{"id":138893,"date":"2025-07-09T23:11:55","date_gmt":"2025-07-09T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd"},"modified":"2025-07-09T23:11:55","modified_gmt":"2025-07-09T21:11:55","slug":"ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd","title":{"rendered":"\u00datok TSA, ved\u00faci k \u00faniku inform\u00e1ci\u00ed z mikroarchitektonick\u00fdch \u0161trukt\u00far CPU AMD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Spolo\u010dnos\u0165 AMD zverejnila inform\u00e1cie o novej triede mikroarchitektonick\u00fdch \u00fatokov na svoje procesory \u2013 TSA (Transient Scheduler Attack). Tento \u00fatok umo\u017e\u0148uje \u00fato\u010dn\u00edkovi ob\u00eds\u0165 mechanizmy izol\u00e1cie CPU a ur\u010di\u0165 d\u00e1ta spracov\u00e1van\u00e9 v in\u00fdch kontextoch, napr\u00edklad z priestoru pou\u017e\u00edvate\u013ea z\u00edska\u0165 inform\u00e1cie spracov\u00e1van\u00e9 na \u00farovni jadra, alebo z hos\u0165ovskej syst\u00e9my zisti\u0165 d\u00e1ta, ktor\u00e9 pou\u017e\u00edvaj\u00fa in\u00e9 hos\u0165ovsk\u00e9 syst\u00e9my. <\/p>\n
Zranite\u013enosti boli zisten\u00e9 po\u010das v\u00fdvoja n\u00e1stroja, ktor\u00fd vytvorili v\u00fdskumn\u00edci z Microsoftu a \u0160vaj\u010diarskej technickej vysok\u00e9 \u0161koly v Curychu na stresov\u00e9 testovanie mikroarchitektonickej izol\u00e1cie medzi r\u00f4znymi z\u00f3nami pr\u00edstupu, ako s\u00fa jadro, virtu\u00e1lne stroje a procesy. <\/p>\n
Met\u00f3da \u00fatoku je zalo\u017een\u00e1 na z\u00e1vislosti \u010dasu vykonania niektor\u00fdch in\u0161trukci\u00ed od stavu mikroarchitektonick\u00fdch \u0161trukt\u00far. Ke\u010f procesor o\u010dak\u00e1va r\u00fdchle dokon\u010denie in\u0161trukcie \u010d\u00edtania d\u00e1t z pam\u00e4te (napr\u00edklad predpokladaj\u00fac, \u017ee d\u00e1ta s\u00fa v L1 cache), ale nedar\u00ed sa mu \u00faspe\u0161ne z\u00edska\u0165 d\u00e1ta, vznik\u00e1 stav \u201efalo\u0161n\u00e9ho dokon\u010denia\u201c in\u0161trukcie (false completion). V tejto chv\u00edli procesor m\u00f4\u017ee e\u0161te pred ur\u010den\u00edm tohto stavu napl\u00e1nova\u0165 \u0161pekulat\u00edvne vykonanie in\u00fdch oper\u00e1ci\u00ed z\u00e1visl\u00fdch od v\u00fdsledku vykonania in\u0161trukcie na\u010d\u00edtania z pam\u00e4te. <\/p>\n
Ke\u010f\u017ee na\u010d\u00edtanie sa uk\u00e1zalo ako nedokon\u010den\u00e9, procesor uzn\u00e1va s \u0148ou spojen\u00e9 d\u00e1ta za neplatn\u00e9 a oper\u00e1cia na\u010d\u00edtania sa nesk\u00f4r opakuje znova. Z\u00e1visl\u00e9 oper\u00e1cie sa tie\u017e op\u00e4\u0165 vykon\u00e1vaj\u00fa po pripravenosti spr\u00e1vnych d\u00e1t. Pri tom ned\u00f4jde k vypr\u00e1zdneniu r\u00farkov\u00e9ho (pipeline flush) po vykonan\u00ed in\u0161trukcie, pre ktor\u00fa bolo zaznamenan\u00e9 \u201efalo\u0161n\u00e9 dokon\u010denie\u201c, a nespr\u00e1vne d\u00e1ta m\u00f4\u017eu by\u0165 presmerovan\u00e9 do z\u00e1visl\u00fdch oper\u00e1ci\u00ed. <\/p>\n
Vykon\u00e1vanie tak\u00fdchto oper\u00e1ci\u00ed nem\u011bn\u00ed stav cache a TLB (Translation Lookaside Buffer), t.j. d\u00e1ta nemo\u017eno obnovi\u0165 tradi\u010dn\u00fdmi met\u00f3dami ur\u010dovania stavu cache. Ale tieto d\u00e1ta ovplyv\u0148uj\u00fa \u010das vykonania in\u00fdch in\u0161trukci\u00ed. Anal\u00fdza \u010dasu vykonania m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 ako zdroj \u00faniku inform\u00e1ci\u00ed z mikroarchitektonick\u00fdch \u0161trukt\u00far, ktor\u00e9 zostali po \u0161pekulat\u00edvnom vykon\u00e1van\u00ed in\u00fdch oper\u00e1ci\u00ed. <\/p>\n
V z\u00e1vislosti od zdroja extrakcie zvy\u0161kov\u00fdch d\u00e1t boli zisten\u00e9 dve zranite\u013enosti: <\/p>\n
\n
CVE-2024-36350 (TSA-SQ \u2013 TSA Store Queue) \u2013 \u00fanik z vyrovn\u00e1vacej pam\u00e4te do\u010dasn\u00fdch oper\u00e1ci\u00ed z\u00e1pisu (Store Queue), umo\u017e\u0148uj\u00faci zisti\u0165 v\u00fdsledok vykon\u00e1vania in\u0161trukci\u00ed z\u00e1pisu do pam\u00e4te.\n
Zranite\u013enosti sa vyskytuj\u00fa v rodin\u00e1ch procesorov AMD (Fam19h) na b\u00e1ze mikroarchitekt\u00far Zen 3 a Zen 4. Probl\u00e9m sa vyskytuje napr\u00edklad v s\u00e9ri\u00e1ch CPU AMD Ryzen 5000\/6000\/7000\/8000, AMD EPYC Milan\/Milan-X\/Genoa\/Genoa-X\/Bergamo\/Siena, AMD Instinct MI300A, AMD Ryzen Threadripper PRO 7000 WX, AMD EPYC Embedded 7003\/8004\/9004\/97X4, AMD Ryzen Embedded 5000\/7000\/V3000. <\/p>\n
Nezbytn\u00e9 zmeny potrebn\u00e9 na zablokovanie zranite\u013enosti s\u00fa zahrnut\u00e9 v decembrovej aktualiz\u00e1cii mikrok\u00f3du a PI firmv\u00e9ru (Platform Initialization), zaslan\u00fdch OEM v\u00fdrobcami. Opravy na ochranu pred zranite\u013enos\u0165ou boli zaslan\u00e9 na za\u010dlenenie do jadra Linux (pre vypnutie ochrany, ktor\u00e1 negat\u00edvne ovplyv\u0148uje v\u00fdkon, je k dispoz\u00edcii mo\u017enos\u0165 pr\u00edkazov\u00e9ho riadku jadra \u201etsa=off\u201c). Oprava bola tie\u017e pridan\u00e1 do hyperv\u00edzora Xen. Na zablokovanie zranite\u013enosti sa vy\u017eaduje s\u00fa\u010dasne ako aktualiz\u00e1cia mikrok\u00f3du, tak aj aktiv\u00e1cia re\u017eimu ochrany na \u00farovni jadra alebo hyperv\u00edzora. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"