{"id":123472,"date":"2025-04-11T15:05:18","date_gmt":"2025-04-11T13:05:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp"},"modified":"2025-04-11T15:05:18","modified_gmt":"2025-04-11T13:05:18","slug":"cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","title":{"rendered":"CPU AMD Zen 5 jan\u00eb t\u00eb ndjesh\u00ebm ndaj nj\u00eb dob\u00ebsie, q\u00eb lejon ndryshimin e mikro-kodit dhe shkeljen e izolimit SEV-SNP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania AMD ka p\u00ebrfshir\u00eb procesor\u00ebt e bazuar n\u00eb mikroarkitektur\u00ebn Zen 5 n\u00eb list\u00ebn e produkteve t\u00eb prekura nga vulnerabiliteti EntrySign, i cili lejon anashkalimin e mekanizmit t\u00eb verifikimit t\u00eb n\u00ebnshkrimit digjital gjat\u00eb p\u00ebrdit\u00ebsimit t\u00eb mikro kodit. Fillimisht, ishte menduar se vulnerabiliteti ndikonte vet\u00ebm CPU AMD t\u00eb bazuar n\u00eb 1-4 gjenerata t\u00eb mikroarkitektur\u00ebs Zen. K\u00ebshtu, vulnerabiliteti ka rezultuar t\u00eb jet\u00eb i aplikuesh\u00ebm p\u00ebr procesor\u00eb si Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen AI 300 (Strix Halo, Strix Point, Krackan Point) dhe Ryzen 9000HX (Fire Range). <\/p>\n

P\u00ebrve\u00e7 p\u00ebrdit\u00ebsimit t\u00eb mikro kodit, p\u00ebr eliminimin e vulnerabilitetit n\u00eb sistemet q\u00eb p\u00ebrdorin verifikimin SEV-SNP, \u00ebsht\u00eb e nevojshme gjithashtu p\u00ebrdit\u00ebsimi i firmware-it AMD SEV, i cili ofrohet si pjes\u00eb e p\u00ebrdit\u00ebsimeve t\u00eb BIOS. Raportohet se kompania AMD i ka transferuar prodhuesve t\u00eb pajisjeve firmware-in e modifikuar (ComboAM5PI 1.2.0.3c AGESA) e nevojshme p\u00ebr zgjidhjen e problemit, por p\u00ebrdit\u00ebsimet e fundit t\u00eb BIOS n\u00eb dispozicion p\u00ebr konsumator\u00ebt mund t\u00eb l\u00ebshohen nga prodhuesit pas jav\u00ebsh ose muajsh. <\/p>\n

Punonj\u00ebsit e AMD gjithashtu kan\u00eb propozuar p\u00ebrfshirjen e nj\u00eb patch-i n\u00eb b\u00ebrtham\u00ebn Linux q\u00eb bllokon ngarkimin e p\u00ebrdit\u00ebsimeve t\u00eb mikrokodit jozyrtare (duhet theksuar se p\u00ebrdit\u00ebsimet korrekte t\u00eb mikrokodit duhet t\u00eb instalohen s\u00eb bashku me BIOS nga prodhuesi i pajisjeve, por tashm\u00eb kan\u00eb filluar p\u00ebrpjekjet e entuziast\u00ebve p\u00ebr t\u00eb krijuar rregullime jozyrtare, t\u00eb bazuara n\u00eb fragmente mikrokodi t\u00eb prer\u00eb nga BIOS). P\u00ebrdoruesit rekomandohen t\u00eb presin p\u00ebrdit\u00ebsimet zyrtare t\u00eb BIOS. <\/p>\n

Vulnerabiliteti EntrySign ofron mund\u00ebsin\u00eb e ndryshimit t\u00eb mikrokodit, duke e mund\u00ebsuar kompromentimin e mekanizmit AMD SEV (Secure Encrypted Virtualization), i cili p\u00ebrdoret n\u00eb sistemet e virtualizimit p\u00ebr mbrojtje makinat virtuale<\/a> nga nd\u00ebrhyrja e hypervisor ose administratorit t\u00eb sistemit host. Gjat\u00eb nj\u00eb sulmi, mund t\u00eb futesh n\u00eb funksionimin e sistemeve t\u00eb mysafir\u00ebve, t\u00eb mbrojtura me ndihm\u00ebn e zgjerimeve AMD SEV (Secure Encrypted Virtualization) dhe SEV-SNP (Secure Nested Paging), t\u00eb cilat ofrojn\u00eb garanci t\u00eb integritetit t\u00eb memories s\u00eb makinave virtuale, duke izoluara regjistrat e procesorit dhe duke siguruar funksionimin e sigurt me tabelat e brendshme t\u00eb memories. <\/p>\n

