{"id":160597,"date":"2026-02-11T17:11:57","date_gmt":"2026-02-11T15:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-pozvolyayushhaya-obojti-mehanizm-zashhity-intel-tdx"},"modified":"2026-02-11T17:11:57","modified_gmt":"2026-02-11T15:11:57","slug":"uyazvimost-pozvolyayushhaya-obojti-mehanizm-zashhity-intel-tdx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-pozvolyayushhaya-obojti-mehanizm-zashhity-intel-tdx","title":{"rendered":"Zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 bezpe\u010dnostn\u00fd mechanizmus Intel TDX","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnosti Google a Intel zverejnili v\u00fdsledky (PDF) spolo\u010dnej pr\u00e1ce na audite bezpe\u010dnosti mechanizmu Intel TDX 1.5 (Trusted Domain Extensions). Technol\u00f3gia Intel TDX umo\u017e\u0148uje \u0161ifrovanie pam\u00e4te virtu\u00e1lnych strojov, \u010d\u00edm chr\u00e1ni pred z\u00e1sahmi a anal\u00fdzou zo strany administr\u00e1tora hostite\u013esk\u00e9ho syst\u00e9mu, ako aj pred fyzick\u00fdmi \u00fatokmi na hardv\u00e9r. V r\u00e1mci auditu bolo odhalen\u00fdch 6 zranite\u013enost\u00ed a 35 bezpe\u010dnostn\u00fdch ch\u00fdb, ktor\u00e9 nemaj\u00fa vplyv auf bezpe\u010dnos\u0165. <\/p>\n

Probl\u00e9my sa t\u00fdkaj\u00fa CPU Intel Xeon 6, ako aj procesorov 4. a 5. gener\u00e1cie Intel Xeon Scalable. Zranite\u013enosti boli odstr\u00e1nen\u00e9 v\u010dera v aktualiz\u00e1cii mikrocode. Na GitHub-e bol zverejnen\u00fd n\u00e1stroj na exploit\u00e1ciu zranite\u013enost\u00ed v Intel TDX a prototypy exploitov pre dve zranite\u013enosti (CVE-2025-30513, CVE-2025-32007). <\/p>\n

Najnebezpe\u010dnej\u0161ia zranite\u013enos\u0165 (CVE-2025-30513) umo\u017e\u0148uje ned\u00f4veryhodn\u00e9mu administr\u00e1torovi, ktor\u00fd m\u00e1 pr\u00edstup k hostite\u013esk\u00e9mu syst\u00e9mu, zv\u00fd\u0161i\u0165 svoje opr\u00e1vnenia a \u00faplne skompromitova\u0165 bezpe\u010dnostn\u00e9 z\u00e1ruky, ktor\u00e9 poskytuje technol\u00f3gia Intel TDX. Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 s\u00fa\u0165a\u017eou v jednom z modulov TDX, ktor\u00e1 umo\u017e\u0148uje po\u010das migr\u00e1cie virtu\u00e1lnych strojov prenies\u0165 zabezpe\u010den\u00e9 prostredie (TD \u2014 Trusted Domain) z stavu podporuj\u00faceho migr\u00e1ciu do stavu, ktor\u00fd umo\u017e\u0148uje prechod do ladacieho re\u017eimu. <\/p>\n

Probl\u00e9m je sp\u00f4soben\u00fd mo\u017enos\u0165ou zmeny atrib\u00fatov prostredia v okamihu po ich overen\u00ed, ale pred ich prenesen\u00edm do nemenn\u00e9ho stavu v presunutom prostred\u00ed. Po stanoven\u00ed ladic\u00edho atrib\u00fatu m\u00f4\u017ee administr\u00e1tor hostite\u013esk\u00e9ho syst\u00e9mu v re\u00e1lnom \u010dase sledova\u0165 \u010dinnos\u0165 chr\u00e1nen\u00e9ho hos\u0165uj\u00faceho syst\u00e9mu a z\u00edska\u0165 pr\u00edstup k de\u0161ifrovanej pam\u00e4ti. <\/p>\n

Zranite\u013enos\u0165 je dostato\u010dne jednoduch\u00e1 na exploit\u00e1ciu, preto\u017ee administr\u00e1tor m\u00f4\u017ee kedyko\u013evek iniciova\u0165 proces live-migr\u00e1cie chr\u00e1nen\u00e9ho virtu\u00e1lneho stroja. Probl\u00e9m bol identifikovan\u00fd v\u00fdskumn\u00edkmi z firmy Google, ktor\u00ed pri sk\u00faman\u00ed API venovali pozornos\u0165 nezrovnalosti medzi t\u00fdm, ako sa v FSM (Finite State Machine) sleduje stav oper\u00e1ci\u00ed, spracov\u00e1va preru\u0161enie oper\u00e1cie importu a men\u00ed, ale nevracia do p\u00f4vodn\u00e9ho stavu po zlyhan\u00ed, stav chr\u00e1nen\u00e9ho prostredia. <\/p>\n

Menej nebezpe\u010dn\u00e9 zranite\u013enosti: <\/p>\n