{"id":108554,"date":"2023-05-17T00:48:11","date_gmt":"2023-05-16T22:48:11","guid":{"rendered":"https:\/\/prohoster.info\/?p=108554"},"modified":"2023-05-17T10:40:17","modified_gmt":"2023-05-17T08:40:17","slug":"ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-pmfault-pozvolyayushhaya-vyvesti-iz-stroya-cpu-na-nekotoryh-servernyh-sistemah","title":{"rendered":"Sulmi PMFault, i cili mund t\u00eb d\u00ebmtoj\u00eb CPU-n\u00eb n\u00eb disa sisteme serverash","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Hulumtuesit nga Universiteti i Birminghamit, t\u00eb njohur m\u00eb par\u00eb p\u00ebr zhvillimin e sulmeve Plundervolt dhe VoltPillager, zbuluan nj\u00eb dob\u00ebsi (CVE-2022-43309) n\u00eb disa plaka mahnit\u00ebse serveri, e cila lejon t\u00eb d\u00ebmtohet fizikisht CPU-ja pa mund\u00ebsi rikuperimi. Dob\u00ebsia, e njohur me emrin kodor PMFault, mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb d\u00ebmtuar server\u00ebt, t\u00eb cil\u00ebve sulmuesi nuk ka akses fizik, por ka akses t\u00eb privilegjuar n\u00eb sistemin operativ, marr\u00eb, p\u00ebr shembull, si rezultat i shfryt\u00ebzimit t\u00eb nj\u00eb dob\u00ebsie t\u00eb paparaqitur ose kapjes s\u00eb kredencialeve t\u00eb administratorit. <\/p>\n
The essence of the proposed method lies in the use of the PMBus interface, which utilizes the I2C protocol, to increase the voltage supplied to the processor to levels that can damage the chip. The PMBus interface is typically implemented in the VRM (Voltage Regulator Module), which can be accessed through manipulations with the BMC (Baseboard Management Controller). To perform an attack on boards supporting PMBus, in addition to administrator privileges in the operating system, access to the BMC is required, for example, via the IPMI KCS (Keyboard Controller Style) interface, over Ethernet, or through a BMC firmware update from the current system. <\/p>\n
Problemi q\u00eb lejon t\u00eb kryhet nj\u00eb sulm pa njohur parametrat e autentifikimit n\u00eb BMC \u00ebsht\u00eb konfirmuar n\u00eb pllakat am\u00eb Supermicro q\u00eb mb\u00ebshtesin IPMI (X11, X12, H11 dhe H12) dhe ASRock, por vulnerabilitetet jan\u00eb t\u00eb pranishme edhe n\u00eb pllakat e tjera server\u00ebsh, n\u00eb t\u00eb cilat mund t\u00eb arrihet n\u00eb PMBus. Gjat\u00eb eksperimenteve t\u00eb kryera, kur tensioni u rrit deri n\u00eb 2.84 volt, dy procesor\u00eb Intel Xeon u d\u00ebmkuan n\u00eb k\u00ebto pllaka. P\u00ebr t\u00eb pasur qasje n\u00eb BMC pa njohur parametrat e autentifikimit, por duke pasur qasje root n\u00eb sistemin operativ, u p\u00ebrdor nj\u00eb vulnerabilitet n\u00eb mekanizmin e verifikimit t\u00eb firmware, q\u00eb lejoi ngarkimin e nj\u00eb azhurnimi t\u00eb modifikuar t\u00eb firmware n\u00eb kontrollorin BMC, si dhe mund\u00ebsin\u00eb e qasjes pa autentifikim p\u00ebrmes IPMI KCS. <\/p>\n
Metoda e ndryshimit t\u00eb tensionit p\u00ebrmes PMBus gjithashtu mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kryer nj\u00eb sulm Plundervolt, duke lejuar q\u00eb p\u00ebrmes uljes s\u00eb tensionit n\u00eb nivele minimale t\u00eb shkaktohet d\u00ebmtimi i p\u00ebrmbajtjes s\u00eb qelizave me t\u00eb dh\u00ebna n\u00eb CPU, t\u00eb p\u00ebrdorura gjat\u00eb llogaritjeve n\u00eb enklavat e izoluara Intel SGX dhe gjenerimin e gabimeve n\u00eb algoritme fillimisht t\u00eb sakta. P\u00ebr shembull, n\u00ebse arrin ta ndryshosh vler\u00ebn e p\u00ebrdorur gjat\u00eb shum\u00ebzimit n\u00eb procesin e enkriptimit, do t\u00eb rezultoj\u00eb nj\u00eb tekst i enkriptuar i pasakt\u00eb. N\u00ebse sulmuesi ka mund\u00ebsin\u00eb t\u00eb lidhet me procesorin n\u00eb SGX p\u00ebr t\u00eb enkriptuar t\u00eb dh\u00ebnat e tij, duke shkaktuar prishje, ai mund t\u00eb grumbulloj\u00eb statistik\u00eb mbi ndryshimin e tekstit t\u00eb enkriptuar n\u00eb daljen dhe t\u00eb rikuperoj\u00eb vler\u00ebn e \u00e7el\u00ebsit t\u00eb ruajtur n\u00eb enklav\u00ebn SGX. <\/p>\n