{"id":36892,"date":"2019-10-31T22:14:35","date_gmt":"2019-10-31T19:14:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu\/"},"modified":"2019-10-31T22:14:35","modified_gmt":"2019-10-31T19:14:35","slug":"swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","title":{"rendered":"SWAPGS \u2014 nov\u00e1 zranite\u013enos\u0165 v mechanizme \u0161pekulat\u00edvneho vykon\u00e1vania CPU","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdskumn\u00edci zo spolo\u010dnosti Bitdefender odhalili<\/a><\/noindex> nov\u00fa zranite\u013enos\u0165 (CVE-2019-1125<\/a><\/noindex>) v mechanizme \u0161pekulat\u00edvneho vykon\u00e1vania in\u0161trukci\u00ed modern\u00fdch CPU, ktor\u00e1 dostala n\u00e1zov SWAPGS, v s\u00falade s n\u00e1zvom procesorovej in\u0161trukcie, ktor\u00e1 probl\u00e9m sp\u00f4sobila. Zranite\u013enos\u0165 umo\u017e\u0148uje<\/a><\/noindex> umo\u017e\u0148uje neopr\u00e1vnen\u00e9mu \u00fato\u010dn\u00edkovi zisti\u0165 obsah oblast\u00ed pam\u00e4te jadra alebo spusten\u00fdch virtu\u00e1lnych strojov. Probl\u00e9m bol potvrden\u00fd<\/a><\/noindex> v procesoroch Intel (x86_64) a \u010diasto\u010dne t\u00fdka<\/noindex> v procesoroch AMD, pre ktor\u00e9 sa nezjavuje hlavn\u00fd vektor \u00fatoku. Predt\u00fdm implementovan\u00e9 met\u00f3dy proti zranite\u013enostiam Spectre a Meltdown nechr\u00e1nia pred \u00fatokom SWAPGS pri pou\u017e\u00edvan\u00ed procesorov Intel, ale pre Linux, ChromeOS, Android a Windows u\u017e boli navrhnut\u00e9 opravy.<\/p>\n

Zranite\u013enos\u0165 patr\u00ed do triedy Spectre v1 a zaklad\u00e1 sa na my\u0161lienke obnovy d\u00e1t z procesorovej cache, ktor\u00e9 zostali po \u0161pekulat\u00edvnom vykon\u00e1van\u00ed in\u0161trukci\u00ed. Bloky predpovedania prechodov modern\u00fdch CPU na zv\u00fd\u0161enie v\u00fdkonu pou\u017e\u00edvaj\u00fa predbe\u017en\u00e9 vykon\u00e1vanie ur\u010dit\u00fdch in\u0161trukci\u00ed, ktor\u00e9 pravdepodobne bud\u00fa vykonan\u00e9, ale ne\u010dakaj\u00fa na v\u00fdpo\u010det v\u0161etk\u00fdch faktorov, ktor\u00e9 ur\u010duj\u00fa ich vykonanie (napr\u00edklad ke\u010f e\u0161te neboli vypo\u010d\u00edtan\u00e9 podmienky prechodu alebo parametre pr\u00edstupu). Ak predpoklad nie je potvrden\u00fd, procesor zahod\u00ed v\u00fdsledok \u0161pekulat\u00edvneho vykon\u00e1vania, ale d\u00e1ta spracovan\u00e9 v jeho priebehu zost\u00e1vaj\u00fa v procesorovej cache a m\u00f4\u017eu by\u0165 obnoven\u00e9 pomocou met\u00f3d na ur\u010denie obsahu cache cez ved\u013eaj\u0161ie kan\u00e1ly, ktor\u00e9 analyzuj\u00fa zmenu \u010dasu pr\u00edstupu k vyrovn\u00e1vanej a nevyrovn\u00e1vanej pam\u00e4ti. <\/p>\n

Charakteristika nov\u00e9ho \u00fatoku spo\u010d\u00edva v vyu\u017e\u00edvan\u00ed \u00faniku, ktor\u00fd vznik\u00e1 po\u010das \u0161pekulat\u00edvneho vykon\u00e1vania in\u0161trukcie SWAPGS, ktor\u00e1 sa pou\u017e\u00edva v opera\u010dn\u00fdch syst\u00e9moch na nahradenie hodnoty registra GS pri prechode riadenia z u\u017e\u00edvate\u013esk\u00e9ho priestoru do jadra OS (pou\u017e\u00edvan\u00e1 hodnota GS v u\u017e\u00edvate\u013eskom priestore sa nahr\u00e1dza hodnotou pou\u017e\u00edvanou pri oper\u00e1ci\u00e1ch v jadre). V jadre Linuxu sa v GS uchov\u00e1va ukazovate\u013e per_cpu, ktor\u00fd sa pou\u017e\u00edva na pr\u00edstup k d\u00e1tam jadra, a v u\u017e\u00edvate\u013eskom priestore s\u00fa ukazovatele na TLS (Thread Local Storage). <\/p>\n

