{"id":52649,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel"},"modified":"2020-02-18T14:00:26","modified_gmt":"2020-02-18T11:00:26","slug":"vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","title":{"rendered":"En ny variant av Zombieload-attacken p\u00e5 Intel-processorer har uppt\u00e4ckts","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskare vid Graz tekniska universitet (\u00d6sterrike) koden<\/a><\/noindex> information om den nya attackmetoden via sidokanaler ZombieLoad 2.0<\/a><\/noindex> (CVE-2019-11135<\/a><\/noindex>), vilket m\u00f6jligg\u00f6r extrahering av konfidentiell information fr\u00e5n andra processer, operativsystem, virtuella maskiner och skyddade enheter (TEE, Trusted Execution Environment). Problemet p\u00e5verkar endast Intel-processorer. Komponenter f\u00f6r att blockera problemet har erbjudits<\/a><\/noindex> i g\u00e5rdagens mikrokodsuppdatering<\/a><\/noindex>. <\/p>\n

Problemet tillh\u00f6r klassen MDS (Microarchitectural Data Sampling) och \u00e4r en moderniserad variant av den offentliggjorda<\/a><\/noindex> attacken ZombieLoad fr\u00e5n maj. ZombieLoad 2.0, liksom andra attacker av MDS-klass, baseras p\u00e5 att anv\u00e4nda metoder f\u00f6r analytisk sidokanal f\u00f6r data i mikroarkitektoniska strukturer (till exempel i cachelinjebuffrar (Line Fill Buffer) och lagringsbuffrar (Store Buffer), d\u00e4r data anv\u00e4nds tempor\u00e4rt under utf\u00f6randet av Load- och Store-operationer).<\/p>\n

Den nya varianten av Zombieload-attacken baseras<\/a><\/noindex> p\u00e5 l\u00e4ckan som uppst\u00e5r vid drift av den asynkrona avbrottsmekanismen (TAA, TSX Asynchronous Abort), implementerad i TSX (Transactional Synchronization Extensions), vilket erbjuder medel f\u00f6r att hantera transaktionellt minne och f\u00f6rb\u00e4ttra prestandan f\u00f6r flertr\u00e5dade applikationer genom att dynamiskt utesluta \u00f6verfl\u00f6diga synkroniseringsoperationer (atomiska transaktioner st\u00f6ds, som kan antingen accepteras eller avbrytas). Vid avbrott \u00e5terst\u00e4lls operationer utf\u00f6rda med det transaktionella minnesomr\u00e5det.<\/p>\n

Avbrottet fr\u00e5n transaktionen genomf\u00f6rs asynkront, och under denna tid kan andra tr\u00e5dar f\u00e5 tillg\u00e5ng till cacheminnet, vilket ocks\u00e5 anv\u00e4nds i det avbrutna transaktionella minnesomr\u00e5det. Under perioden fr\u00e5n b\u00f6rjan av det asynkrona avbrottet till den faktiska avslutningen kan situationer uppst\u00e5 d\u00e4r processorn, under spekulativ exekvering av en operation, kan l\u00e4sa data fr\u00e5n interna mikroarkitektoniska buffertar och \u00f6verf\u00f6ra dem till den spekulativa operationen. Konflikten kommer sedan att identifieras, och den spekulativa operationen kommer att avvisas, men data kommer att finnas kvar i cacheminnet och kan extraheras med hj\u00e4lp av metoder f\u00f6r cache\u00e5terst\u00e4llning via sidokanaler. <\/p>\n

Attack involves opening TSX transactions and creating conditions for their asynchronous interruption, during which conditions arise for leaking the contents of internal buffers, speculatively filled with data from memory read operations executing on the same CPU core. The leak is limited to the current physical CPU core (where the attacker's code runs), but since microarchitectural buffers are shared by different threads in Hyper-Threading mode, a memory operation leak may occur from other CPU threads. <\/p>\n

Attack are susceptible to<\/a><\/noindex> certain models of eighth, ninth, and tenth generation Intel Core processors, as well as Intel Pentium Gold, Intel Celeron 5000, Intel Xeon E, Intel Xeon W, and the second generation Intel Xeon Scalable. This includes new Intel processors based on the Cascade Lake microarchitecture introduced in April, which was initially not susceptible to RIDL and Fallout attacks. In addition to Zombieload 2.0, researchers also identified the possibility of bypassing previously proposed methods of protection against MDS attacks, based on the use of the VERW instruction to clear the contents of microarchitectural buffers at the time of returning from kernel to user space or during control transfer to a guest system.<\/p>\n

