{"id":124683,"date":"2025-05-13T15:05:07","date_gmt":"2025-05-13T13:05:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel"},"modified":"2026-01-24T17:56:45","modified_gmt":"2026-01-24T15:56:45","slug":"training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel","title":{"rendered":"Training Solo \u2014 variacione t\u00eb reja sulmesh Spectre-v2, q\u00eb ndodhin n\u00eb CPU-t\u00eb Intel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb grup hulumtuesish nga Universiteti i Lir\u00eb i Amsterdamit ka zbuluar disa dob\u00ebsi t\u00eb reja t\u00eb klas\u00ebs Spectre-v2, t\u00eb publikuara me emrin kodik Training Solo, t\u00eb cilat lejojn\u00eb kalimin p\u00ebrmes mekanizmave t\u00eb izolimit t\u00eb memories. N\u00eb kontekstin e sistemeve t\u00eb virtualizimit, k\u00ebto dob\u00ebsi ofrojn\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrmbajtjen e memories s\u00eb mjedisit host nga sistemet mysafire, dhe n\u00eb kontekstin e server\u00ebve - p\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrmbajtjen e memories s\u00eb b\u00ebrtham\u00ebs gjat\u00eb ekzekutimit t\u00eb nj\u00eb eksploitimi n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit. Shembujt e eksploitimeve p\u00ebr t\u00eb kryer sulme t\u00eb tilla jan\u00eb publikuar n\u00eb GitHub. Eksploit\u00ebt e paraqitur lejojn\u00eb nxjerrjen e t\u00eb dh\u00ebnave t\u00eb rastit nga memoria e b\u00ebrtham\u00ebs me shpejt\u00ebsi 17 KB\/s, dhe nga memoria e hipervizorit - 8.5 KB\/s. <\/p>\n
N\u00eb sulmet e klas\u00ebs Spectre-v2, p\u00ebr t\u00eb organizuar rrjedhjet e t\u00eb dh\u00ebnave, p\u00ebrdoret z\u00ebvend\u00ebsimi i vlerave n\u00eb tamponin e adres\u00ebs s\u00eb degeve (Branch Target Buffer) ose tamponi i historis\u00eb s\u00eb kalimeve (Branch History Buffer), t\u00eb cilat p\u00ebrdoren p\u00ebr parashikimin e operacionit t\u00eb ardhsh\u00ebm t\u00eb degeve. P\u00ebrmes manipulimeve me historin\u00eb e kalimeve krijohen kushte p\u00ebr parashikimin e gabuar t\u00eb deges gjat\u00eb ekzekutimit spekulativ t\u00eb instrukcioneve. Objektivi i sulmuesit \u00ebsht\u00eb q\u00eb gjat\u00eb ekzekutimit t\u00eb nj\u00eb operacioni spekulativ t\u00eb deges, adresa p\u00ebr kalimin t\u00eb merret nga nj\u00eb zon\u00eb e d\u00ebshiruar e memories. Pas ekzekutimit t\u00eb kalimit spekulativ, n\u00eb cache-in e procesorit mbetet adresa e lexuar nga memoria (n\u00eb form\u00ebn e adrese q\u00eb lexon t\u00eb dh\u00ebnat e nevojshme p\u00ebr sulmuesin nga memoria). Nj\u00eb nga metodat p\u00ebr nxjerrjen e informacionit nga cache mund t\u00eb jet\u00eb nj\u00eb m\u00ebnyr\u00eb e p\u00ebrcaktimit t\u00eb p\u00ebrmbajtjes s\u00eb cache-it, bazuar n\u00eb analiz\u00ebn e ndryshimit t\u00eb koh\u00ebs s\u00eb aksesit n\u00eb t\u00eb dh\u00ebna t\u00eb mbajtura n\u00eb cache dhe jo t\u00eb mbajtura n\u00eb cache. <\/p>\n
Metodat e sulmit Training Solo synojn\u00eb kalimin p\u00ebrmes mekanizmave t\u00eb izolimit t\u00eb fushave t\u00eb ekzekutimit (domain isolation), si IBPB, eIBRS dhe BHI_NO, t\u00eb cilat p\u00ebrdoren p\u00ebr t\u00eb bllokuar sulmet e klas\u00ebs Spectre-v2. P\u00ebr shembull, instruksioni IBPB (Indirect Branch Prediction Barriers) siguron pastrimin e gjendjes s\u00eb bllokut t\u00eb parashikimi t\u00eb kalimeve me \u00e7do nd\u00ebrrim konteksti - kur kalon kontrollin midis hap\u00ebsir\u00ebs s\u00eb p\u00ebrdoruesit dhe b\u00ebrtham\u00ebs ose midis sistemit mysafir dhe mjedisit host. Pastrimi i gjendjes bllokon mund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb kodit t\u00eb vet p\u00ebr t\u00eb ndikuar n\u00eb sjelljen e bllokut t\u00eb parashikimit t\u00eb kalimeve indirekte. <\/p>\n
Dallimet n\u00eb metodat e Training Solo jan\u00eb se p\u00ebr t\u00eb ndikuar n\u00eb bllokun e parashikimit t\u00eb kalimeve, propozohet t\u00eb mos ekzekutohet kodi q\u00eb \u00ebsht\u00eb n\u00ebn kontrollin e sulmuesit, por t\u00eb p\u00ebrdoret kodi q\u00eb tashm\u00eb ekziston n\u00eb an\u00ebn e zon\u00ebs privilegjuese t\u00eb ekzekutimit (b\u00ebrthama ose hipervizori), nga e cila sulmuesi synon t\u00eb arrij\u00eb rrjedhjet. N\u00eb t\u00eb tjera aspekte, metodat jan\u00eb t\u00eb ngjashme me sulmin klasik Spectre-v2. P\u00ebrve\u00e7 k\u00ebsaj, hulumtuesit identifikuan dy probleme harduerike (CVE-2024-28956 dhe CVE-2025-24495) q\u00eb lejojn\u00eb kalimin e plot\u00eb t\u00eb izolimit t\u00eb zonave t\u00eb ekzekutimit dhe realizimin e rrjedhjeve nga proceset e p\u00ebrdoruesve t\u00eb tjer\u00eb, sistemet mysafir\u00eb t\u00eb tjer\u00eb ose ambientin host.