Vulnerabiliteti shkaktohet nga p\u00ebrdorimi i algoritmit t\u00eb imitosh\u00ebm CMAC n\u00eb procesin e verifikimit t\u00eb mikro-kodit, n\u00eb vend t\u00eb nj\u00eb funksioni t\u00eb sigurt hash. Kompania AMD p\u00ebrdor nj\u00eb \u00e7el\u00ebs t\u00eb mbyllur RSA p\u00ebr t\u00eb n\u00ebnshkruar mikro-kodin q\u00eb ngarkohet n\u00eb procesor, nd\u00ebrsa p\u00ebrmban nj\u00eb \u00e7el\u00ebs t\u00eb hapur si pjes\u00eb e patch-it t\u00eb mikro-kodit. P\u00ebr t\u00eb verifikuar se \u00e7el\u00ebsi i hapur korrespondon me \u00e7iftin origjinal t\u00eb \u00e7el\u00ebsave RSA, procesori kryen nj\u00eb krahasim t\u00eb hash-it nga \u00e7el\u00ebsi i hapur AMD, i futur gjat\u00eb prodhimit n\u00eb CPU, me hash-in nga \u00e7el\u00ebsi i hapur i specifikuar n\u00eb patch. <\/p>\n

Verifikimi i autenticitetit t\u00eb mikro-code n\u00eb patch b\u00ebhet p\u00ebrmes krahasimit t\u00eb hash-it t\u00eb siguruar me patch-in me n\u00ebnshkrim digjital (RSASSA-PKCS1-v1_5) dhe hash-it t\u00eb llogaritur bazuar n\u00eb mikro-code-n q\u00eb \u00ebsht\u00eb realisht e ofruar n\u00eb patch. Problemi \u00ebsht\u00eb se n\u00eb vend t\u00eb p\u00ebrdorimit t\u00eb funksioneve hash t\u00eb rekomanduara q\u00eb jan\u00eb t\u00eb q\u00ebndrueshme ndaj kriptimit, \u00ebsht\u00eb p\u00ebrdorur algoritmi CMAC, i cili nuk \u00ebsht\u00eb i dizajnuar p\u00ebr t\u00eb tilla operacione dhe nuk \u00ebsht\u00eb i mbrojtur nga gjetja e kolizioneve. <\/p>\n

CMAC nuk \u00ebsht\u00eb nj\u00eb funksion hash, por realizon nj\u00eb imitosh (Message Authentication Code) q\u00eb varet nga \u00e7el\u00ebsi i enkriptimit. Funksionimi i AES-CMAC p\u00ebrfshin p\u00ebrdorimin e algoritmit kriptografik AES dhe kombinimin e rezultatit t\u00eb tij me bllokun e dh\u00ebnave t\u00eb ardhsh\u00ebm p\u00ebrmes operacionit XOR. Ky skem\u00eb garanton q\u00eb ndryshimi i t\u00eb dh\u00ebnave hyr\u00ebse do t\u00eb sjell\u00eb nj\u00eb ndryshim t\u00eb paparashikuesh\u00ebm n\u00eb t\u00eb dh\u00ebnat n\u00eb dalje. Megjithat\u00eb, CMAC nuk duhet t\u00eb p\u00ebrdoret si nj\u00eb funksion hash, pasi kushdo q\u00eb e di \u00e7el\u00ebsin e enkriptimit mund t\u00eb zbuloj\u00eb gjendjet nd\u00ebrmjet\u00ebse t\u00eb enkriptimit dhe t\u00eb llogaris\u00eb vlerat q\u00eb mund t\u00eb kompenzojn\u00eb ndryshimin n\u00eb t\u00eb dh\u00ebnat hyr\u00ebse, n\u00eb m\u00ebnyr\u00eb q\u00eb rezultati i p\u00ebrdorimit t\u00eb CMAC t\u00eb mbetet i pandryshuar. <\/p>\n

