktor\u00fd m\u00e1 vy\u0161\u0161iu prioritu ako hyperv\u00edzor a nulov\u00fd ochrann\u00fd re\u017eim.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-33164) \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 UEFI, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM (System Management Mode), \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0435 \u043a\u043e\u043b\u044c\u0446\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-proshivkah-uefi-pozvolyayushhaya-vypolnit-kod-na-urovne-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-09T01:36:39+00:00","article:modified_time":"2022-11-09T01:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/105506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=105506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/105506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=105506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=105506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=105506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"