{"id":104644,"date":"2022-07-13T15:36:38","date_gmt":"2022-07-13T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd"},"modified":"2022-07-13T15:36:38","modified_gmt":"2022-07-13T13:36:38","slug":"retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd","title":{"rendered":"Retbleed \u2014 nj\u00eb sulm i ri ndaj mekanizmit t\u00eb ekzekutimit spekulativ t\u00eb CPU-ve Intel dhe AMD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb grup studiuesish nga Politeknika e Lozan\u00ebs n\u00eb Zvic\u00ebr ka zbuluar nj\u00eb variant t\u00eb ri sulmi ndaj mekanizmit t\u00eb ekzekutimit spekulator t\u00eb kalimeve t\u00eb nd\u00ebrsjella n\u00eb CPU, q\u00eb lejon nxjerrjen e informacionit nga memoria e b\u00ebrtham\u00ebs ose organizimin e nj\u00eb sulmi ndaj sistemit t\u00eb host-it nga makinat virtuale. K\u00ebto dob\u00ebsi mor\u00ebn emrin kodor Retbleed (CVE-2022-29900, CVE-2022-29901) dhe jan\u00eb t\u00eb ngjashme n\u00eb substanc\u00eb me sulmet Spectre-v2. Dallimi q\u00ebndron n\u00eb organizimin e ekzekutimit spekulator t\u00eb kodit t\u00eb rast\u00ebsish\u00ebm gjat\u00eb p\u00ebrpunimit t\u00eb instrukcionit «ret» (kthehu), q\u00eb nxjerr adres\u00ebn p\u00ebr kalim nga steku, p\u00ebrkundrazi nga kalimi i nd\u00ebrsjell\u00eb p\u00ebrmes instrukcionit «jmp» me ngarkes\u00ebn e adres\u00ebs nga memoria ose registeri i CPU. <\/p>\n
Sulmuesi mund t\u00eb krijoj\u00eb kushte p\u00ebr parashikimin e gabuar t\u00eb kalimit dhe t\u00eb organizoj\u00eb nj\u00eb kalim spekulativ t\u00eb targetuar n\u00eb nj\u00eb bllok kodi, q\u00eb nuk parashihet nga logjika e ekzekutimit t\u00eb programit. N\u00eb fund, procesori do t\u00eb p\u00ebrcaktoj\u00eb se parashikimi i deg\u00ebs nuk ka qen\u00eb i sakt\u00eb dhe do t\u00eb t\u00ebrheq\u00eb operacionin n\u00eb gjendjen fillestare, por t\u00eb dh\u00ebnat e p\u00ebrpunuara gjat\u00eb procesit t\u00eb ekzekutimit spekulativ do t\u00eb mbesin n\u00eb memorie dhe buffers mikroarkitektonike. N\u00ebse blloku q\u00eb \u00ebsht\u00eb ekzekutuar gabimisht b\u00ebn akses n\u00eb memorie, at\u00ebher\u00eb ekzekutimi i tij spekulativ do t\u00eb sjell\u00eb vendosjen e t\u00eb dh\u00ebnave n\u00eb memorien e p\u00ebrbashk\u00ebt. <\/p>\n
P\u00ebr t\u00eb p\u00ebrcaktuar t\u00eb dh\u00ebnat q\u00eb kan\u00eb mbetur n\u00eb cache pas ekzekutimit spekulator t\u00eb operacioneve, sulmuesi mund t\u00eb p\u00ebrdor\u00eb metoda p\u00ebr t\u00eb p\u00ebrcaktuar t\u00eb dh\u00ebnat e mbetura p\u00ebrmes kanaleve an\u00ebsore, p\u00ebr shembull, duke analizuar ndryshimet n\u00eb koh\u00ebn e aksesit n\u00eb t\u00eb dh\u00ebna t\u00eb caktuara dhe t\u00eb pa-cache. P\u00ebr nxjerrjen e q\u00ebllimshme t\u00eb informacionit nga zona n\u00eb nj\u00eb nivel tjet\u00ebr privilegji (p\u00ebr shembull, nga memoria e b\u00ebrtham\u00ebs) p\u00ebrdoren «gadgets» \u2014 sekuencat e komandave t\u00eb pranishme n\u00eb b\u00ebrtham\u00eb, t\u00eb p\u00ebrshtatshme p\u00ebr leximin spekulator t\u00eb t\u00eb dh\u00ebnave nga memoria n\u00eb var\u00ebsi t\u00eb kushteve t\u00eb jashtme, p\u00ebr t\u00eb cilat mund t\u00eb ndikoj\u00eb sulmuesi. <\/p>\n