AMD p\u00ebrdor nj\u00eb \u00e7el\u00ebs t\u00eb vet\u00ebm p\u00ebr AES-CMAC, i ofruar n\u00eb t\u00eb gjitha CPU-t\u00eb q\u00eb nga Zen 1. K\u00ebshtu, mjafton t\u00eb nxirret ky \u00e7el\u00ebs nga \u00e7do CPU AMD dhe do t\u00eb jet\u00eb i aplikuesh\u00ebm n\u00eb t\u00eb gjitha CPU-t\u00eb e tjera. K\u00ebrkuesit zbuluan se p\u00ebr enkriptimin AES-CMAC n\u00eb AMD \u00ebsht\u00eb p\u00ebrdorur nj\u00eb \u00e7el\u00ebs i njohur, i marr\u00eb nga nj\u00eb shembull i p\u00ebrmendur n\u00eb rekomandimet p\u00ebr p\u00ebrdorimin e algoritmeve t\u00eb bllokimeve, NIST SP 800-38B. Duke qen\u00eb se AES-CMAC p\u00ebrdoret p\u00ebr hashimin e \u00e7el\u00ebsit RSA t\u00eb integruar dhe p\u00ebrmbajtjes s\u00eb mikrokodit, duke p\u00ebrcaktuar \u00e7el\u00ebsin e enkriptimit AES-CMAC, u krijua mund\u00ebsia p\u00ebr t\u00eb z\u00ebvend\u00ebsuar n\u00eb patch nj\u00eb \u00e7el\u00ebs tjet\u00ebr t\u00eb hapur RSA dhe p\u00ebr t\u00eb ndryshuar p\u00ebrmbajtjen e mikrokodit. <\/p>\n

P\u00ebr t\u00eb krijuar nj\u00eb patch fals, mjafton t\u00eb formohet nj\u00eb \u00e7el\u00ebs i ri i hapur, q\u00eb gjeneron t\u00eb nj\u00ebjtin hash si \u00e7el\u00ebsi i v\u00ebrtet\u00eb i hapur AMD, si dhe t\u00eb gjenden kolizionet p\u00ebr n\u00ebnshkrimin digjital. Kolizionet formohen duke ngjitur nj\u00eb bllok shtes\u00eb n\u00eb mikrokod, q\u00eb duket si nj\u00eb grup t\u00eb dh\u00ebnash t\u00eb rast\u00ebsishme. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, mund t\u00eb p\u00ebrgatitet nj\u00eb patch t\u00eb ndryshuar me mikrokod, q\u00eb i p\u00ebrket n\u00ebnshkrimit digjital me t\u00eb cilin patch-i origjinal nga AMD \u00ebsht\u00eb vulosur. Mjeti Zentool, q\u00eb p\u00ebrfshin utilitetet p\u00ebr analiz\u00ebn e mikrokodit dhe krijimin e patch-eve p\u00ebr ndryshimin e mikrokodit, \u00ebsht\u00eb i disponuesh\u00ebm me licenc\u00ebn Apache 2.0. P\u00ebr t\u00eb z\u00ebvend\u00ebsuar mikrokodin, k\u00ebrkohen t\u00eb drejta p\u00ebr t\u00eb ekzekutuar kodin n\u00eb nivelin e zero t\u00eb mbrojtjes (teknologjit\u00eb VT-x dhe AMD-V lejojn\u00eb sistemin mik t\u00eb operoj\u00eb me t\u00eb drejta Ring 0).
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e CPU AMD \u043d\u0430 \u0431\u0430\u0437\u0435 1-4 \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u0439 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u0430 \u043a \u0442\u0430\u043a\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c, \u043a\u0430\u043a Ryzen 9000 (Granite Ridge), EPYC 9005 (Turin), Ryzen […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123472","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47CPU-t\u00eb AMD Zen 5 jan\u00eb t\u00eb ndjesh\u00ebm ndaj nj\u00eb vulnerabiliteti q\u00eb lejon ndryshimin e mikrokodit dhe kalimin e izolimit SEV-SNP | ProHoster","description":"Kompania AMD p\u00ebrfshiu procesor\u00ebt e bazuar n\u00eb mikroarkitektur\u00ebn Zen 5 n\u00eb list\u00ebn e produkteve t\u00eb ndjeshme ndaj shp\u00ebrthimit EntrySign, q\u00eb lejon kalimin e mekanizmit t\u00eb verifikimit t\u00eb n\u00ebnshkrimit digjital gjat\u00eb p\u00ebrdit\u00ebsimit t\u00eb mikrokodit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47CPU AMD Zen 5 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0445\u043e\u0434 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 SEV-SNP | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f AMD \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u043c\u0438\u043a\u0440\u043e\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b Zen 5 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EntrySign, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/cpu-amd-zen-5-podverzheny-uyazvimosti-dopuskayushhej-izmenenie-mikrokoda-i-obhod-izolyaczii-sev-snp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-11T13:05:18+00:00","article:modified_time":"2025-04-11T13:05:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123472","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:44:58","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:10:19","updated":"2026-02-09 17:44:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/123472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=123472"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/123472\/revisions"}],"predecessor-version":[{"id":159262,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/123472\/revisions\/159262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=123472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=123472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=123472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}