<\/center> <\/p>\n
Jan\u00eb propozuar tre lloje sulmesh Training Solo: <\/p>\n
\n
Shkurtimi i logjik\u00ebs s\u00eb parashikimit t\u00eb kalimeve p\u00ebrmes thirrjes s\u00eb sekuencave t\u00eb komandave q\u00eb tashm\u00eb ekzistojn\u00eb n\u00eb b\u00ebrtham\u00eb (gadget), q\u00eb ndikojn\u00eb n\u00eb p\u00ebrmbajtjen e tamponit t\u00eb historis\u00eb s\u00eb kalimeve. Si gadgete t\u00eb till\u00eb propozohet p\u00ebrdorimi i mekanizmit t\u00eb kufizimit t\u00eb aksesit n\u00eb thirrjet sistemike SECCOMP, i cili lejon p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb filtreve t\u00eb tij BPF t\u00eb arrij\u00eb nj\u00eb kalim t\u00eb gabuar t\u00eb orientuar n\u00eb nj\u00eb mod spekulativ (filtrat n\u00eb SECCOMP p\u00ebrcaktohen p\u00ebrmes cBPF klasike, t\u00eb aktivizuar nga default n\u00eb krahasim me eBPF). Gjat\u00eb testimit n\u00eb CPU Intel Tiger Lake dhe Lion Cove, shpejt\u00ebsia e rrjedhjes me k\u00ebt\u00eb metod\u00eb ishte 1.7 KB\/s.\n
P\u00ebrdorimi i kolizionit t\u00eb IP (Instruction Pointer) n\u00eb bllokun e parashikimit t\u00eb kalimeve. Sulmuesi mund t\u00eb krijoj\u00eb kushte, n\u00eb t\u00eb cilat adresa p\u00ebr nj\u00eb kalim spekulativ do t\u00eb zgjidhte vet\u00ebm bazuar n\u00eb adres\u00ebn e kalimit t\u00eb tash\u00ebm n\u00eb tampon, pa marr\u00eb parasysh historin\u00eb e kalimeve. Ideja \u00ebsht\u00eb se nj\u00eb operacion i kalimit t\u00ebrthor mund t\u00eb ndikoj\u00eb n\u00eb tjetrin, n\u00ebse ndodh nj\u00eb kolizion n\u00eb ruajtjen e hash-eve t\u00eb adresave t\u00eb tyre n\u00eb BTB (Branch Target Buffer).\n
P\u00ebrdorimi i ndikimit t\u00eb kalimeve t\u00eb drejtp\u00ebrdrejta n\u00eb parashikimin e kalimeve indirekte. Nj\u00eb sjellje e till\u00eb shkaktohet nga dy dob\u00ebsi harduerike: CVE-2024-28956 - ITS (Indirect Target Selection) dhe CVE-2025-24495 - nj\u00eb problem n\u00eb CPU-t\u00eb Intel me b\u00ebrthama Lion Cove. Shpejt\u00ebsia e rrjedhjes s\u00eb t\u00eb dh\u00ebnave nga memoria duke p\u00ebrdorur k\u00ebt\u00eb metod\u00eb ishte 17 KB\/s. N\u00eb eksploitimin e demonstruar p\u00ebr t\u00eb p\u00ebrcaktuar hash-in e fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit root, t\u00eb ruajtur n\u00eb memorie pas thirrjes s\u00eb komand\u00ebs \"passwd -s\", u shpenzuan 60 sekonda. <\/ul>\n
![\"Training](\"\/wp-content\/uploads\/2025\/05\/aab3af31923044fc239d55ff8b7846b4.png\")
<\/center> <\/p>\n![\"Training](\"\/wp-content\/uploads\/2025\/05\/14076832d38911938e435cf800505ac7.png\")
<\/center> <\/p>\n