P\u00ebr t\u00eb mbrojtur nga sulmet klasike t\u00eb klas\u00ebs Spectre, n\u00eb t\u00eb cilat p\u00ebrdoren instrukcione kushtore dhe kalimesh t\u00eb nd\u00ebrsjella, shumica e sistemeve operative zbatojn\u00eb teknik\u00ebn «retpoline», e cila bazohet n\u00eb z\u00ebvend\u00ebsimin e operacioneve t\u00eb kalimit t\u00eb nd\u00ebrsjell\u00eb me instrukcionin «ret», p\u00ebr t\u00eb cilin n\u00eb procesor\u00eb p\u00ebrdoret nj\u00eb bllok i ve\u00e7ant\u00eb parashikimi t\u00eb gjendjes s\u00eb stekut, q\u00eb nuk p\u00ebrdor bllokun e parashikimit t\u00eb kalimeve. Kur u implementua retpoline n\u00eb vitin 2018, u konsiderua se manipulimet me adresat t\u00eb ngjashme me ato t\u00eb Spectre nuk ishin t\u00eb aplikueshme n\u00eb praktik\u00eb p\u00ebr kalimin spekulator p\u00ebrmes instrukcionit «ret». <\/p>\n
Studiuesit q\u00eb zhvilluan metod\u00ebn e sulmit Retbleed demonstruan mund\u00ebsin\u00eb e krijimit t\u00eb kushteve mikroarkitektonike p\u00ebr iniciimin e kalimit spekulator p\u00ebrmes instrukcionit «ret» dhe publikuan nj\u00eb set t\u00eb gatsh\u00ebm veglash p\u00ebr identifikimin n\u00eb b\u00ebrtham\u00ebn Linux t\u00eb sekuencave t\u00eb instrukcioneve t\u00eb p\u00ebrshtatshme p\u00ebr shfryt\u00ebzimin e dob\u00ebsive (gadgets), n\u00eb t\u00eb cilat shfaqen kushte t\u00eb tilla. <\/p>\n
Gjat\u00eb k\u00ebrkimit \u00ebsht\u00eb p\u00ebrgatitur nj\u00eb eksploit punues, i cili lejon q\u00eb n\u00eb sistemet me CPU Intel t\u00eb nxirren t\u00eb dh\u00ebna t\u00eb rastit nga memoria e b\u00ebrtham\u00ebs me nj\u00eb shpejt\u00ebsi prej 219 byte n\u00eb sekond\u00eb dhe sakt\u00ebsi 98%. N\u00eb procesor\u00ebt AMD, efikasiteti i eksploitit \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb \u2014 shpejt\u00ebsia e rrjedhjes arrin 3.9 KB n\u00eb sekond\u00eb. Si nj\u00eb shembull praktik tregohet se si me an\u00eb t\u00eb eksploitit t\u00eb propozuar mund t\u00eb p\u00ebrcaktohet p\u00ebrmbajtja e dosjes \/etc\/shadow. N\u00eb sistemet me CPU Intel, sulmi p\u00ebr t\u00eb p\u00ebrcaktuar hash-in e fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit root \u00ebsht\u00eb kryer p\u00ebr 28 minuta, nd\u00ebrsa n\u00eb sistemet me CPU AMD \u2014 p\u00ebr 6 minuta.
\r\n \r\n
<\/div>\r\n <\/div><\/center> <\/p>\n
Mund\u00ebsia p\u00ebr kryerjen e sulmit \u00ebsht\u00eb konfirmuar p\u00ebr brezat 6-8 t\u00eb procesor\u00ebve Intel, t\u00eb cil\u00ebt jan\u00eb prodhuar deri n\u00eb tremujorin e tret\u00eb t\u00eb vitit 2019 (p\u00ebrfshir\u00eb Skylake), dhe p\u00ebr procesor\u00ebt AMD t\u00eb bazuar n\u00eb mikroarkitektur\u00ebn Zen 1, Zen 1+ dhe Zen 2, t\u00eb cil\u00ebt jan\u00eb prodhuar deri n\u00eb tremujorin e dyt\u00eb t\u00eb vitit 2021. N\u00eb modelet m\u00eb t\u00eb reja t\u00eb procesor\u00ebve, si AMD Zen3 dhe Intel Alder Lake, si dhe n\u00eb procesor\u00ebt ARM, problemi bllokohet nga mekanizmat ekzistues t\u00eb mbrojtjes. P\u00ebr shembull, p\u00ebrdorimi i instrukcioneve IBRS (Parashikimi i Kalimeve t\u00eb T\u00ebrthorta t\u00eb Kufizuara) ndihmon p\u00ebr t'u mbrojtur nga sulmi. <\/p>\n
