{"id":84664,"date":"2020-06-10T01:42:18","date_gmt":"2020-06-09T23:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami"},"modified":"2020-06-10T01:42:18","modified_gmt":"2020-06-09T23:42:18","slug":"crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","title":{"rendered":"CROSSTalk \u2013 zranite\u013enos\u0165 v CPU Intel, ved\u00faca k \u00faniku \u00fadajov medzi jadrami","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdskumn\u00edkov z Amsterdamskej slobodnej univerzity identifikovala nov\u00fa zranite\u013enos\u0165<\/a><\/noindex> (CVE-2020-0543) v mikroarchitektonick\u00fdch \u0161trukt\u00farach procesorov Intel, osobitne pozoruhodn\u00fa t\u00fdm, \u017ee umo\u017e\u0148uje obnovi\u0165 v\u00fdsledky vykon\u00e1vania niektor\u00fdch in\u0161trukci\u00ed, ktor\u00e9 boli vykon\u00e1van\u00e9 na inom CPU jadre. Tento probl\u00e9m je prvou zranite\u013enos\u0165ou mechanizmu \u0161pekulat\u00edvneho vykon\u00e1vania in\u0161trukci\u00ed, ktor\u00e1 umo\u017e\u0148uje \u00fanik \u00fadajov medzi jednotliv\u00fdmi CPU jadrami (predt\u00fdm sa \u00faniky obmedzovali na r\u00f4zne vl\u00e1kna jedn\u00e9ho jadra). V\u00fdskumn\u00edci nazvali tento probl\u00e9m CROSSTalk, ale v dokumentoch Intel<\/a><\/noindex> sa zranite\u013enos\u0165 uv\u00e1dza ako SRBDS (Special Register Buffer Data Sampling). <\/p>\n

Zranite\u013enos\u0165 patr\u00ed do predstaven\u00e9ho<\/a><\/noindex> pred rokom triedy probl\u00e9mov MDS (Microarchitectural Data Sampling) a je zalo\u017een\u00e1 na aplik\u00e1cii met\u00f3d anal\u00fdzy cez bo\u010dn\u00e9 kan\u00e1ly na \u00fadaje v mikroarchitektonick\u00fdch \u0161trukt\u00farach. Princ\u00edp fungovania<\/a><\/noindex> CROSSTalk je bl\u00edzky zranite\u013enosti RIDL<\/a><\/noindex>, ale l\u00ed\u0161i sa zdrojom \u00faniku.
\nNov\u00e1 zranite\u013enos\u0165 manipuluje s \u00fanikom z predt\u00fdm nedokumentovan\u00e9ho medzipam\u00e4\u0165ov\u00e9ho buffera, ktor\u00fd sa zdie\u013ea medzi v\u0161etk\u00fdmi CPU jadrami. <\/p>\n

\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

Podstata probl\u00e9mu<\/a><\/noindex> v tom, \u017ee niektor\u00e9 in\u0161trukcie mikroprocesora, vr\u00e1tane RDRAND, RDSEED a SGX EGETKEY, s\u00fa implementovan\u00e9 pomocou vn\u00fatornej mikroarchitektonickej oper\u00e1cie SRR (Special Register Reads). Na zranite\u013en\u00fdch procesoroch sa \u00fadaje vr\u00e1ten\u00e9 pre SRR ukladaj\u00fa do medzipam\u00e4\u0165ov\u00e9ho buffera, ktor\u00fd je spolo\u010dn\u00fd pre v\u0161etky CPU jadr\u00e1, po \u010dom sa pren\u00e1\u0161aj\u00fa do buffera naplnenia viazan\u00e9ho na konkr\u00e9tne fyzick\u00e9 CPU jadro, na ktorom je oper\u00e1cia \u010d\u00edtania iniciovan\u00e1. N\u00e1sledne sa z buffera naplnenia hodnota kop\u00edruje do registrov vidite\u013en\u00fdch aplik\u00e1ci\u00e1m. <\/p>\n

Ve\u013ekos\u0165 spolo\u010dn\u00e9ho medzipam\u00e4\u0165ov\u00e9ho buffera zodpoved\u00e1 ve\u013ekosti cache riadku, \u010do je zvy\u010dajne viac ako ve\u013ekos\u0165 \u010d\u00edtan\u00fdch \u00fadajov a r\u00f4zne oper\u00e1cie \u010d\u00edtania sa t\u00fdkaj\u00fa r\u00f4znych posunov v buffere. Ke\u010f\u017ee spolo\u010dn\u00fd buffer sa kop\u00edruje do buffera naplnenia cel\u00fd, pres\u00fava sa nielen potrebn\u00e1 \u010das\u0165 pre aktu\u00e1lnu oper\u00e1ciu, ale aj \u00fadaje, ktor\u00e9 zostali z vykon\u00e1vania in\u00fdch oper\u00e1ci\u00ed, vr\u00e1tane t\u00fdch, ktor\u00e9 boli vykonan\u00e9 na in\u00fdch CPU jadr\u00e1ch.
\n

\"CROSSTalk<\/a><\/noindex><\/center>
\n
\"CROSSTalk<\/a><\/noindex><\/center><\/p>\n

