{"id":119301,"date":"2024-08-10T09:43:01","date_gmt":"2024-08-10T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm"},"modified":"2024-08-10T09:43:01","modified_gmt":"2024-08-10T07:43:01","slug":"sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm","title":{"rendered":"Sinkclose \u2014 zranite\u013enos\u0165 v CPU AMD, ktor\u00e1 umo\u017e\u0148uje pr\u00edstup k SMM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vedci zo spolo\u010dnosti IOActive odhalili zranite\u013enos\u0165 (CVE-2023-31315) v procesoroch AMD, ktor\u00e1 umo\u017e\u0148uje pri privil\u00e9govanom lok\u00e1lnom pr\u00edstupe k syst\u00e9mu zmeni\u0165 konfigur\u00e1ciu SMM (System Management Mode, Ring -2), aj ke\u010f je zapnut\u00fd mechanizmus blokovania SMM (SMM Lock), a potenci\u00e1lne tak d\u00e1va mo\u017enos\u0165 na vykonanie k\u00f3du na \u00farovni SMM. \u00darove\u0148 SMM, ktor\u00e1 m\u00e1 vy\u0161\u0161\u00ed prioritu ako hyperv\u00edzor a nulov\u00fd ochrann\u00fd kruh, umo\u017e\u0148uje neobmedzen\u00fd pr\u00edstup k celej syst\u00e9movej pam\u00e4ti a m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 na kontrolu opera\u010dn\u00e9ho syst\u00e9mu. <\/p>\n

Zranite\u013enos\u0165, ktor\u00e1 z\u00edskala k\u00f3dov\u00e9 meno Sinkclose, je sp\u00f4soben\u00e1 nespr\u00e1vnou kontrolou registrov z\u00e1visl\u00fdch od modelu (MSR, Model Specific Register). Pre SMM je vyhraden\u00e1 oblas\u0165 fyzick\u00fdch str\u00e1nok pam\u00e4te, ku ktorej je na \u00farovni pam\u00e4\u0165ov\u00e9ho kontrol\u00e9ra blokovan\u00fd pr\u00edstup. Odhalen\u00e1 zranite\u013enos\u0165 umo\u017e\u0148uje ob\u00eds\u0165 toto blokovanie prostredn\u00edctvom manipul\u00e1cie s ur\u010dit\u00fdmi registrom MSR, do ktor\u00fdch nebola zak\u00e1zan\u00e1 z\u00e1pis aj napriek zapnutiu re\u017eimu SMM Lock. <\/p>\n

Exploat\u00e1cia zranite\u013enosti m\u00f4\u017ee by\u0165 uskuto\u010dnen\u00e1 z nulov\u00e9ho ochrann\u00e9ho kruhu, na ktorom be\u017e\u00ed jadro opera\u010dn\u00e9ho syst\u00e9mu, a m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 napr\u00edklad na uchov\u00e1vanie vlastnej pr\u00edtomnosti po exploat\u00e1cii in\u00fdch zranite\u013enost\u00ed v syst\u00e9me alebo aplikovan\u00ed met\u00f3d soci\u00e1lneho in\u017einierstva. Opera\u010dn\u00fd syst\u00e9m nem\u00e1 mo\u017enos\u0165 sledova\u0165 a kontrolova\u0165 vykon\u00e1vanie k\u00f3du na \u00farovni SMM, \u010do m\u00f4\u017ee by\u0165 vyu\u017eit\u00e9 na modifik\u00e1ciu firmv\u00e9rov a umiestnenie skryt\u00e9ho \u0161kodliv\u00e9ho k\u00f3du alebo rootkitov, ktor\u00e9 nie s\u00fa detekovan\u00e9 opera\u010dn\u00fdm syst\u00e9mom, ako aj na deaktiv\u00e1ciu overovania v \u0161t\u00e1diu zav\u00e1dzania a \u00fatoky na hyperv\u00edzory na ob\u00eddenie mechanizmov kontroly integrity virtu\u00e1lnych prostred\u00ed. <\/p>\n

Zranite\u013enos\u0165 sa prejavuje prakticky vo v\u0161etk\u00fdch \u010dipoch AMD vydan\u00fdch od roku 2006, vr\u00e1tane s\u00e9ri\u00ed procesorov AMD EPYC (1-4. gener\u00e1cia), Ryzen (R1000, R2000, 3000-8000, V1000, V2000, V3000), Athlon 3000 a Threadripper PRO. Aktualiz\u00e1cie mikroprogramu na blokovanie zranite\u013enosti u\u017e boli vydan\u00e9 pre mobiln\u00e9 a desktopov\u00e9 s\u00e9rie CPU EPYC a Ryzen. Pre vstavan\u00e9 modely CPU je pl\u00e1novan\u00e9 vydanie aktualiz\u00e1cie v okt\u00f3bri. Jedin\u00fdm sp\u00f4sobom, ako odstr\u00e1ni\u0165 \u0161kodliv\u00fd k\u00f3d implantovan\u00fd cez \u00fatok na SMM, je vymazanie pam\u00e4te pomocou fyzik\u00e1lne pripojen\u00e9ho program\u00e1tora SPI Flash.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 IOActive \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-31315) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e SMM (System Management Mode, Ring -2), \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 SMM (SMM Lock), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 SMM. \u0423\u0440\u043e\u0432\u0435\u043d\u044c SMM, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442, \u0447\u0435\u043c \u0440\u0435\u0436\u0438\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119301","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sinkclose \u2014 zranite\u013enos\u0165 v CPU AMD, ktor\u00e1 umo\u017e\u0148uje z\u00edska\u0165 pr\u00edstup k SMM | ProHoster","description":"Vedci zo spolo\u010dnosti IOActive identifikovali zranite\u013enos\u0165 (CVE-2023-31315) v procesoroch AMD, ktor\u00e1 pri privilegovanom miestnom pr\u00edstupe k syst\u00e9mu umo\u017e\u0148uje zmeni\u0165 konfigur\u00e1ciu SMM (System Management Mode, Ring.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Sinkclose \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a SMM | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 IOActive \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-31315) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e SMM (System Management Mode, Ring.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-10T07:43:01+00:00","article:modified_time":"2024-08-10T07:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119301","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:43:19","updated":"2026-01-23 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/119301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=119301"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/119301\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=119301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=119301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=119301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}