Spolo\u010dnos\u0165 AMD zaradila procesory zalo\u017een\u00e9 na mikroarchitekt\u00fare Zen 5 do zoznamu produktov postihnut\u00fdch zranite\u013enos\u0165ou EntrySign, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 mechanizmus overovania digit\u00e1lneho podpisu pri aktualiz\u00e1cii mikrok\u00f3du. P\u00f4vodne sa predpokladalo, \u017ee zranite\u013enos\u0165 sa t\u00fdka iba CPU AMD na b\u00e1ze 1-4 gener\u00e1ci\u00ed mikroarchitekt\u00fary Zen. Takto sa zranite\u013enos\u0165 uk\u00e1zala ako relevantn\u00e1 aj pre procesory ako Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen AI 300 (Strix Halo, Strix Point, Krackan Point) a Ryzen 9000HX (Fire Range). <\/p>\n
Okrem aktualiz\u00e1cie mikrok\u00f3du je na odstr\u00e1nenie zranite\u013enosti v syst\u00e9moch vyu\u017e\u00edvaj\u00facich overovanie SEV-SNP tie\u017e potrebn\u00e1 aktualiz\u00e1cia firmv\u00e9ru AMD SEV, ktor\u00fd je s\u00fa\u010das\u0165ou aktualiz\u00e1ci\u00ed BIOS. Tvrd\u00ed sa, \u017ee spolo\u010dnos\u0165 AMD poskytla v\u00fdrobcov hardv\u00e9ru upraven\u00fd firmv\u00e9r (ComboAM5PI 1.2.0.3c AGESA), ktor\u00fd je potrebn\u00fd na vyrie\u0161enie probl\u00e9mu, ale dostupn\u00e9 kone\u010dn\u00e9 aktualiz\u00e1cie BIOS pre z\u00e1kazn\u00edkov m\u00f4\u017eu by\u0165 vydan\u00e9 v\u00fdrobcami a\u017e o nieko\u013eko t\u00fd\u017ed\u0148ov alebo mesiacov. <\/p>\n
Zamestnanci AMD navrhli aj zaradenie z\u00e1platy do jadra Linux, ktor\u00e1 blokuje na\u010d\u00edtanie neofici\u00e1lnych aktualiz\u00e1ci\u00ed mikrok\u00f3du (uv\u00e1dza sa, \u017ee spr\u00e1vne aktualiz\u00e1cie mikrok\u00f3du je potrebn\u00e9 nain\u0161talova\u0165 spolu s BIOS v\u00fdrobcu hardv\u00e9ru, av\u0161ak u\u017e existuj\u00fa pokusy o vytvorenie neofici\u00e1lnych opr\u00e1v, zalo\u017een\u00fdch na fragmentoch mikrok\u00f3du vyrezan\u00fdch z BIOS). Pou\u017e\u00edvate\u013eom sa odpor\u00fa\u010da po\u010dka\u0165 na ofici\u00e1lne aktualiz\u00e1cie BIOS. <\/p>\n
Mo\u017enos\u0165 modifik\u00e1cie mikrok\u00f3du poskytovan\u00e1 zranite\u013enos\u0165ou EntrySign umo\u017e\u0148uje skompromitova\u0165 mechanizmus AMD SEV (Secure Encrypted Virtualization), pou\u017e\u00edvan\u00fd v syst\u00e9moch virtualiz\u00e1cie na ochranu virtu\u00e1ln\u00edch stroj\u016f<\/a> pred z\u00e1sahmi hyperv\u00edzora alebo spr\u00e1vcu hostite\u013esk\u00e9ho syst\u00e9mu. Po\u010das \u00fatoku je mo\u017en\u00e9 zasiahnu\u0165 do fungovania hosten\u00fdch syst\u00e9mov, chr\u00e1nen\u00fdch pomocou roz\u0161\u00edren\u00ed AMD SEV (Secure Encrypted Virtualization) a SEV-SNP (Secure Nested Paging), poskytuj\u00facich z\u00e1ruky integrity pam\u00e4te virtu\u00e1lnych strojov, izoluj\u00facich procesorov\u00e9 registry a zabezpe\u010duj\u00facich bezpe\u010dn\u00fa pr\u00e1cu s vnoren\u00fdmi tabu\u013ekami str\u00e1nok pam\u00e4te. <\/p>\n Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 pou\u017eit\u00edm pri verifik\u00e1cii mikrok\u00f3du algoritmu autentiz\u00e1cie CMAC namiesto spo\u013eahlivej hash funkcie. Spolo\u010dnos\u0165 AMD pou\u017e\u00edva uzavret\u00fd k\u013e\u00fa\u010d RSA na podpisovanie mikrok\u00f3du