{"id":104644,"date":"2022-07-13T15:36:38","date_gmt":"2022-07-13T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd"},"modified":"2022-07-13T15:36:38","modified_gmt":"2022-07-13T13:36:38","slug":"retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd","title":{"rendered":"Retbleed \u2014 nj\u00eb sulm i ri ndaj mekanizmit t\u00eb ekzekutimit spekullativ t\u00eb CPU-ve Intel dhe AMD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb grup studiuesish nga Shkolla e Lart\u00eb Teknologjike e Cyrihut ka zbuluar nj\u00eb variant t\u00eb ri t\u00eb sulmit mbi mekanizmin e ekzekutimit spekulativ t\u00eb kalimeve t\u00eb drejtp\u00ebrdrejta n\u00eb CPU, i cili lejon nxjerrjen e informacionit nga memoria e kernelit ose organizimin e nj\u00eb sulmi ndaj sistemit host nga makinat virtuale. Vulnerabilitetet mor\u00ebn emrin kodor Retbleed (CVE-2022-29900, CVE-2022-29901) dhe jan\u00eb t\u00eb ngjashme n\u00eb natyr\u00ebn e tyre me sulmet Spectre-v2. Dallimi q\u00ebndron n\u00eb organizimin e ekzekutimit spekulativ t\u00eb kodit t\u00eb rast\u00ebsish\u00ebm gjat\u00eb trajtimit t\u00eb instrukcionit \u00abret\u00bb (return), i cili nxjerr adres\u00ebn p\u00ebr kalimin nga stack, n\u00eb vend t\u00eb kalimit t\u00eb drejtp\u00ebrdrejt\u00eb p\u00ebrmes instrukcionit \u00abjmp\u00bb me ngarkimin e adres\u00ebs nga memoria ose regjistri i CPU. <\/p>\n
Sulmuesi mund t\u00eb krijoj\u00eb kushte p\u00ebr parashikim t\u00eb pasakt\u00eb t\u00eb kalimit dhe t\u00eb organizoj\u00eb nj\u00eb kalim spekulativ t\u00eb q\u00ebllimt\u00eb n\u00eb nj\u00eb bllok kodi q\u00eb nuk parashikohet nga logjika e ekzekutimit t\u00eb programit. N\u00eb fund t\u00eb fundit, procesori do t\u00eb p\u00ebrcaktoj\u00eb se parashikimi i kalimit nuk \u00ebsht\u00eb realizuar dhe do ta rikthej\u00eb operacionin n\u00eb gjendjen e tij fillestare, por t\u00eb dh\u00ebnat e p\u00ebrpunuara n\u00eb procesin e ekzekutimit spekulativ do t\u00eb mbeten n\u00eb cache dhe t\u00eb dh\u00ebna mikroarkitekturore. N\u00ebse blloku i ekzekutuar gabimisht b\u00ebn nj\u00eb k\u00ebrkes\u00eb n\u00eb memorie, ekzekutimi i tij spekulativ do t\u00eb \u00e7oj\u00eb n\u00eb nguljen n\u00eb cache t\u00eb p\u00ebrgjithsh\u00ebm dhe t\u00eb dh\u00ebnave t\u00eb lexuara nga memoria. <\/p>\n
P\u00ebr t\u00eb p\u00ebrcaktuar t\u00eb dh\u00ebnat q\u00eb mbeten n\u00eb cache pas ekzekutimit spekulativ t\u00eb operacioneve, sulmuesi mund t\u00eb p\u00ebrdor\u00eb metoda p\u00ebr p\u00ebrcaktimin e t\u00eb dh\u00ebnave mbet\u00ebse p\u00ebrmes kanaleve an\u00ebsore, p\u00ebr shembull, duke analizuar ndryshimet n\u00eb koh\u00ebn e qasjes n\u00eb t\u00eb dh\u00ebna t\u00eb mbushura dhe t\u00eb papushura n\u00eb cache. P\u00ebr nxjerrjen e q\u00ebllimshme t\u00eb informacionit nga zona n\u00eb nj\u00eb nivel tjet\u00ebr privilegjesh (p.sh., nga memoria e kernelit) p\u00ebrdoren \u00abgadgets\u00bb \u2014 sekuenca komandash q\u00eb jan\u00eb t\u00eb pranishme n\u00eb kernel, t\u00eb p\u00ebrshtatshme p\u00ebr leximin spekulativ t\u00eb t\u00eb dh\u00ebnave nga memoria n\u00eb var\u00ebsi t\u00eb kushteve t\u00eb jashtme, t\u00eb cilat mund t\u00eb ndikohen nga sulmuesi. <\/p>\n
