K\u00ebrkuesit nga Universiteti i Birminghamit, t\u00eb njohur m\u00eb par\u00eb p\u00ebr zhvillimin e sulmeve Plundervolt dhe VoltPillager, zbuluan nj\u00eb dob\u00ebsi (CVE-2022-43309) n\u00eb disa pllak\u00ebz\u00eb server\u00ebsh, e cila lejon d\u00ebshtimin fizik t\u00eb CPU-s\u00eb pa mund\u00ebsi p\u00ebr ta rikuperuar at\u00eb m\u00eb pas. Dob\u00ebsia, e cila mori emrin e kodit PMFault, mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb d\u00ebmtuar server\u00ebt, p\u00ebr t\u00eb cil\u00ebt sulmuesi nuk ka qasje fizike, por ka qasje privilegjuese n\u00eb sistemin operativ, e fituar p\u00ebr shembull si rezultat i shfryt\u00ebzimit t\u00eb nj\u00eb dob\u00ebsie t\u00eb pap\u00ebrmir\u00ebsuar ose kapjes s\u00eb kredencialeve t\u00eb administratorit. <\/p>\n
Thelbi i metod\u00ebs s\u00eb propozuar \u00ebsht\u00eb p\u00ebrdorimi i nd\u00ebrfaqes PMBus, n\u00eb t\u00eb cil\u00ebn aplikohet protokolli I2C, p\u00ebr t\u00eb rritur tensionin e dh\u00ebn\u00eb CPU-s\u00eb n\u00eb nivele q\u00eb shkaktojn\u00eb d\u00ebmtim t\u00eb \u00e7ipit. Nd\u00ebrfaqja PMBus zakonisht implementohet n\u00eb modulimin VRM (Voltage Regulator Module), akses n\u00eb t\u00eb cilin mund t\u00eb merret p\u00ebrmes manipulimeve me kontrollorin BMC. P\u00ebr t\u00eb kryer nj\u00eb sulm n\u00eb pllaka q\u00eb mb\u00ebshtesin PMBus, p\u00ebrve\u00e7 privilegjeve t\u00eb administratorit n\u00eb sistemin operativ, nevojitet akses softuerik n\u00eb BMC (Baseboard Management Controller), p\u00ebr shembull, p\u00ebrmes nd\u00ebrfaqes IPMI KCS (Keyboard Controller Style), p\u00ebrmes Ethernet-it ose p\u00ebrmes ribllokimit t\u00eb BMC nga sistemi aktual. <\/p>\n
Prania e nj\u00eb problemi q\u00eb lejon kryerjen e nj\u00eb sulmi pa njohuri mbi parametrat e autentikimit n\u00eb BMC, \u00ebsht\u00eb konfirmuar n\u00eb pllak\u00ebz\u00ebt Supermicro me mb\u00ebshtetje p\u00ebr IPMI (X11, X12, H11 dhe H12) dhe ASRock, por dob\u00ebsit\u00eb jan\u00eb t\u00eb prekshme edhe n\u00eb pllaka t\u00eb tjera server\u00ebsh, ku mund t\u00eb merret akses n\u00eb PMBus. Gjat\u00eb eksperimenteve t\u00eb kryera, rritja e tensionit deri n\u00eb 2.84 volt n\u00eb k\u00ebto pllaka shkaktoi d\u00ebmtimin e dy procesor\u00ebve Intel Xeon. P\u00ebr t\u00eb aksesuar BMC pa njohuri mbi parametrat e autentikimit, por me qasje root n\u00eb sistemin operativ, u p\u00ebrdor nj\u00eb dob\u00ebsi n\u00eb mekanizmin e verifikimit t\u00eb firmware, e cila lejon ngarkimin e nj\u00eb azhurnimi t\u00eb ndryshuar t\u00eb firmware n\u00eb kontrollorin BMC, si dhe mund\u00ebsin\u00eb e aksesit pa autentikim p\u00ebrmes IPMI KCS. <\/p>\n
Metoda e ndryshimit t\u00eb tensionit p\u00ebrmes PMBus gjithashtu mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kryer nj\u00eb sulm Plundervolt, i cili lejon q\u00eb duke ulur tensionin n\u00eb nivele minime t\u00eb shkaktoj\u00eb d\u00ebmtimin e p\u00ebrmbajtjes s\u00eb qelizave me t\u00eb dh\u00ebna n\u00eb CPU, t\u00eb cilat p\u00ebrdoren n\u00eb llogaritjet n\u00eb enklavat e izoluara Intel SGX dhe t\u00eb gjeneroj\u00eb gabime n\u00eb algoritmet fillimisht t\u00eb sakta. P\u00ebr shembull, n\u00ebse arrihet t\u00eb ndryshohet vlera e p\u00ebrdorur gjat\u00eb shum\u00ebzimit n\u00eb procesin e enkriptimit, rezultati do t\u00eb jet\u00eb nj\u00eb tekst i enkriptuar i gabuar. Duke pasur mund\u00ebsin\u00eb p\u00ebr t\u00eb aksesuar p\u00ebrpunuesin n\u00eb SGX p\u00ebr t\u00eb enkriptuar t\u00eb dh\u00ebnat e tij, sulmuesi mund, duke shkaktuar d\u00ebshtime, t\u00eb grumbulloj\u00eb statistik\u00eb mbi ndryshimin e tekstit t\u00eb enkriptuar n\u00eb dalje dhe t\u00eb rikthej\u00eb vler\u00ebn e \u00e7el\u00ebsit q\u00eb ruhet n\u00eb enklav\u00ebn SGX. <\/p>\n