Pri \u00faspe\u0161nom uskuto\u010dnen\u00ed \u00fatoku m\u00f4\u017ee autentifikovan\u00fd lok\u00e1lny pou\u017e\u00edvate\u013e ur\u010di\u0165 v\u00fdsledok vykon\u00e1vania in\u0161trukci\u00ed RDRAND, RDSEED a EGETKEY v cudzom procese alebo v r\u00e1mci Intel SGX encl\u00e1va, bez oh\u013eadu na to, na ktorom CPU jadre je k\u00f3d spusten\u00fd.
\nProbl\u00e9m objavili v\u00fdskumn\u00edci publikovali<\/a><\/noindex> prototyp exploitu, ktor\u00fd demon\u0161truje mo\u017enos\u0165 \u00faniku inform\u00e1ci\u00ed o n\u00e1hodn\u00fdch hodnot\u00e1ch z\u00edskan\u00fdch pomocou in\u0161trukci\u00ed RDRAND a RDSEED, na obnovenie s\u00fakromn\u00e9ho k\u013e\u00fa\u010da ECDSA, spracov\u00e1van\u00e9ho v enclave Intel SGX, po vykonan\u00ed len jednej oper\u00e1cie s digit\u00e1lnym podpisom v syst\u00e9me.<\/p>\n


\n
\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Problematika je vystaven\u00fd<\/a><\/noindex> \u0161irok\u00fd rozsah desktopov\u00fdch, mobiln\u00fdch a serverov\u00fdch procesorov Intel, vr\u00e1tane Core i3, i5, i7, i9, m3, Celeron (s\u00e9ri\u00ed J, G a N), Atom (s\u00e9ri\u00ed C, E a X), Xeon (rodiny E3, E5, E7, W a D), Xeon Scalable a \u010fal\u0161\u00edch. Zauj\u00edmav\u00e9 je, \u017ee spolo\u010dnos\u0165 Intel bola upozornen\u00e1 na zranite\u013enos\u0165 v septembri 2018 a v j\u00fali 2019 bol poskytnut\u00fd prototyp exploitu, ktor\u00fd demon\u0161truje \u00fanik \u00fadajov medzi jadrami CPU, av\u0161ak v\u00fdvoj opravy sa oneskoril kv\u00f4li zlo\u017eitosti jej implement\u00e1cie. V dnes predstavenom aktualiz\u00e1cii mikrok\u00f3du je probl\u00e9m zablokovan\u00fd zmenou spr\u00e1vania in\u0161trukci\u00ed RDRAND, RDSEED a EGETKEY na nadbyto\u010dn\u00fa prepisovanie \u00fadajov v zdie\u013eanej pam\u00e4ti, aby sa zabr\u00e1nilo usadzovaniu zvy\u0161kov\u00fdch inform\u00e1ci\u00ed. Okrem toho bola aplikovan\u00e1 pozast\u00e1vka pr\u00edstupu k pam\u00e4ti do dokon\u010denia oper\u00e1ci\u00ed \u010d\u00edtania a prepisovania obsahu. <\/p>\n

Ne\u017eiaducim \u00fa\u010dinkom takejto ochrany je zv\u00fd\u0161enie latenci\u00ed pri vykon\u00e1van\u00ed RDRAND, RDSEED a EGETKEY a zn\u00ed\u017eenie priepustnosti pri pokuse o s\u00fa\u010dasn\u00e9 vykon\u00e1vanie t\u00fdchto in\u0161trukci\u00ed na r\u00f4znych logick\u00fdch procesoroch. Vykonanie RDRAND, RDSEED a EGETKEY tie\u017e pozastavuje pr\u00edstup k pam\u00e4ti z in\u00fdch logick\u00fdch procesorov. Tieto vlastnosti m\u00f4\u017eu negat\u00edvne ovplyvni\u0165 v\u00fdkon niektor\u00fdch serverov\u00fdch aplik\u00e1ci\u00ed, preto je v firme zahrnut\u00fd mechanizmus (RNGDS_MITG_DIS) na deaktiv\u00e1ciu ochrany in\u0161trukci\u00ed RDRAND a RDSEED vykon\u00e1van\u00fdch mimo enclavy Intel SGX.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u043c \u044f\u0434\u0440\u0435 CPU. \u042d\u0442\u043e \u043f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0442\u0435\u0447\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u044f\u0434\u0440\u0430\u043c\u0438 CPU (\u0440\u0430\u043d\u0435\u0435 \u0443\u0442\u0435\u0447\u043a\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043f\u043e\u0442\u043e\u043a\u0430\u043c\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u044f\u0434\u0440\u0430). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0438\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84665,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84664","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47CROSSTalk \u2014 zranite\u013enos\u0165 v CPU Intel, ktor\u00e1 vedie k \u00faniku \u00fadajov medzi jadrami | ProHoster","description":"Skupina v\u00fdskumn\u00edkov z Amsterdamskej univerzity zistila nov\u00fa zranite\u013enos\u0165 (CVE-2020-0543) v mikroarchitekt\u00fare.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CROSSTalk \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CPU Intel, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u044f\u0434\u0440\u0430\u043c\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0543) \u0432 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/crosstalk-uyazvimost-v-cpu-intel-privodyashhaya-k-utechke-dannyh-mezhdu-yadrami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:18+00:00","article:modified_time":"2020-06-09T23:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84664","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:00:17","updated":"2022-09-29 11:12:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/84664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=84664"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/84664\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/84665"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=84664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=84664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=84664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}