P\u00ebr t\u00eb mbrojtur nga sulmet klasike t\u00eb klas\u00ebs Spectre, t\u00eb cilat p\u00ebrdorin instrukcione kalimi t\u00eb kusht\u00ebzuar dhe t\u00eb drejtp\u00ebrdrejta, shumica e sistemeve operative aplikojn\u00eb teknik\u00ebn \u00abretpoline\u00bb, e cila bazohet n\u00eb z\u00ebvend\u00ebsimin e operacioneve t\u00eb kalimit t\u00eb drejtp\u00ebrdrejt\u00eb me instrukcionin \u00abret\u00bb, p\u00ebr t\u00eb cilin n\u00eb procesor\u00eb aplikohet nj\u00eb bllok i ve\u00e7ant\u00eb p\u00ebr parashikimin e gjendjes s\u00eb stack-ut, pa p\u00ebrdorur bllokun e parashikimit t\u00eb kalimeve. Kur u implementua retpoline n\u00eb vitin 2018, u mendua se manipulimet e ngjashme me adresat si Spectre nuk ishin t\u00eb aplikueshme n\u00eb praktik\u00eb p\u00ebr kalimin spekulativ p\u00ebrmes instrukcionit \u00abret\u00bb. <\/p>\n
Studiuesit q\u00eb zhvilluan metod\u00ebn e sulmit Retbleed demonstruan mund\u00ebsin\u00eb e krijimit t\u00eb kushteve mikroarkitekturore p\u00ebr iniciimin e kalimit spekulativ p\u00ebrmes instrukcionit \u00abret\u00bb dhe publikuan nj\u00eb mjet t\u00eb gatsh\u00ebm p\u00ebr t\u00eb identifikuar n\u00eb kernelin Linux sekuencat e instrukcioneve (gadgets) t\u00eb p\u00ebrshtatshme p\u00ebr shfryt\u00ebzim t\u00eb vulnerabiliteteve, n\u00eb t\u00eb cilat dalin k\u00ebto kushte. <\/p>\n
Gjat\u00eb hetimit, u p\u00ebrgatit nj\u00eb eksploit funksional, i cili lejon n\u00eb sistemet me CPU Intel nga nj\u00eb proces i pa privilegjuar n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit t\u00eb nxjerr\u00eb t\u00eb dh\u00ebna t\u00eb rast\u00ebsishme nga memoria e kernelit me shpejt\u00ebsi 219 byte n\u00eb sekond\u00eb dhe sakt\u00ebsi 98%. N\u00eb procesor\u00ebt AMD, efikasiteti i eksploitit \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb \u2014 shpejt\u00ebsia e rrjedhjes arrin n\u00eb 3.9 KB n\u00eb sekond\u00eb. Si nj\u00eb shembull praktik u tregua se si me an\u00eb t\u00eb eksploitit t\u00eb propozuar mund t\u00eb p\u00ebrcaktohet p\u00ebrmbajtja e skedarit \/etc\/shadow. N\u00eb sistemet me CPU Intel, sulmi p\u00ebr p\u00ebrcaktimin e hash-it t\u00eb fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit root u krye brenda 28 minutash, nd\u00ebrsa n\u00eb sistemet me CPU AMD \u2014 brenda 6 minutash.
\r\n \r\n
<\/div>\r\n <\/div><\/center> <\/p>\n
Mund\u00ebsia e kryerjes s\u00eb sulmit \u00ebsht\u00eb konfirmuar p\u00ebr brezat 6-8 t\u00eb procesor\u00ebve Intel, t\u00eb cil\u00ebt jan\u00eb prodhuar deri n\u00eb tremujorin e tret\u00eb t\u00eb vitit 2019 (duke p\u00ebrfshir\u00eb Skylake), dhe procesor\u00ebt AMD t\u00eb bazuar n\u00eb mikroarkitektur\u00ebn Zen 1, Zen 1+ dhe Zen 2, t\u00eb cilat jan\u00eb prodhuar deri n\u00eb tremujorin e dyt\u00eb t\u00eb vitit 2021. N\u00eb modelet m\u00eb t\u00eb reja t\u00eb procesor\u00ebve, si AMD Zen3 dhe Intel Alder Lake, si dhe n\u00eb procesor\u00ebt ARM, problemet bllokohen nga mekanizmat e mbrojtjes t\u00eb pranish\u00ebm. P\u00ebr shembull, p\u00ebrdorimi i instruksioneve IBRS (Indirect Branch Restricted Speculation) ndihmon n\u00eb mbrojtjen nga sulmi. <\/p>\n
