O se vaega o tagata suʻesuʻe mai le Free University of Amsterdam ua faʻasalalau se meafaigaluega Kasper ua mamanuina e faʻailoa ai snippets code i le fatu Linux lea e mafai ona faʻaaogaina e faʻaogaina ai le vaivai o le Specter-class e mafua mai i le faʻaogaina o tulafono faʻamaonia i luga o le gaioiga. O le faʻailoga autu mo le meafaigaluega e tufatufa atu i lalo ole laisene Apache 2.0.
Seʻi o tatou manatua ina ia mafai ona faia ni osofaʻiga e pei o le Specter v1, lea e mafai ai ona iloa mea o loʻo i totonu o le manatua, o le i ai i totonu o le tulafono faʻapitoa o se faasologa o poloaiga (gadgets) e manaʻomia, e taʻitaʻia ai le faʻatinoina o faʻatonuga. . Mo faʻamoemoega sili ona lelei, e amata ona faʻatino e le processor ia gaioiga i se faiga faʻapitoa, ona fuafua ai lea e leʻi faʻamaonia le vaʻaiga a le paranesi ma toe faʻafoʻi galuega i lo latou tulaga muamua, ae o faʻamaumauga na faʻagasolo i le taimi o le faʻataunuʻuina o faʻamatalaga e muta i totonu o le cache ma microarchitectural buffers ma o lo'o avanoa mo le toe maua mai ia i latou i le fa'aaogaina o metotia eseese e fa'amautu ai fa'amaumauga o totoe e ala i auala lona tolu.
O meafaigaluega na maua muamua mo le suʻeina o masini mo le Specter vulnerability, e faʻavae i luga o le suʻeina o mamanu masani, na faʻaalia ai se maualuga maualuga o mea sese, aʻo misi le tele o mea moni (faʻataʻitaʻiga na faʻaalia ai 99% o gadgets na iloa e ia meafaigaluega e le mafai ona faʻaaogaina mo osofaʻiga. , ma le 33% o mea faigaluega e mafai ona oʻo atu ai i se osofaʻiga e leʻi matauina).
Ina ia faʻaleleia le tulaga lelei o le faʻailoaina o faʻafitauli faʻafitauli, e faʻataʻitaʻi e Kasper faʻafitauli e mafai e le tagata osofaʻi ona faʻaogaina i laasaga taʻitasi o le faia o osofaʻiga a le vasega Specter - faʻafitauli e mafai ai ona faʻatonutonuina faʻamatalaga e faʻataʻitaʻiina (mo se faʻataʻitaʻiga, suia faʻamatalaga osofaʻiga i fausaga microarchitectural e faʻaosofia ai le faʻataunuʻuina o faʻamatalaga faʻapitoa e faʻaaoga ai. osofaiga a le vasega LVI), maua le avanoa i faʻamatalaga faʻalilolilo (mo se faʻataʻitaʻiga, pe a alu i tua atu o pa puipui poʻo le faʻaogaina o le manatua pe a uma ona faʻasaʻoloto) ma faʻamalo faʻamatalaga faʻalilolilo (mo se faʻataʻitaʻiga, e ala i le suʻesuʻeina o le tulaga o le cache processor poʻo le faʻaogaina o le MDS method).
Pe a suʻeina, e fesoʻotaʻi le fatu ma Kasper runtime faletusi ma siaki o loʻo tamoe i le LLVM tulaga. O le faiga o le siakiina e faʻataʻitaʻia ai le faʻatinoina o tulafono faʻapitoa, faʻatinoina e faʻaaoga ai le siaki-toe faʻafoʻisia masini, lea e faʻapitoa ai le faʻatinoina o se lala faʻailoga sese, ona toe foʻi lea i le tulaga muamua aʻo leʻi amataina le lala. E taumafai fo'i Kasper e fa'ata'ita'i le tele o fa'afitauli fa'aletonu ma masini, su'esu'e le a'afiaga o a'afiaga o fa'ata'ita'iga ma microarchitectural, ma fa'atino su'ega fuzz o gaioiga e ono osofa'i. Ina ia au'ili'ili le fa'agasologa o fa'atinoga, o le DataFlowSanitizer uafu mo le fatu Linux o lo'o fa'aogaina, ma mo su'ega fuzzing, o lo'o fa'aogaina se fa'aliliuga o le pusa syzkaller.
O le su'esu'eina o le fatu Linux e fa'aaoga ai Kasper na iloa ai 1379 mea e le'i iloa muamua e ono ta'ita'i atu ai i fa'amaumauga i le taimi o le fa'atinoina o fa'atonuga. O loʻo maitauina atonu e naʻo nisi oi latou e ono tulaʻi mai ni faʻafitauli moni, ae e faʻaalia ai o loʻo i ai se tulaga lamatia moni, ae le naʻo se faʻataʻitaʻiga, o se faʻataʻitaʻiga galue o se faʻaogaina na fausia mo se tasi o faʻalavelave faʻalavelave faʻailoga, e taʻitaʻia ai faʻamatalaga. le leaka mai fatu manatua.
puna: opennet.ru