{"id":182817,"date":"2026-08-10T19:49:35","date_gmt":"2026-08-10T17:49:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2"},"modified":"2026-08-10T19:49:35","modified_gmt":"2026-08-10T17:49:35","slug":"tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","title":{"rendered":"TONTOU \u2014 sulm mbi CPU-t\u00eb Intel dhe AMD, q\u00eb lejon anashkalimin e mbrojtjes nga dob\u00ebsit\u00eb Spectre v2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Studiues nga Instituti i Teknologjis\u00eb i Massachusetts kan\u00eb identifikuar teknik\u00ebn e sulmit TONTOU (Time-of-Neutralization to Time-of-Use), e cila ofron nj\u00eb m\u00ebnyr\u00eb t\u00eb re p\u00ebr t\u00eb shfryt\u00ebzuar cenueshm\u00ebrit\u00eb mikroarkitekturore t\u00eb klas\u00ebs Spectre v2. Cenueshm\u00ebria b\u00ebn t\u00eb mundur p\u00ebrcaktimin e p\u00ebrmbajtjes s\u00eb memories s\u00eb kernel-it gjat\u00eb ekzekutimit t\u00eb eksploitit n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit. Kodi p\u00ebr bllokimin e shfryt\u00ebzimit t\u00eb k\u00ebsaj cenueshm\u00ebrie u pranua n\u00eb kernel-in Linux m\u00eb 5 gusht dhe u p\u00ebrfshi n\u00eb versionet 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214 dhe 5.10.263. <\/p>\n
Studiuesit demonstruan mund\u00ebsin\u00eb e kryerjes s\u00eb sulmit nga nj\u00eb p\u00ebrdorues lokal pa privilegje p\u00ebr t\u00eb p\u00ebrcaktuar hash-in e fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit root, i ruajtur n\u00eb skedarin \/etc\/shadow dhe i ngarkuar n\u00eb memorie gjat\u00eb autentifikimit n\u00eb sistem. Studiuesit arrit\u00ebn t\u00eb siguronin rrjedhje t\u00eb t\u00eb dh\u00ebnave nga memoria e kernel-it me nj\u00eb shpejt\u00ebsi prej 5.47 bajt n\u00eb sekond\u00eb dhe me sakt\u00ebsi 91.97%. Nga 10 ekzekutime prov\u00eb t\u00eb eksploitit, q\u00eb mesatarisht zgjat\u00ebn 18 minuta, n\u00eb gjysm\u00ebn e rasteve u arrit t\u00eb p\u00ebrcaktohej me sukses prania e skedarit \/etc\/shadow n\u00eb memorie dhe t\u00eb nxirrej p\u00ebrmbajtja e tij. <\/p>\n
Eksploiti u demonstrua n\u00eb sisteme me procesor\u00eb AMD dhe mund t\u00eb p\u00ebrdoret me CPU AMD t\u00eb familjeve Zen 1-4. N\u00eb sistemet Intel, sulmi \u00ebsht\u00eb gjithashtu i mundur, por shfryt\u00ebzimi \u00ebsht\u00eb m\u00eb kompleks. P\u00ebr mbrojtje nga tejmbushja e stek\u00ebs s\u00eb adresave t\u00eb kthimit dhe p\u00ebr bllokimin e cenueshm\u00ebris\u00eb SRSO (Speculative Return Stack Overflow) n\u00eb procesor\u00ebt AMD, p\u00ebrdoret mekanizmi mbrojt\u00ebs Safe-RET, i cili pastron buffer-in e parashikimit t\u00eb deg\u00ebzimeve pas \u00e7do p\u00ebrdorimi dhe e ngushton dritaren e sulmit n\u00eb 2 instruksione, t\u00eb ekzekutuara brenda disa dhjet\u00ebra nanosekondash. <\/p>\n
P\u00ebr t\u00eb anashkaluar k\u00ebt\u00eb mbrojtje dhe p\u00ebr t\u00eb zgjeruar dritaren e kryerjes s\u00eb sulmit, \u00ebsht\u00eb zbatuar nj\u00eb teknik\u00eb e ngadal\u00ebsimit t\u00eb CPU-s\u00eb, e cila b\u00ebri t\u00eb mundur z\u00ebvend\u00ebsimin e nd\u00ebrprerjes n\u00eb momentin e duhur p\u00ebr t\u00eb ridrejtuar rrjedh\u00ebn e ekzekutimit n\u00eb kernel dhe p\u00ebr t\u00eb p\u00ebrdorur trajtuesin e nd\u00ebrprerjes p\u00ebr t\u00eb shtremb\u00ebruar shkrimin n\u00eb buferin e parashikimit t\u00eb deg\u00ebzimeve. P\u00ebr shfryt\u00ebzimin e cenueshm\u00ebris\u00eb SRSO, sulmuesi mund t\u00eb krijoj\u00eb kushte n\u00eb t\u00eb cilat blloku i parashikimit t\u00eb deg\u00ebzimeve do t\u00eb ekzekutoj\u00eb n\u00eb m\u00ebnyr\u00eb spekulative nj\u00eb num\u00ebr t\u00eb madh thirrjesh CALL t\u00eb parashikuara gabim, t\u00eb mjaftueshme p\u00ebr t\u00eb tejmbushur stekun e adresave t\u00eb kthimit dhe p\u00ebr t\u00eb mbishkruar pikat e kthimit t\u00eb parashikuara sakt\u00eb, t\u00eb vendosura n\u00eb fillim t\u00eb stekut. Si rezultat, elementet fillestare t\u00eb stekut mund t\u00eb mbishkruhen me vlera t\u00eb zgjedhura nga sulmuesi, gj\u00eb q\u00eb m\u00eb pas do t\u00eb \u00e7oj\u00eb n\u00eb p\u00ebrdorimin e k\u00ebtyre vlerave t\u00eb z\u00ebvend\u00ebsuara gjat\u00eb ekzekutimit spekulativ t\u00eb instruksionit RET n\u00eb kontekstin e nj\u00eb procesi tjet\u00ebr. <\/p>\n
Procesori do t\u00eb p\u00ebrcaktoj\u00eb se parashikimi i deg\u00ebzimit ka qen\u00eb i pasakt\u00eb dhe do ta kthej\u00eb operacionin n\u00eb gjendjen fillestare, por t\u00eb dh\u00ebnat e p\u00ebrpunuara gjat\u00eb ekzekutimit spekulativ do t\u00eb mbeten n\u00eb cache dhe n\u00eb bufer\u00ebt mikroarkitekturor\u00eb. N\u00ebse blloku i ekzekutuar gabimisht kryen qasje n\u00eb memorie, ekzekutimi i tij spekulativ do t\u00eb b\u00ebj\u00eb q\u00eb n\u00eb cache-n e p\u00ebrbashk\u00ebt t\u00eb mbeten edhe t\u00eb dh\u00ebnat e lexuara nga memoria. P\u00ebr nxjerrjen e informacionit nga cache mund t\u00eb p\u00ebrdoret nj\u00eb nga metodat p\u00ebr p\u00ebrcaktimin e p\u00ebrmbajtjes s\u00eb cache bazuar n\u00eb analiz\u00ebn e ndryshimit t\u00eb koh\u00ebs s\u00eb qasjes te t\u00eb dh\u00ebnat e ruajtura n\u00eb cache dhe te ato q\u00eb nuk jan\u00eb n\u00eb cache. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"