Intel's report states that in systems with heterogeneous loads, the possibility of conducting an attack is complicated, as leakage from microarchitectural structures covers all activity in the system and the attacker cannot influence the source of the extracted data; that is, they can only accumulate the information that pops up as a result of leakage and try to identify useful information among these data, without the ability to deliberately intercept data related to specific memory addresses. However, researchers have published Problem var<\/a><\/noindex>, working in Linux and Windows, and demonstrated the possibility of using the attack to determine the hash of the root user's password.
\nIt is possible<\/a><\/noindex> to conduct an attack from the guest system to accumulate data that appears in the operations of other guest systems, host environments, hypervisors, and Intel SGX enclaves.<\/p>\n

\r\n \"Spela\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

The corrections to block the vulnerability Rust-bindningar f\u00f6r<\/a><\/noindex> have been incorporated into the Linux kernel code base and are included in the releases \t5.3.11, 4.19.84, 4.14.154, 4.9.201, and 4.4.201<\/a><\/noindex>. Updates with the kernel and microcode have also been released for major distributions (Debian<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>). Problemet uppt\u00e4cktes i april och l\u00f6sningen koordinerades av Intel med operativsystemens utvecklare.<\/p>\n

Den enklaste metoden f\u00f6r att blockera Zombieload 2.0 \u00e4r att inaktivera st\u00f6d f\u00f6r TSX i CPU:n. Den f\u00f6reslagna patchen f\u00f6r Linux-k\u00e4rnan inkluderar flera skyddsalternativ. Det f\u00f6rsta alternativet erbjuder parametern \"tsx=on\/off\/auto\", vilket g\u00f6r att anv\u00e4ndaren kan styra aktiveringen av TSX-till\u00e4gget i CPU:n (v\u00e4rdet auto inaktiverar TSX endast f\u00f6r s\u00e5rbara CPU:er). Det andra skyddsalternativet aktiveras med parametern \"tsx_async_abort=off\/full\/full,nosmt\" och baseras p\u00e5 rensning av mikroarkitektoniska buffertar under kontextv\u00e4xling (flaggan nosmt inaktiverar dessutom SMT\/Hyper-Threads). F\u00f6r att kontrollera systemets utsatthet f\u00f6r s\u00e5rbarheten finns en parameter i sysfs som heter \"\/sys\/devices\/system\/cpu\/vulnerabilities\/tsx_async_abort\".<\/p>\n

Dessutom, i i version 1.930. Som en tillf\u00e4llig \u00e5tg\u00e4rd f\u00f6r att blockera bakd\u00f6rren r\u00e4cker det att ta bort inst\u00e4llningen \"passwd_mode=\" fr\u00e5n konfigurationsfilen \\\/etc\\\/webmin\\\/miniserv.conf. F\u00f6r testning har en<\/a><\/noindex> mikrokod har \u00e5tg\u00e4rdats<\/a><\/noindex> \u00e4nnu en s\u00e5rbarhet<\/a><\/noindex> (CVE-2018-12207<\/a><\/noindex>) i Intel-processorer, som ocks\u00e5 blockeras i den senaste i version 1.930. Som en tillf\u00e4llig \u00e5tg\u00e4rd f\u00f6r att blockera bakd\u00f6rren r\u00e4cker det att ta bort inst\u00e4llningen \"passwd_mode=\" fr\u00e5n konfigurationsfilen \\\/etc\\\/webmin\\\/miniserv.conf. F\u00f6r testning har en<\/a><\/noindex> Linux-k\u00e4rnan. S\u00e5rbarheten m\u00f6jligg\u00f6r<\/a><\/noindex> en icke-privilegerad angripare kan initiera en \u00f6verbelastningsattack som leder till att systemet h\u00e4nger i tillst\u00e5ndet \"Machine Check Error\".
\n Attacken kan \u00e4ven genomf\u00f6ras<\/a><\/noindex> fr\u00e5n ett g\u00e4stsystem.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u043c \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c ZombieLoad 2.0 (CVE-2019-11135), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u043e\u0432 (TEE, Trusted Execution Environment). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel. \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u044b \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 MDS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ny variant av Zombieload-attacken p\u00e5 Intel-processorer uppt\u00e4cktes | ProHoster","description":"Forskare vid Graz tekniska universitet (\u00d6sterrike)","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 Zombieload \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f)","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/vyyavlen-novyj-variant-ataki-zombieload-na-protsessory-intel","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:26","updated":"2026-01-24 04:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=52649"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52649\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=52649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=52649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=52649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}