{"id":124683,"date":"2025-05-13T15:05:07","date_gmt":"2025-05-13T13:05:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel"},"modified":"2026-01-24T17:56:45","modified_gmt":"2026-01-24T15:56:45","slug":"training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel","title":{"rendered":"Training Solo \u2014 variante t\u00eb reja t\u00eb sulmit Spectre-v2, q\u00eb prekin CPU Intel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb grup hulumtuesish nga Universitetei i Lir\u00eb t\u00eb Amsterdamit identifikoi disa dob\u00ebsi t\u00eb reja t\u00eb klas\u00ebs Spectre-v2, t\u00eb publikuara n\u00ebn emrin kodor Training Solo, t\u00eb cilat lejojn\u00eb anashkalimin e mekanizmave t\u00eb izolimit t\u00eb memories. N\u00eb kuad\u00ebr t\u00eb sistemeve t\u00eb virtualizimit, k\u00ebto dob\u00ebsi ofrojn\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrmbajtjen e memories s\u00eb ambientit host nga sistemet mysafir, dhe n\u00eb kontekstin e tipareve t\u00eb server\u00ebve \u2014 p\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrmbajtjen e memories s\u00eb b\u00ebrtham\u00ebs gjat\u00eb ekzekutimit t\u00eb nj\u00eb eksploiti n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit. Shembujt e eksploiteve p\u00ebr t\u00eb kryer sulme t\u00eb tilla jan\u00eb publikuar n\u00eb GitHub. Eksploit\u00ebt e paraqitur lejojn\u00eb nxjerrjen e t\u00eb dh\u00ebnave t\u00eb rast\u00ebsishme nga memoria e b\u00ebrtham\u00ebs me shpejt\u00ebsi 17 KB\/s, dhe nga memoria e hiperzhvilluesit \u2014 8.5 KB\/s. <\/p>\n
N\u00eb sulmet e klas\u00ebs Spectre-v2, p\u00ebr organizimin e rrjedhjes s\u00eb t\u00eb dh\u00ebnave p\u00ebrdoret z\u00ebvend\u00ebsimi i vlerave n\u00eb tamponin e adresave t\u00eb deg\u00ebve (Branch Target Buffer) ose tamponin e historis\u00eb s\u00eb kalimeve (Branch History Buffer), t\u00eb cilat p\u00ebrdoren p\u00ebr parashikimin e operacionit t\u00eb ardhsh\u00ebm t\u00eb deg\u00ebs. P\u00ebrmes manipulimeve me historin\u00eb e kalimeve krijohen kushte p\u00ebr parashikimin e gabuar t\u00eb kalimit gjat\u00eb ekzekutimit spekulativ t\u00eb instrukcioneve. Q\u00ebllimi i sulmuesit \u00ebsht\u00eb q\u00eb gjat\u00eb ekzekutimit t\u00eb nj\u00eb operacioni spekulativ t\u00eb deg\u00ebs, adresa p\u00ebr kalim t\u00eb jet\u00eb e marr\u00eb nga zona e d\u00ebshiruar e memorjes. Pas p\u00ebrfundimit t\u00eb kalimit spekulativ, n\u00eb cache t\u00eb procesorit mbetet adresa e kalimit e lexuar nga memoria (n\u00ebn form\u00ebn e adres\u00ebs, t\u00eb dh\u00ebnat e nevojshme p\u00ebr sulmuesin lexohen nga memoria). Nj\u00eb nga metodat e nxjerrjes s\u00eb informacionit nga cache mund t\u00eb p\u00ebrdor\u00eb nj\u00eb m\u00ebnyr\u00eb identifikimi t\u00eb p\u00ebrmbajtjes s\u00eb cache bazuar n\u00eb analiz\u00ebn e ndryshimit t\u00eb koh\u00ebs s\u00eb aksesit n\u00eb t\u00eb dh\u00ebnat e cache dhe ato q\u00eb nuk jan\u00eb t\u00eb cache. <\/p>\n
Metodat e sulmit Training Solo synojn\u00eb t\u00eb anashkalojn\u00eb mekanizmat e izolimit t\u00eb hap\u00ebsirave t\u00eb ekzekutimit (domain isolation), t\u00eb tilla si IBPB, eIBRS dhe BHI_NO, t\u00eb aplikuara p\u00ebr t\u00eb bllokuar sulmet e klas\u00ebs Spectre-v2. P\u00ebr shembull, instruksioni IBPB (Bllokadat e Parashikimit t\u00eb Deg\u00ebve Indirekte) siguron rivendosjen e gjendjes s\u00eb bllokut t\u00eb parashikimit t\u00eb kalimeve n\u00eb \u00e7do kalim konteksti \u2014 gjat\u00eb kalimit t\u00eb kontrollit midis hap\u00ebsir\u00ebs s\u00eb p\u00ebrdoruesit dhe b\u00ebrtham\u00ebs ose midis sistemit mysafir dhe ambientit host. Rivendosja e gjendjes bllokon mund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb kodit t\u00eb vet p\u00ebr t\u00eb ndikuar n\u00eb sjelljen e bllokut t\u00eb parashikimit t\u00eb kalimeve indirekte. <\/p>\n
Dallimet e metodave Training Solo jan\u00eb se p\u00ebr t\u00eb ndikuar n\u00eb bllokun e parashikimit t\u00eb kalimeve propozohet t\u00eb mos ekzekutohet kodi i kontrolluar nga sulmuesi, por t\u00eb p\u00ebrdoret kodi q\u00eb tashm\u00eb ekziston n\u00eb an\u00ebn e zon\u00ebs privilegjuar t\u00eb ekzekutimit (n\u00eb b\u00ebrtham\u00eb ose hipervizor), nga i cili sulmuesi arrin t\u00eb nxjerr\u00eb informacione. P\u00ebr t\u00eb tjerat, metodat jan\u00eb t\u00eb ngjashme me sulmin klasik Spectre-v2. P\u00ebrve\u00e7 k\u00ebsaj, studiuesit zbuluan dy probleme harduerike (CVE-2024-28956 dhe CVE-2025-24495) q\u00eb lejojn\u00eb t\u00eb anashkalojn\u00eb plot\u00ebsisht izolimin e zonave t\u00eb ekzekutimit dhe t\u00eb realizojn\u00eb rrjedhje nga proceset e p\u00ebrdoruesve t\u00eb tjer\u00eb, sistemeve t\u00eb tjera mysafir\u00eb ose mjedisit t\u00eb hostit.