P\u00ebr b\u00ebrtham\u00ebn Linux dhe hypervisor-in Xen \u00ebsht\u00eb p\u00ebrgatitur nj\u00eb grup ndryshimesh, q\u00eb p\u00ebr CPU-t\u00eb m\u00eb t\u00eb vjetra bllokojn\u00eb problemin p\u00ebrmes nj\u00eb metode softuerike. Patch-i i propozuar p\u00ebr b\u00ebrtham\u00ebn Linux ndryshon 68 skedare, shton 1783 rreshta dhe fshin 387 rreshta. Fatkeq\u00ebsisht, mbrojtja \u00e7on n\u00eb kostot e dukshme \u2014 n\u00eb testet e kryera n\u00eb procesor\u00ebt AMD dhe Intel, r\u00ebnia e performanc\u00ebs e vler\u00ebsuar \u00ebsht\u00eb nga 14% deri n\u00eb 39%. M\u00eb e preferueshme \u00ebsht\u00eb t\u00eb aplikohet mbrojtja e bazuar n\u00eb komandat IBRS, t\u00eb cilat jan\u00eb t\u00eb dostupshme n\u00eb gjeneratat e reja t\u00eb CPU Intel dhe mb\u00ebshteten q\u00eb nga b\u00ebrthama Linux 4.19. <\/p>\n
N\u00eb procesor\u00ebt Intel, z\u00ebvend\u00ebsimi i adres\u00ebs p\u00ebr kalimin spekullativ t\u00ebrhiqet nga nj\u00eb ve\u00e7ori q\u00eb shfaqet gjat\u00eb tejkalimit nga fundi (underflow) n\u00eb bufferin e parashikimit t\u00eb p\u00ebrmbajtjes s\u00eb grumbullit (Return Stack Buffer). Kur ndodhin kushtet e tilla, logjika e zgjedhjes s\u00eb adres\u00ebs fillon t\u00eb zbatohet p\u00ebr instruksionin \u00abret\u00bb, e cila \u00ebsht\u00eb e ngjashme me at\u00eb q\u00eb ndodh n\u00eb kalimet indirekte normale. N\u00eb b\u00ebrtham\u00ebn Linux jan\u00eb gjetur m\u00eb shum\u00eb se nj\u00eb mij\u00eb vende q\u00eb krijojn\u00eb kushte p\u00ebr inicimin e nj\u00eb tejkalimi t\u00eb till\u00eb dhe q\u00eb jan\u00eb t\u00eb aksesueshme p\u00ebrmes thirrjeve sistemike. <\/p>\n
N\u00eb procesor\u00ebt AMD, ekzekutimi spekullativ i instruksionit \u00abret\u00bb realizohet pa u lidhur me nj\u00eb buffer specifik p\u00ebr grumbullin (Return Address Stack) dhe blloku i parashikimit t\u00eb kalimeve e konsideron instruksionin \u00abret\u00bb jo si nj\u00eb kthim t\u00eb kontrollit, por si nj\u00eb kalim t\u00eb drejtp\u00ebrdrejt\u00eb, dhe p\u00ebr pasoj\u00eb, p\u00ebrdor p\u00ebr parashikim t\u00eb dh\u00ebnat p\u00ebr kalimet indirekte. N\u00eb kushte t\u00eb tilla, pothuajse \u00e7do operacion \u00abret\u00bb, i arritsh\u00ebm p\u00ebrmes nj\u00eb thirrjeje sistemike, mund t\u00eb p\u00ebrdoret p\u00ebr shfryt\u00ebzim. <\/p>\n
P\u00ebrve\u00e7 k\u00ebsaj, n\u00eb CPU AMD \u00ebsht\u00eb identifikuar nj\u00eb tjet\u00ebr problem (CVE-2022-23825, Branch Type Confusion), q\u00eb lidhet me kryerjen e kalimeve t\u00eb rreme \u2014 kushtet p\u00ebr parashikimin e kalimit mund t\u00eb ndodhin edhe pa instruksione t\u00eb nevojshme t\u00eb deg\u00ebve, duke lejuar ndikimin n\u00eb buferin e parashikimit t\u00eb kalimeve pa instruksionin \u00abret\u00bb. Kjo karakteristik\u00eb e b\u00ebn zbatimin e mbrojtjes m\u00eb t\u00eb v\u00ebshtir\u00eb dhe k\u00ebrkon nj\u00eb pastrim m\u00eb t\u00eb aktiv t\u00eb buferit t\u00eb parashikimeve t\u00eb kalimeve. Pritet q\u00eb shtimi i mbrojtjes s\u00eb plot\u00eb n\u00eb b\u00ebrtham\u00eb do t\u00eb shkaktoj\u00eb nj\u00eb rritje t\u00eb kostove deri n\u00eb 209%. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Luaj](\"https:\/\/img.youtube.com\/vi\/dmSPvJxPm80\/hqdefault.jpg\")
\r\n