nahr\u00e1van\u00e9ho do procesora digit\u00e1lnym podpisom a v r\u00e1mci patchu s mikrok\u00f3dom distribuuje otvoren\u00fd k\u013e\u00fa\u010d. Na overenie toho, \u017ee otvoren\u00fd k\u013e\u00fa\u010d je v s\u00falade s origin\u00e1lnym p\u00e1rom RSA k\u013e\u00fa\u010dov, procesor vykon\u00e1va porovnanie hash hodnoty otvoren\u00e9ho k\u013e\u00fa\u010da AMD, zabudovanej po\u010das v\u00fdroby do CPU, s hash hodnotou otvoren\u00e9ho k\u013e\u00fa\u010da uveden\u00e9ho v patchi. <\/p>\n Autentifik\u00e1cia mikrok\u00f3du v patchi sa vykon\u00e1va porovnan\u00edm dod\u00e1van\u00e9ho ha\u0161u, ktor\u00fd je podp\u00edsan\u00fd digit\u00e1lnym podpisom (RSASSA-PKCS1-v1_5), a ha\u0161u vypo\u010d\u00edtan\u00e9ho na z\u00e1klade skuto\u010dne dod\u00e1van\u00e9ho mikrok\u00f3du v patchi. Ak sa referen\u010dn\u00fd a vypo\u010d\u00edtan\u00fd ha\u0161 zhoduj\u00fa \u2014 patch sa nahr\u00e1va do vn\u00fatornej pam\u00e4te CPU. Probl\u00e9m je v tom, \u017ee namiesto odpor\u00fa\u010dan\u00fdch kryptograficky bezpe\u010dn\u00fdch ha\u0161ovac\u00edch funkci\u00ed bol pou\u017eit\u00fd algoritmus CMAC, ktor\u00fd nie je ur\u010den\u00fd na tak\u00e9to oper\u00e1cie a nie je chr\u00e1nen\u00fd pred \u00fanikom kol\u00edzi\u00ed. <\/p>\n CMAC nie je hash funkciou, ale implementuje autentiza\u010dn\u00fd k\u00f3d (Message Authentication Code), ktor\u00fd z\u00e1vis\u00ed od \u0161ifrovacieho k\u013e\u00fa\u010da. Pr\u00e1ca AES-CMAC spo\u010d\u00edva v pou\u017eit\u00ed kryptografick\u00e9ho algoritmu AES a kombinovan\u00ed v\u00fdsledku jeho aplik\u00e1cie s nasleduj\u00facim blokom d\u00e1t pomocou oper\u00e1cie XOR. Tak\u00e1to sch\u00e9ma zaru\u010duje, \u017ee zmena vstupn\u00fdch \u00fadajov povedie k nepredv\u00eddate\u013enej zmene v\u00fdstupn\u00fdch \u00fadajov. CMAC sa v\u0161ak ned\u00e1 pou\u017ei\u0165 ako hash funkcia, preto\u017ee ktoko\u013evek, kto pozn\u00e1 p\u00f4vodn\u00fd \u0161ifrovac\u00ed k\u013e\u00fa\u010d, m\u00f4\u017ee odhali\u0165 medzi\u010dasy \u0161ifrovania a vypo\u010d\u00edta\u0165 hodnoty, ktor\u00e9 dok\u00e1\u017eu kompenzova\u0165 zmeny vo vstupn\u00fdch \u00fadajoch tak, \u017ee v\u00fdsledok aplik\u00e1cie CMAC ostane nezmenen\u00fd. <\/p>\n AMD pou\u017e\u00edva pre AES-CMAC jedin\u00fd \u0161ifrovac\u00ed k\u013e\u00fa\u010d dod\u00e1van\u00fd na v\u0161etk\u00fdch CPU, po\u010dn\u00fac Zen 1. T\u00fdmto sp\u00f4sobom sta\u010d\u00ed z\u00edska\u0165 tento k\u013e\u00fa\u010d z ak\u00e9hoko\u013evek CPU AMD a bude aplikovate\u013en\u00fd na v\u0161etky ostatn\u00e9 CPU. V\u00fdskumn\u00edci zistili, \u017ee pre AES-CMAC \u0161ifrovanie v AMD bol pou\u017eit\u00fd zn\u00e1my k\u013e\u00fa\u010d, z\u00edskan\u00fd z pr\u00edkladu uveden\u00e9ho v odpor\u00fa\u010daniach na pou\u017e\u00edvanie blokov\u00fdch \u0161ifrov NIST SP 800-38B. Ke\u010f\u017ee AES-CMAC sa pou\u017e\u00edva na hashovanie vlo\u017een\u00e9ho RSA k\u013e\u00fa\u010da a obsahu mikrok\u00f3du, ur\u010den\u00edm \u0161ifrovacieho k\u013e\u00fa\u010da AES-CMAC vznikla mo\u017enos\u0165 n\u00e1hrady v patchi za in\u00fd verejn\u00fd RSA k\u013e\u00fa\u010d a zmeny obsahu