P\u00ebr kernelin Linux dhe hypervisorin Xen u p\u00ebrgatit nj\u00eb grup ndryshimesh p\u00ebr CPU t\u00eb vjetra q\u00eb bllokojn\u00eb problemin n\u00eb m\u00ebnyr\u00eb programore. Patch-i i propozuar p\u00ebr kernelin Linux ndryshon 68 skedar\u00eb, shton 1783 rreshta dhe fshin 387 rreshta. Fatkeq\u00ebsisht, mbrojtja shkakton shpenzime t\u00eb konsiderueshme \u2014 n\u00eb testet e kryera n\u00eb procesor\u00ebt AMD dhe Intel, reduktimi i shpejt\u00ebsis\u00eb vler\u00ebsohet nga 14% deri n\u00eb 39%. M\u00eb e preferueshme \u00ebsht\u00eb q\u00eb t\u00eb aplikohet mbrojtja e bazuar n\u00eb instrukcionet IBRS, t\u00eb cilat jan\u00eb t\u00eb disponueshme n\u00eb brezat e rinj t\u00eb CPU Intel dhe mb\u00ebshteten q\u00eb nga kernelin Linux 4.19. <\/p>\n
N\u00eb procesor\u00ebt Intel, vendosja e adres\u00ebs p\u00ebr kalimin spekulativ t\u00eb drejtp\u00ebrdrejt\u00eb realizohet fal\u00eb nj\u00eb ve\u00e7orie q\u00eb shfaqet gjat\u00eb mbingarkesave p\u00ebrmes an\u00ebs s\u00eb poshtme (underflow) n\u00eb bufferin e parashikimit t\u00eb p\u00ebrmbajtjes s\u00eb stack-ut (Return Stack Buffer). Kur ndodhin kushte t\u00eb tilla, p\u00ebr instrukcionin \u00abret\u00bb fillon t\u00eb aplikohet logjika e zgjedhjes s\u00eb adres\u00ebs, e cila \u00ebsht\u00eb e ngjashme me at\u00eb q\u00eb p\u00ebrdoret p\u00ebr kalimet e drejtp\u00ebrdrejta t\u00eb zakonshme. N\u00eb kernelin Linux jan\u00eb gjetur m\u00eb shum\u00eb se nj\u00eb mij\u00eb vende q\u00eb krijojn\u00eb kushte p\u00ebr iniciimin e nj\u00eb shnd\u00ebrrimi t\u00eb till\u00eb t\u00eb kthyer dhe q\u00eb jan\u00eb t\u00eb arritshme p\u00ebrmes thirrjeve sistemike. <\/p>\n
N\u00eb procesor\u00ebt AMD, ekzekutimi spekulativ i instrukcionit \u00abret\u00bb realizohet pa qen\u00eb i lidhur me bufferin e ve\u00e7ant\u00eb t\u00eb adres\u00ebs s\u00eb stack-ut (Return Address Stack) dhe blloku i parashikimit t\u00eb kalimeve e konsideron instrukcionin \u00abret\u00bb jo si nj\u00eb kthim t\u00eb kontrollit, por si nj\u00eb kalim t\u00eb drejtp\u00ebrdrejt\u00eb, dhe, p\u00ebr rrjedhoj\u00eb, p\u00ebrdor t\u00eb dh\u00ebnat p\u00ebr kalimet e drejtp\u00ebrdrejta gjat\u00eb parashikimit. N\u00ebn k\u00ebto kushte, faktikisht \u00e7do operacion \u00abret\u00bb, i arritsh\u00ebm p\u00ebrmes nj\u00eb thirrje sistemike, mund t\u00eb p\u00ebrdoret p\u00ebr shfryt\u00ebzim. <\/p>\n
P\u00ebrs\u00ebri, n\u00eb CPU AMD \u00ebsht\u00eb zbuluar nj\u00eb problem tjet\u00ebr (CVE-2022-23825, Branch Type Confusion), i lidhur me realizimin e kalimeve t\u00eb rreme \u2014 kushtet p\u00ebr parashikimin e kalimeve mund t\u00eb ndodhin edhe pa udh\u00ebzime t\u00eb nevojshme branch, duke lejuar ndikimin n\u00eb buferin e parashikimit t\u00eb kalimeve pa udh\u00ebzimin \u00abret\u00bb. Kjo ve\u00e7ori ndjesh\u00ebm e komplikon zbatimin e mbrojtjes dhe k\u00ebrkon nj\u00eb pastrim m\u00eb aktiv t\u00eb buferit t\u00eb parashikimeve t\u00eb kalimeve. Pritet q\u00eb shtimi i mbrojtjes t\u00eb plot\u00eb n\u00eb b\u00ebrtham\u00eb do t\u00eb \u00e7oj\u00eb n\u00eb rritjen e kostove me 209%. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Luaj](\"https:\/\/img.youtube.com\/vi\/dmSPvJxPm80\/hqdefault.jpg\")
\r\n