{"id":182817,"date":"2026-08-10T19:49:35","date_gmt":"2026-08-10T17:49:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2"},"modified":"2026-08-10T19:49:35","modified_gmt":"2026-08-10T17:49:35","slug":"tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","title":{"rendered":"TONTOU \u2014 \u00fatok na CPU Intel a AMD, ktor\u00fd umo\u017e\u0148uje ob\u00eds\u0165 ochranu pred zranite\u013enos\u0165ami Spectre v2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V\u00fdskumn\u00edci z Massachusettsk\u00e9ho technologick\u00e9ho in\u0161tit\u00fatu identifikovali techniku \u00fatoku TONTOU (Time-of-Neutralization to Time-of-Use), ktor\u00e1 pon\u00faka nov\u00fd sp\u00f4sob zneu\u017eitia mikroarchitektonick\u00fdch zranite\u013enost\u00ed triedy Spectre v2. Zranite\u013enos\u0165 umo\u017e\u0148uje ur\u010di\u0165 obsah pam\u00e4te jadra pri vykon\u00e1van\u00ed exploit v u\u017e\u00edvate\u013eskom priestore. K\u00f3d na blokovanie zneu\u017eitia zranite\u013enosti bol zahrnut\u00fd do jadra Linux 5. augusta a je s\u00fa\u010das\u0165ou vydan\u00ed 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214 a 5.10.263. <\/p>\n
V\u00fdskumn\u00edci predviedli mo\u017enos\u0165 uskuto\u010dni\u0165 \u00fatok lok\u00e1lnym nepriviligovan\u00fdm u\u017e\u00edvate\u013eom za \u00fa\u010delom ur\u010denia hash hesla u\u017e\u00edvate\u013ea root, ulo\u017een\u00e9ho v s\u00fabore \/etc\/shadow a na\u010d\u00edtan\u00e9ho do pam\u00e4te pri vykon\u00e1van\u00ed autentifik\u00e1cie v syst\u00e9me. V\u00fdskumn\u00edkom sa podarilo dosiahnu\u0165 \u00fanik \u00fadajov z pam\u00e4te jadra s v\u00fdkonom 5.47 bajtov za sekundu a presnos\u0165ou 91.97%. Z 10 testovac\u00edch spusten\u00ed exploitu, ktor\u00e9 v priemere trvali 18 min\u00fat, sa v polovici pr\u00edpadov podarilo \u00faspe\u0161ne ur\u010di\u0165 pr\u00edtomnos\u0165 s\u00faboru \/etc\/shadow v pam\u00e4ti a extrahova\u0165 jeho obsah. <\/p>\n
Exploit bol demon\u0161trovan\u00fd na syst\u00e9moch s procesormi AMD a m\u00f4\u017ee sa pou\u017ei\u0165 s CPU AMD rod\u00edn Zen 1-4. Na syst\u00e9moch Intel je \u00fatok tie\u017e uskuto\u010dnite\u013en\u00fd, ale zneu\u017eitie je zlo\u017eitej\u0161ie. Na ochranu pred prete\u010den\u00edm z\u00e1sobn\u00edka adries n\u00e1vratu a blokovan\u00edm zranite\u013enosti SRSO (Speculative Return Stack Overflow) v procesoroch AMD sa pou\u017e\u00edva ochrann\u00fd mechanizmus Safe-RET, ktor\u00fd \u010dist\u00ed buffer predpovedania prechodov po ka\u017edom pou\u017eit\u00ed a z\u00fa\u017ei okno vykonania \u00fatoku na 2 in\u0161trukcie vykon\u00e1van\u00e9 po\u010das nieko\u013ek\u00fdch desiatok nanosek\u00fand. <\/p>\n
Na ob\u00eddenie tejto ochrany a roz\u0161\u00edrenie okna \u00fatoku bola implementovan\u00e1 technika spomalenia CPU, ktor\u00e1 umo\u017enila vykona\u0165 substit\u00faciu preru\u0161enia v prav\u00fd \u010das a t\u00fdm presmerova\u0165 pr\u00fad vykon\u00e1vania v jadre a vyu\u017ei\u0165 handler preru\u0161enia na skreslenie z\u00e1znamu v bufferi predpovedania prechodov. Na vykonanie zranite\u013enosti SRSO m\u00f4\u017ee \u00fato\u010dn\u00edk vytvori\u0165 podmienky, za ktor\u00fdch blok predpovedania prechodov spekulat\u00edvne vykon\u00e1 ve\u013ek\u00e9 mno\u017estvo nespr\u00e1vne predpovedan\u00fdch volan\u00ed CALL, dostato\u010dn\u00e9 na preplnenie z\u00e1sobn\u00edka adries n\u00e1vratu a prep\u00edsanie spr\u00e1vne predpovedan\u00fdch bodov n\u00e1vratu umiestnen\u00fdch na za\u010diatku z\u00e1sobn\u00edka. V d\u00f4sledku toho m\u00f4\u017eu by\u0165 po\u010diato\u010dn\u00e9 prvky z\u00e1sobn\u00edka prep\u00edsan\u00e9 na hodnoty zvolen\u00e9 \u00fato\u010dn\u00edkom, \u010do n\u00e1sledne povedie k pou\u017eitiu t\u00fdchto nahraden\u00fdch hodn\u00f4t pri spekulat\u00edvnom vykon\u00e1van\u00ed in\u0161trukcie RET v kontexte in\u00e9ho procesu. <\/p>\n
Procesor ur\u010d\u00ed, \u017ee predpovedanie vetvenia nevy\u0161lo a vr\u00e1ti oper\u00e1ciu do p\u00f4vodn\u00e9ho stavu, ale \u00fadaje spracovan\u00e9 po\u010das spekulat\u00edvneho vykon\u00e1vania ostan\u00fa v cache a mikroarchitektonick\u00fdch buforoch. Ak chybne vykonan\u00fd blok pristupuje do pam\u00e4te, jeho spekulat\u00edvne vykon\u00e1vanie vedie k ulo\u017eeniu v spolo\u010dnej cache a \u00fadajoch pre\u010d\u00edtan\u00fdch z pam\u00e4te. Na extrakciu inform\u00e1ci\u00ed z cache m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 jedna z met\u00f3d ur\u010dovania obsahu cache na z\u00e1klade anal\u00fdzy zmien \u010dasu pr\u00edstupu k ke\u0161ovan\u00fdm a neke\u0161ovan\u00fdm \u00fadajom. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"