{"id":107877,"date":"2023-04-16T12:48:13","date_gmt":"2023-04-16T10:48:13","guid":{"rendered":"https:\/\/prohoster.info\/?p=107877"},"modified":"2023-04-17T17:50:38","modified_gmt":"2023-04-17T15:50:38","slug":"uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","title":{"rendered":"Zranite\u013enos\u0165 v jadre Linux 6.2, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 ochranu proti \u00fatokom Spectre v2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V jadre Linux 6.2 bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2023-1998), ktor\u00e1 deaktivuje ochranu proti \u00fatokom triedy Spectre v2, \u010do umo\u017e\u0148uje pr\u00edstup k pam\u00e4ti in\u00fdch procesov vykon\u00e1van\u00fdch v r\u00f4znych vl\u00e1knach SMT alebo Hyper Threading, ale na jednom fyzickom jadre procesora. Zranite\u013enos\u0165 m\u00f4\u017ee by\u0165 mimo in\u00e9ho pou\u017eit\u00e1 na organiz\u00e1ciu \u00faniku \u00fadajov medzi virtu\u00e1lnymi strojmi v cloudov\u00fdch syst\u00e9moch. Probl\u00e9m sa t\u00fdka iba jadra Linux 6.2 a je sp\u00f4soben\u00fd nespr\u00e1vnou implement\u00e1ciou optimaliz\u00e1ci\u00ed, ktor\u00e9 mali zn\u00ed\u017ei\u0165 v\u00fdrazn\u00e9 re\u017eijn\u00e9 n\u00e1klady pri aplik\u00e1cii ochrany proti Spectre v2. Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 v experiment\u00e1lnej vetve jadra Linux 6.3. <\/p>\n

V u\u017e\u00edvate\u013eskom priestore na ochranu proti \u00fatokom triedy Spectre m\u00f4\u017eu procesy selekt\u00edvne deaktivova\u0165 \u0161pekulat\u00edvne vykon\u00e1vanie in\u0161trukci\u00ed pomocou prctl PR_SET_SPECULATION_CTRL alebo pou\u017ei\u0165 filtr\u00e1ciu syst\u00e9mov\u00fdch volan\u00ed na z\u00e1klade mechanizmu seccomp. Pod\u013ea \u00fadajov v\u00fdskumn\u00edkov, ktor\u00ed probl\u00e9m identifikovali, nespr\u00e1vna optimaliz\u00e1cia v jadre 6.2 nechala bez riadnej ochrany virtu\u00e1lne stroje<\/a> aspo\u0148 jedn\u00e9ho ve\u013ek\u00e9ho cloudov\u00e9ho providera, aj napriek aktiv\u00e1cii re\u017eimu blokovania \u00fatokov spectre-BTI prostredn\u00edctvom prctl. Zranite\u013enos\u0165 sa tie\u017e prejavuje na be\u017en\u00fdch serveroch<\/a> s jadrom 6.2, pri na\u010d\u00edtan\u00ed ktor\u00fdch sa pou\u017e\u00edva nastavenie «spectre_v2=ibrs. <\/p>\n

Podstata zranite\u013enosti spo\u010d\u00edva v tom, \u017ee pri v\u00fdbere ochrann\u00fdch re\u017eimov IBRS alebo eIBRS zaveden\u00e9 optimaliz\u00e1cie deaktivovali uplatnenie mechanizmu STIBP (Single Thread Indirect Branch Predictors), potrebn\u00e9ho na blokovanie \u00fanikov pri aplik\u00e1cii technol\u00f3gie s\u00fa\u010dasn\u00e9ho viacvl\u00e1knov\u00e9ho spracovania (SMT alebo Hyper-Threading). Ochranu proti \u00faniku medzi vl\u00e1knami zabezpe\u010duje iba re\u017eim eIBRS, nie re\u017eim IBRS, preto\u017ee pri \u0148om sa bit IBRS, zabezpe\u010duj\u00faci ochranu proti \u00fanikom medzi logick\u00fdmi jadrami, z d\u00f4vodu v\u00fdkonu vyma\u017ee pri n\u00e1vrate kontroly do u\u017e\u00edvate\u013esk\u00e9ho priestoru, \u010do rob\u00ed vl\u00e1kna v u\u017e\u00edvate\u013eskom priestore nechr\u00e1nene pred \u00fatokmi triedy Spectre v2.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper Threading, \u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u044f\u0434\u0440\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0442\u0435\u0447\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107877","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v jadre Linux 6.2, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 ochranu proti \u00fatokom Spectre v2 | ProHoster","description":"V jadre Linux 6.2 bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2023-1998), ktor\u00e1 deaktivuje ochranu proti \u00fatokom triedy Spectre v2, umo\u017e\u0148uj\u00facim pr\u00edstup k pam\u00e4ti in\u00fdch procesov vykon\u00e1van\u00fdch v r\u00f4znych vl\u00e1knach SMT alebo Hyper.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux 6.2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0430\u0442\u0430\u043a Spectre v2 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux 6.2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-1998), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 Spectre v2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u0430\u0445 SMT \u0438\u043b\u0438 Hyper.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-yadre-linux-6-2-pozvolyayushhaya-obojti-zashhitu-ot-atak-spectre-v2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-16T10:48:13+00:00","article:modified_time":"2023-04-17T15:50:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=107877"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107877\/revisions"}],"predecessor-version":[{"id":164434,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107877\/revisions\/164434"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=107877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=107877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=107877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}