Aby sa zabr\u00e1nilo dvojit\u00e9mu vyvolaniu in\u0161trukcie SWAPGS pri opakovanom volan\u00ed jadra z priestoru jadra alebo ke\u010f sa vykon\u00e1va k\u00f3d, ktor\u00fd nevy\u017eaduje zmenu registra GS, pred in\u0161trukciou sa vykon\u00e1va kontrola a podmienen\u00fd prechod. Mechanizmus \u0161pekulat\u00edvneho vykon\u00e1vania prech\u00e1dza vopred k vykon\u00e1vaniu k\u00f3du s in\u0161trukciou SWAPGS, ani\u017e by \u010dakal na v\u00fdsledok kontroly, a ak zvolen\u00e1 vetva nie je potvrden\u00e1, ignoruje v\u00fdsledok. Tak sa m\u00f4\u017ee vyskytn\u00fa\u0165 situ\u00e1cia, kedy \u0161pekulat\u00edvne bude zvolen\u00e1 vetva, ktor\u00e1 nepredpoklad\u00e1 vykon\u00e1vanie SWAPGS, ale po\u010das \u0161pekulat\u00edvneho vykon\u00e1vania sa hodnota registra GS zmen\u00ed in\u0161trukciou SWAPGS a pou\u017eije sa v z\u00e1visl\u00fdch oper\u00e1ci\u00e1ch s pam\u00e4\u0165ou, ktor\u00e9 sa ukladaj\u00fa do CPU cache. <\/p>\n

V\u00fdskumn\u00edci navrhli dva scen\u00e1re \u00fatoku, pre ktor\u00e9 s\u00fa pripraven\u00e9 prototypy exploitov. Prv\u00fd scen\u00e1r vych\u00e1dza z situ\u00e1cie, ke\u010f sa in\u0161trukcia SWAPGS nevykon\u00e1va \u0161pekulat\u00edvne, hoci sa pou\u017e\u00edva pri skuto\u010dnom vykon\u00e1van\u00ed, a druh\u00fd \u2014 naopak, ke\u010f sa in\u0161trukcia SWAPGS vykon\u00e1va \u0161pekulat\u00edvne, hoci v skuto\u010dnosti by sa nemala. Pre ka\u017ed\u00fd scen\u00e1r s\u00fa predpokladan\u00e9 dva varianty exploit\u00e1cie: \u00fato\u010dn\u00edk m\u00f4\u017ee ur\u010di\u0165 hodnotu na konkr\u00e9tnej adrese v oblasti jadra a \u00fato\u010dn\u00edk m\u00f4\u017ee vykona\u0165 vyh\u013ead\u00e1vanie ur\u010ditej hodnoty na n\u00e1hodn\u00fdch adres\u00e1ch v jadre. Vykonanie \u00fatoku trv\u00e1 ve\u013ea \u010dasu a na zabezpe\u010denie \u00faniku m\u00f4\u017ee by\u0165 potrebn\u00e9 vykon\u00e1va\u0165 exploit nieko\u013eko hod\u00edn. <\/p>\n

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

V jadre Linux je probl\u00e9m bola odstr\u00e1nen\u00e1<\/a><\/noindex> prostredn\u00edctvom zmeny logiky vyvol\u00e1vania in\u0161trukcie SWAPGS (blokovanie \u0161pekulat\u00edvneho vykon\u00e1vania), podobne ako pri oprave in\u00fdch zranite\u013enost\u00ed triedy Spectre v1. Predpoklad\u00e1 sa, \u017ee pridan\u00e1 ochrana minim\u00e1lne ovplyvn\u00ed v\u00fdkon typick\u00fdch pracovn\u00fdch z\u00e1\u0165a\u017e\u00ed. Zdr\u017eanie vznik\u00e1 v \u0161t\u00e1diu prechodu medzi priestorom pou\u017e\u00edvate\u013ea a jadrom, \u010do m\u00f4\u017ee vies\u0165 k zn\u00ed\u017eeniu v\u00fdkonu, napr\u00edklad pri intenz\u00edvnom vykon\u00e1van\u00ed syst\u00e9mov\u00fdch volan\u00ed z aplik\u00e1cie alebo pri \u010dastom generovan\u00ed NMI a preru\u0161eniach. <\/p>\n