<\/center> <\/p>\n
Tre lloje sulmesh Training Solo jan\u00eb propozuar: <\/p>\n
\n
Keqinterpretimi i logjik\u00ebs s\u00eb parashikimit t\u00eb kalimeve p\u00ebrmes thirrjes s\u00eb sekuencave t\u00eb komandave ekzistuese n\u00eb b\u00ebrtham\u00eb (gadgeteve), q\u00eb ndikon n\u00eb p\u00ebrmbajtjen e buferit me historin\u00eb e kalimeve. Si gadgete t\u00eb tilla propozohet t\u00eb p\u00ebrdoret mekanizmi i kufizimit t\u00eb qasjes n\u00eb thirrjet sistemike SECCOMP, i cili lejon, p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb filtrave t\u00eb tij BPF, t\u00eb arrij\u00eb nj\u00eb kalim t\u00eb rrem\u00eb indirekt n\u00eb modin spekullativ (filtrat n\u00eb SECCOMP vendosen p\u00ebrmes cBPF t\u00eb klas\u00ebs, t\u00eb cilat jan\u00eb t\u00eb aktivizuara n\u00eb m\u00ebnyr\u00eb t\u00eb parazgjedhur n\u00eb krahasim me eBPF). Gjat\u00eb testimeve n\u00eb CPU-n\u00eb Intel Tiger Lake dhe Lion Cove, shpejt\u00ebsia e rrjedhjes me k\u00ebt\u00eb metod\u00eb ishte 1.7KB\/sek.\n
P\u00ebrdorimi i kolizion\u00ebve IP (Instruction Pointer) n\u00eb bllokun e parashikimit t\u00eb kalimeve. Sulmuesi mund t\u00eb krijoj\u00eb kushte n\u00eb t\u00eb cilat adresa p\u00ebr kalimin spekullativ do t\u00eb zgjidhet vet\u00ebm n\u00eb baz\u00eb t\u00eb adres\u00ebs s\u00eb kalimit tashm\u00eb t\u00eb pranishme n\u00eb bufer, pa marr\u00eb parasysh historin\u00eb e kalimeve. Ideja \u00ebsht\u00eb se nj\u00eb operacion kalimi indirekt mund t\u00eb ndikoj\u00eb n\u00eb nj\u00eb tjet\u00ebr, n\u00ebse ndodh kolizioni gjat\u00eb ruajtjes s\u00eb hashes s\u00eb adresave t\u00eb tyre n\u00eb BTB (Branch Target Buffer).\n
P\u00ebrdorimi i ndikimit t\u00eb kalimeve direkte n\u00eb parashikimin e kalimeve indirekte. Nj\u00eb sjellje e till\u00eb \u00ebsht\u00eb shkaktuar nga dy dob\u00ebsi harduerike: CVE-2024-28956 \u2014 ITS (Zgjedhja Indirekte e Objektivit) dhe CVE-2025-24495 \u2014 nj\u00eb problem n\u00eb CPU-n\u00eb Intel me b\u00ebrthama Lion Cove. Shpejt\u00ebsia e rrjedhjes s\u00eb t\u00eb dh\u00ebnave nga memoria gjat\u00eb p\u00ebrdorimit t\u00eb k\u00ebtij \u043c\u0435\u0442\u043e\u0434i arrin 17 KB\/s. N\u00eb eksploatin e demonstruar p\u00ebr p\u00ebrcaktimin e hash-it t\u00eb fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit root, t\u00eb ruajtur n\u00eb memorie pas ekzekutimit t\u00eb komand\u00ebs \u00abpasswd -s\u00bb, u shpenzuan 60 sekonda. <\/ul>\n
![\"Training](\"\/wp-content\/uploads\/2025\/05\/aab3af31923044fc239d55ff8b7846b4.png\")
<\/center> <\/p>\n![\"Training](\"\/wp-content\/uploads\/2025\/05\/14076832d38911938e435cf800505ac7.png\")
<\/center> <\/p>\n