{"id":35693,"date":"2019-10-31T22:05:48","date_gmt":"2019-10-31T19:05:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya\/"},"modified":"2019-10-31T22:05:48","modified_gmt":"2019-10-31T19:05:48","slug":"uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","title":{"rendered":"S\u00e5rbarhet i AMD SEV som m\u00f6jligg\u00f6r identifiering av krypteringsnycklar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Utvecklarna fr\u00e5n Google Cloud-teamet har uppt\u00e4ckt<\/a><\/noindex> en s\u00e5rbarhet (CVE-2019-9836) i genomf\u00f6randet av teknologin AMD SEV (Secure Encrypted Virtualization), som till\u00e5ter kompromettering av data som skyddas av denna teknologi. AMD SEV erbjuder p\u00e5 maskinniv\u00e5 transparant kryptering av minnet i virtuella maskiner, d\u00e4r endast det aktuella g\u00e4stoperativsystemet har tillg\u00e5ng till de dekrypterade uppgifterna, medan andra virtuella maskiner och hypervisorn f\u00e5r ett krypterat datam\u00e4ngd n\u00e4r de f\u00f6rs\u00f6ker komma \u00e5t detta minne.<\/p>\n

Den uppt\u00e4ckta problemet g\u00f6r det m\u00f6jligt att fullt \u00e5terst\u00e4lla inneh\u00e5llet i den skyddade PDH-nyckeln som bearbetas p\u00e5 niv\u00e5n av en specifik s\u00e4ker processor PSP (AMD Security Processor), som \u00e4r otillg\u00e4nglig f\u00f6r huvud-OS.
\nGenom att ha PDH-nyckeln kan en angripare sedan \u00e5terst\u00e4lla sessionsnyckeln och den hemliga sekvensen som angavs vid skapandet av den virtuella maskinen, och f\u00e5 tillg\u00e5ng till de krypterade uppgifterna. <\/p>\n

S\u00e5rbarheten orsakas av brister i genomf\u00f6randet av elliptiska kurvor (ECC) som anv\u00e4nds f\u00f6r kryptering, vilket m\u00f6jligg\u00f6r attacker<\/a><\/noindex> f\u00f6r att \u00e5terst\u00e4lla kurvparametrar. Under k\u00f6rningen av kommandot f\u00f6r att starta en s\u00e4ker virtuell maskin kan en angripare skicka kurvparametrar som inte \u00f6verensst\u00e4mmer med de parametrar som rekommenderas av NIST, vilket leder till att v\u00e4rden med l\u00e5g ordning anv\u00e4nds i multiplikationsoperationer med data fr\u00e5n den hemliga nyckeln. <\/p>\n

S\u00e4kerheten i protokollet ECDH beror direkt p\u00e5 ordningen<\/a><\/noindex> fr\u00e5n av startpunkten f\u00f6r kurvan, vars diskreta logaritm \u00e4r ett mycket komplext problem. Vid ett av stegen i initieringen av AMD SEV-milj\u00f6n anv\u00e4nds parametrar som erh\u00e5llits fr\u00e5n anv\u00e4ndaren i ber\u00e4kningarna med den hemliga nyckeln. I grund och botten utf\u00f6rs en multiplikationsoperation av tv\u00e5 punkter, d\u00e4r den ena motsvarar den hemliga nyckeln. Om den andra punkten tillh\u00f6r l\u00e5gnummererade primtal kan en angripare best\u00e4mma parametrarna f\u00f6r den f\u00f6rsta punkten (modulens bitar som anv\u00e4nds i exponentieringsoperationen modulen) genom att pr\u00f6va alla m\u00f6jliga v\u00e4rden. F\u00f6r att best\u00e4mma den hemliga nyckeln kan de valda fragmenten av primtal sedan sammanfogas med<\/a><\/noindex> Kinas sats om rester Kinesiska resten satsens teorem<\/a><\/noindex>.<\/p>\n

Serverplattformar med AMD EPYC som anv\u00e4nder SEV-firmware upp till version 0.17 build 11 \u00e4r drabbade av problemet. AMD har redan publicerade<\/noindex> sl\u00e4ppt en firmwareuppdatering som blockerar anv\u00e4ndningen av punkter som inte motsvarar NIST-kurvan. Samtidigt f\u00f6rblir tidigare genererade certifikat f\u00f6r PDH-nycklar giltiga, vilket g\u00f6r det m\u00f6jligt f\u00f6r en angripare att genomf\u00f6ra en attack genom att migrera virtuella maskiner fr\u00e5n milj\u00f6er som skyddas mot s\u00e5rbarheten till milj\u00f6er som \u00e4r drabbade av problemet. Det n\u00e4mns ocks\u00e5 en m\u00f6jlighet att genomf\u00f6ra en attack genom att rulla tillbaka firmwareversionen till en \u00e4ldre s\u00e5rbar utg\u00e5va, men denna m\u00f6jlighet har \u00e4nnu inte bekr\u00e4ftats.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Cloud \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9836) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 AMD SEV (Secure Encrypted Virtualization), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0435. AMD SEV \u043d\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043a\u0443\u0449\u0430\u044f \u0433\u043e\u0441\u0442\u0435\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0438 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35693","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i AMD SEV som m\u00f6jligg\u00f6r identifiering av krypteringsnycklar | ProHoster","description":"Utvecklare fr\u00e5n Google Cloud-teamet har uppt\u00e4ckt en s\u00e5rbarhet (CVE-2019-9836) i implementationen av AMD SEV-teknologin (Secure).","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 AMD SEV, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Cloud \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9836) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 AMD SEV (Secure.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-amd-sev-pozvolyayushhaya-opredelit-klyuchi-shifrovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:48+00:00","article:modified_time":"2019-10-31T19:05:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35693","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:24:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:57:46","updated":"2026-01-22 00:24:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/35693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=35693"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/35693\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=35693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=35693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=35693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}