mikrok\u00f3du. <\/p>\n Na vytvorenie falo\u0161n\u00e9ho patchu sta\u010d\u00ed vytvori\u0165 nov\u00fd verejn\u00fd k\u013e\u00fa\u010d generuj\u00faci ten ist\u00fd hash, ak\u00fd generoval p\u00f4vodn\u00fd verejn\u00fd k\u013e\u00fa\u010d AMD, a tie\u017e n\u00e1js\u0165 kol\u00edzie pre digit\u00e1lny podpis. Kol\u00edzie sa vytv\u00e1raj\u00fa pripojen\u00edm k mikrok\u00f3du pr\u00eddavn\u00e9ho bloku, ktor\u00fd vyzer\u00e1 ako s\u00fabor n\u00e1hodn\u00fdch \u00fadajov. Tak\u00fdmto sp\u00f4sobom je mo\u017en\u00e9 pripravi\u0165 upraven\u00fd patch s mikrok\u00f3dom, ktor\u00fd zodpoved\u00e1 digit\u00e1lnemu podpisu, ktor\u00fdm bol potvrden\u00fd p\u00f4vodn\u00fd patch od AMD. N\u00e1strojov\u00fd s\u00fabor Zentool, ktor\u00fd obsahuje n\u00e1stroje na anal\u00fdzu mikrok\u00f3du a vytv\u00e1ranie patchov pre zmenu mikrok\u00f3du, je dostupn\u00fd pod licenciou Apache 2.0. Na nahradenie mikrok\u00f3du je potrebn\u00e9 ma\u0165 pr\u00e1va na vykon\u00e1vanie k\u00f3du na \u00farovni nulov\u00e9ho ochrann\u00e9ho kruhu (technol\u00f3gie VT-x a AMD-V umo\u017e\u0148uj\u00fa hos\u0165uj\u00facemu syst\u00e9mu vykon\u00e1va\u0165 s pr\u00e1vami Ring 0). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e CPU AMD \u043d\u0430 \u0431\u0430\u0437\u0435 1-4 \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u0430 \u043a \u0442\u0430\u043a\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c, \u043a\u0430\u043a Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123472","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47CPU AMD Zen 5 s\u00fa n\u00e1chyln\u00e9 na zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje zmenu mikrok\u00f3du a ob\u00eddenie izol\u00e1cie SEV-SNP | ProHoster","description":"Spolo\u010dnos\u0165 AMD zahrnula procesory zalo\u017een\u00e9 na mikroarchitekt\u00fare Zen 5 do zoznamu produktov, ktor\u00e9 s\u00fa n\u00e1chyln\u00e9 na zranite\u013enos\u0165 EntrySign, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 mechanizmus kontroly digit\u00e1lneho podpisu pri aktualiz\u00e1cii mikrok\u00f3du.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CPU AMD Zen 5 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0445\u043e\u0434 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 SEV-SNP | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-11T13:05:18+00:00","article:modified_time":"2025-04-11T13:05:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123472","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:44:58","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:10:19","updated":"2026-02-09 17:44:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/123472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=123472"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/123472\/revisions"}],"predecessor-version":[{"id":159262,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/123472\/revisions\/159262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=123472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=123472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=123472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"