{"id":108554,"date":"2023-05-17T00:48:11","date_gmt":"2023-05-16T22:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=108554"},"modified":"2023-05-17T10:40:17","modified_gmt":"2023-05-17T08:40:17","slug":"ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","title":{"rendered":"\u00datok PMFault, umo\u017e\u0148uj\u00faci zni\u010di\u0165 CPU na niektor\u00fdch serverov\u00fdch syst\u00e9m\u00e1ch","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdskumn\u00edci z Birmingham University, zn\u00e1mi svojou pr\u00e1cou na \u00fatokoch Plundervolt a VoltPillager, odhalili zranite\u013enos\u0165 (CVE-2022-43309) v niektor\u00fdch serverov\u00fdch z\u00e1kladn\u00fdch dosk\u00e1ch, ktor\u00e1 umo\u017e\u0148uje fyzicky zni\u010di\u0165 CPU bez mo\u017enosti jeho n\u00e1sledn\u00e9ho obnovenia. Zranite\u013enos\u0165, ktor\u00e1 dostala k\u00f3dov\u00e9 meno PMFault, m\u00f4\u017ee by\u0165 vyu\u017eit\u00e1 na po\u0161kodenie serverov, ku ktor\u00fdm \u00fato\u010dn\u00edk nem\u00e1 fyzick\u00fd pr\u00edstup, ale m\u00e1 privil\u00e9gi\u00e1 v opera\u010dnom syst\u00e9me, z\u00edskan\u00e9 napr\u00edklad v d\u00f4sledku zneu\u017eitia neopravenej zranite\u013enosti alebo z\u00edskania prihlasovac\u00edch \u00fadajov administr\u00e1tora. <\/p>\n

Podstata navrhovanej met\u00f3dy spo\u010d\u00edva v pou\u017eit\u00ed rozhrania PMBus, ktor\u00e9 vyu\u017e\u00edva protokol I2C, na zv\u00fd\u0161enie nap\u00e4tia pod\u00e1van\u00e9ho na procesor a\u017e na \u00farovne, ktor\u00e9 sp\u00f4sobuj\u00fa po\u0161kodenie \u010dipu. Rozhranie PMBus sa zvy\u010dajne realizuje v module VRM (Voltage Regulator Module), k ktor\u00e9mu je mo\u017en\u00e9 z\u00edska\u0165 pr\u00edstup prostredn\u00edctvom manipul\u00e1cie s BMC ovl\u00e1da\u010dom. Na vykonanie \u00fatoku na dosky podporuj\u00face PMBus je okrem administr\u00e1torsk\u00fdch pr\u00e1v v opera\u010dnom syst\u00e9me potrebn\u00fd aj softv\u00e9rov\u00fd pr\u00edstup k BMC (Baseboard Management Controller), napr\u00edklad prostredn\u00edctvom rozhrania IPMI KCS (Keyboard Controller Style), cez Ethernet alebo prostredn\u00edctvom preflashovania BMC z aktu\u00e1lneho syst\u00e9mu. <\/p>\n

Existencia probl\u00e9mu, ktor\u00fd umo\u017e\u0148uje \u00fatok bez znalosti autentifika\u010dn\u00fdch parametrov v BMC, bola potvrden\u00e1 na z\u00e1kladn\u00fdch dosk\u00e1ch Supermicro podporuj\u00facich IPMI (X11, X12, H11 a H12) a ASRock, ale zranite\u013enosti s\u00fa takisto pr\u00edtomn\u00e9 aj na in\u00fdch serverov\u00fdch dosk\u00e1ch, na ktor\u00fdch je mo\u017en\u00e9 z\u00edska\u0165 pr\u00edstup k PMBus. V priebehu uskuto\u010dnen\u00fdch experimentov, pri zv\u00fd\u0161en\u00ed nap\u00e4tia na 2.84 volty, bolo na t\u00fdchto dosk\u00e1ch po\u0161koden\u00fdch dva procesory Intel Xeon. Na pr\u00edstup k BMC bez znalosti autentifika\u010dn\u00fdch parametrov, ale s root pr\u00edstupom k opera\u010dn\u00e9mu syst\u00e9mu, bola vyu\u017eit\u00e1 zranite\u013enos\u0165 v mechanizme verifik\u00e1cie firmv\u00e9ru, ktor\u00e1 umo\u017enila nahranie upraven\u00e9ho aktualiza\u010dn\u00e9ho s\u00faboru do BMC ovl\u00e1da\u010da, ako aj mo\u017enos\u0165 neautentifikovan\u00e9ho pr\u00edstupu cez IPMI KCS. <\/p>\n

Met\u00f3da zmeny nap\u00e4tia cez PMBus sa m\u00f4\u017ee tie\u017e pou\u017ei\u0165 na vykonanie \u00fatoku Plundervolt, ktor\u00fd umo\u017e\u0148uje po\u0161kodi\u0165 obsah buniek s \u00fadajmi v CPU zn\u00ed\u017een\u00edm nap\u00e4tia na minim\u00e1lne hodnoty po\u010das v\u00fdpo\u010dtov v izolovan\u00fdch enkl\u00e1vach Intel SGX a generova\u0165 chyby v p\u00f4vodne spr\u00e1vnych algoritmoch. Napr\u00edklad, ak sa podar\u00ed zmeni\u0165 hodnotu pou\u017e\u00edvan\u00fa pri n\u00e1soben\u00ed v procese \u0161ifrovania, v\u00fdstupom bude nespr\u00e1vny \u0161ifrovan\u00fd text. Ak m\u00e1 \u00fato\u010dn\u00edk schopnos\u0165 pristupova\u0165 k spracovate\u013eovi v SGX pre \u0161ifrovanie svojich \u00fadajov, m\u00f4\u017ee pomocou sp\u00f4sobovania ch\u00fdb zhroma\u017edi\u0165 \u0161tatistiku o zmene \u0161ifrovan\u00e9ho textu na v\u00fdstupe a obnovi\u0165 hodnotu k\u013e\u00fa\u010da ulo\u017een\u00e9ho v enkl\u00e1ve SGX. <\/p>\n

N\u00e1stroje na vykonanie \u00fatoku na dosky Supermicro a ASRock, ako aj utilita na overenie pr\u00edstupu k PMBus, s\u00fa zverejnen\u00e9 na GitHub.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PMFault, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0435\u0442 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043d\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok PMFault, ktor\u00fd umo\u017e\u0148uje zlyhanie CPU v niektor\u00fdch serverov\u00fdch syst\u00e9moch | ProHoster","description":"V\u00fdskumn\u00edci z Birmingham University, ktor\u00ed s\u00fa zn\u00e1mi v\u00fdvojom \u00fatokov Plundervolt a VoltPillager, identifikovali zranite\u013enos\u0165 (CVE-2022-43309) v niektor\u00fdch serverov\u00fdch z\u00e1kladn\u00fdch dosk\u00e1ch, ktor\u00e1 umo\u017e\u0148uje fyzick\u00e9 naru\u0161enie.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 PMFault, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f CPU \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0411\u0438\u0440\u043c\u0438\u043d\u0433\u0435\u043c\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a Plundervolt \u0438 VoltPillager, \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-43309) \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-05-16T22:48:11+00:00","article:modified_time":"2023-05-17T08:40:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/108554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=108554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/108554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=108554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=108554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=108554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}