{"id":107141,"date":"2023-03-07T12:48:16","date_gmt":"2023-03-07T10:48:16","guid":{"rendered":"https:\/\/prohoster.info\/?p=107141"},"modified":"2023-03-10T11:57:09","modified_gmt":"2023-03-10T09:57:09","slug":"uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","title":{"rendered":"Ranljivosti v referen\u010dni izvedbi TPM 2.0, ki omogo\u010dajo dostop do podatkov v kripto \u010dipu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kodi referen\u010dne implementacije specifikacije TPM 2.0 (Trusted Platform Module) so bile odkrite ranljivosti (CVE-2023-1017, CVE-2023-1018), ki omogo\u010dajo pisanje ali branje podatkov zunaj dodeljenega pomnilnika. Napad na implementacije kriptoprocesorjev, ki uporabljajo ranljiv kodo, lahko privede do pridobitve ali prepisovanja informacij, shranjenih na \u010dipu, kot so kriptografski klju\u010di. Mo\u017enost prepisovanja podatkov v vdelani programski opremi TPM lahko napadalec izkoristi za izvajanje svojega kode v okviru TPM, kar se lahko na primer uporabi za uresni\u010ditev backdoor-ov, ki delujejo na strani TPM in niso prepoznavni iz operacijskega sistema. <\/p>\n

Ranljivosti so povzro\u010dene zaradi nepravilne preverjanja velikosti parametrov funkcije CryptParameterDecryption(), ki omogo\u010da pisanje ali branje dveh bajtov zunaj pomnilnika, ki se posreduje funkciji ExecuteCommand() in vsebuje ukaz TPM2.0. Glede na implementacijo vdelane programske opreme lahko prepisana dva bajta po\u0161kodujeta tako neuporabljeni pomnilnik kot tudi podatke ali kazalnike na\u5806\u3002 <\/p>\n

Izkori\u0161\u010danje ranljivosti se odvija prek po\u0161iljanja specifi\u010dno oblikovanih ukazov TPM-modulu (napadalec mora imeti dostop do vmesnika TPM). Te\u017eave so odpravljene v razli\u010dici specifikacije TPM 2.0, izdani januarja (1.59 Errata 1.4, 1.38 Errata 1.13, 1.16 Errata 1.6). <\/p>\n

Ranljivost je podvr\u017eena tudi odprti knji\u017enici libtpms, ki se uporablja za programsko emulacijo TPM-modulov in integracijo podpore TPM v hipervizorje. Ranljivost je odpravljena v razli\u010dici libtpms 0.9.6.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 TPM 2.0 (Trusted Platform Module) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-1017, CVE-2023-1018), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0438\u043b\u0438 \u0447\u0442\u0435\u043d\u0438\u044e \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0435\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043a\u043e\u0434, \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044e \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0442\u0430\u043a\u043e\u0439 \u043a\u0430\u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 TPM \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107141","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivosti v referen\u010dni implementaciji TPM 2.0, ki omogo\u010dajo dostop do podatkov v kripto\u010dipu | ProHoster","description":"V kodi referen\u010dne implementacije specifikacije TPM 2.0 (Trusted Platform Module) so bile odkrite ranljivosti (CVE-2023-1017, CVE-2023-1018), ki omogo\u010dajo pisanje ali branje podatkov zunaj dodeljenega pomnilnika.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 TPM 2.0, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0447\u0438\u043f\u0435 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 TPM 2.0 (Trusted Platform Module) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-1017, CVE-2023-1018), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0438\u043b\u0438 \u0447\u0442\u0435\u043d\u0438\u044e \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0435\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-etalonnoj-realizaczii-tpm-2-0-pozvolyayushhie-poluchit-dostup-k-dannym-v-kriptochipe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-07T10:48:16+00:00","article:modified_time":"2023-03-10T09:57:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/107141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=107141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/107141\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=107141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=107141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=107141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}