Oprava si vy\u017eaduje in\u0161tal\u00e1ciu aktualiz\u00e1cie jadra ako v hlavnom syst\u00e9me, tak aj v hostite\u013esk\u00fdch prostrediach, s n\u00e1sledn\u00fdm re\u0161tartovan\u00edm syst\u00e9mu. Na vypnutie ochrany v Linuxe m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 mo\u017enos\u0165 \u201enospectre_v1\u201c, ktor\u00e1 tie\u017e vyp\u00edna opatrenia na blokovanie zranite\u013enosti SWAPGS. Oprava je dostupn\u00e1 vo forme patchu<\/a><\/noindex> jadra Linux, ktor\u00e9 u\u017e bolo zahrnut\u00e9 do vydan\u00ed 4.19.65<\/a><\/noindex>, 5.2.7<\/a><\/noindex>, 4.14.137, 4.9.188 a 4.4.188. Aktualiz\u00e1cie pre distrib\u00facie Linux zatia\u013e neboli vydan\u00e9 (Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>). V syst\u00e9me Windows bola probl\u00e9m bez zbyto\u010dn\u00e9ho rozruchu odstr\u00e1nen\u00e1 v j\u00falovej aktualiz\u00e1cii<\/a><\/noindex>. Spolo\u010dnos\u0165 Google pripravila<\/a><\/noindex> opravn\u00fd bal\u00edk pre jadro 4.19, dod\u00e1van\u00e9 v ChromeOS a Android<\/a><\/noindex>.<\/p>\n

Pod\u013ea vyhl\u00e1sen\u00ed v\u00fdskumn\u00edkov zo spolo\u010dnosti Bitdefender, bola spolo\u010dnos\u0165 Intel o probl\u00e9me informovan\u00e1 u\u017e v auguste minul\u00e9ho roka. Probl\u00e9m sa rozhodol vyrie\u0161i\u0165 softv\u00e9rovo, pri\u010dom do koordinovanej v\u00fdroby opravy boli zapojen\u00ed v\u00fdvoj\u00e1ri z Microsoftu, Googlu a jadra Linux. Star\u0161ie procesory Intel, do Ivy Bridge, s\u00fa v\u00fdrazne \u0165a\u017e\u0161ie napadnute\u013en\u00e9 kv\u00f4li nedostatku podpory in\u0161trukcie WRGSBASE, pou\u017eitej v expl\u00f3ite. Syst\u00e9my ARM, POWER, SPARC, MIPS a RISC-V nie s\u00fa zranite\u013en\u00e9, preto\u017ee nepodporuj\u00fa in\u0161trukciu SWAPGS.<\/p>\n

Probl\u00e9m najm\u00e4 hroz\u00ed vlastn\u00edkom procesorov Intel \u2014
\n na syst\u00e9moch AMD sa podarilo reprodukova\u0165 iba druh\u00fd scen\u00e1r \u00fatoku, ktor\u00fd je obmedzen\u00fd na \u0161pekulat\u00edvne spracovanie z\u00e1kladnej hodnoty registru GS, ktor\u00fa je mo\u017en\u00e9 vyu\u017ei\u0165 na vyh\u013ead\u00e1vanie ur\u010dit\u00fdch hodn\u00f4t v n\u00e1hodn\u00fdch oblastiach pam\u00e4te. Na blokovanie tejto varianty \u00fatoku sta\u010d\u00ed<\/noindex> existuj\u00facich met\u00f3d ochrany pred zranite\u013enos\u0165ami Spectre v1. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-1125) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 CPU, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0438\u043c\u044f SWAPGS, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043d\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Intel (x86_64) \u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b AMD, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SWAPGS \u2014 nov\u00e1 zranite\u013enos\u0165 v mechanizme \u0161pekulat\u00edvneho vykon\u00e1vania CPU | ProHoster","description":"V\u00fdskumn\u00edci zo spolo\u010dnosti Bitdefender odhalili nov\u00fa zranite\u013enos\u0165 (","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SWAPGS \u2014 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f CPU | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/swapgs-novaya-uyazvimost-v-mehanizme-spekulyativnogo-vypolneniya-cpu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:35+00:00","article:modified_time":"2019-10-31T19:14:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:14:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:22","updated":"2026-01-22 05:14:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/36892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=36892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/36892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=36892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=36892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=36892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}