{"id":53866,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx"},"modified":"2020-02-18T14:01:48","modified_gmt":"2020-02-18T11:01:48","slug":"plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","title":{"rendered":"Plundervolt \u2014 en ny attackmetod mot Intel-processorer som p\u00e5verkar SGX-teknologin.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Intel har sl\u00e4ppt<\/a><\/noindex> mikrokoduppdatering som \u00e5tg\u00e4rdar s\u00e5rbarhet<\/a><\/noindex> (CVE-2019-14607), m\u00f6jligg\u00f6r<\/a><\/noindex> genom manipulation av mekanismen f\u00f6r dynamisk sp\u00e4nning och frekvenskontroll i CPU:n initiera skador p\u00e5 inneh\u00e5llet i dataceller, inklusive omr\u00e5den som anv\u00e4nds vid ber\u00e4kningar i isolerade Intel SGX-anklaver. Attacken har f\u00e5tt namnet Plundervolt och kan potentiellt till\u00e5ta en lokal anv\u00e4ndare att h\u00f6ja sina privilegier i systemet, orsaka serviceavbrott och f\u00e5 tillg\u00e5ng till skyddade data.<\/p>\n

Attacken utg\u00f6r en fara endast i samband med manipulation av ber\u00e4kningar i SGX-anklaver, eftersom den kr\u00e4ver root-r\u00e4ttigheter i systemet f\u00f6r att utf\u00f6ras. I det enklaste fallet kan angriparen \u00e5stadkomma f\u00f6rvr\u00e4ngningar av informationen som behandlas i ankare, men i mer komplexa scenarier utesluts inte m\u00f6jligheten att \u00e5terskapa de hemliga nycklar som lagras i ankaret och som anv\u00e4nds f\u00f6r kryptering med RSA-CRT och AES-NI-algoritmer. Tekniken kan \u00e4ven anv\u00e4ndas f\u00f6r att generera fel i ursprungligen korrekta algoritmer f\u00f6r att provocera fram s\u00e5rbarheter vid arbete med minnet, till exempel f\u00f6r att organisera \u00e5tkomst till omr\u00e5den utanf\u00f6r det tilldelade buffertomr\u00e5det.
\nPrototypkod f\u00f6r att utf\u00f6ra attacken publicerades<\/a><\/noindex> p\u00e5 GitHub<\/p>\n

Metoden g\u00e5r ut p\u00e5 att skapa f\u00f6rh\u00e5llanden f\u00f6r ov\u00e4ntade datavvikelser under ber\u00e4kningar i SGX, som inte skyddas av anv\u00e4ndning av kryptering och minnesautentisering i ankaret. F\u00f6r att \u00e5stadkomma f\u00f6rvr\u00e4ngningar visade det sig vara m\u00f6jligt att anv\u00e4nda standardprogrammeringsgr\u00e4nssnitt f\u00f6r att hantera frekvens och sp\u00e4nning, som vanligtvis anv\u00e4nds f\u00f6r att minska energif\u00f6rbrukningen under systemets vilotillst\u00e5nd och aktivera maximal prestanda vid intensiva arbetsuppgifter. Frekvens- och sp\u00e4nningskarakteristika t\u00e4cker hela chipet och p\u00e5verkar \u00e4ven ber\u00e4kningarna i det isolerade ankaret. <\/p>\n

Genom att \u00e4ndra sp\u00e4nningen kan man skapa f\u00f6rh\u00e5llanden d\u00e4r det inte finns tillr\u00e4ckligt med laddning f\u00f6r att regenerera minnescellen inuti CPU:n, vilket resulterar i att dess v\u00e4rde \u00e4ndras. Den avg\u00f6rande skillnaden fr\u00e5n attacken RowHammer<\/a><\/noindex> \u00e4r det som RowHammer m\u00f6jligg\u00f6r att \u00e4ndra inneh\u00e5llet i enskilda bitar i DRAM-minnet, genom att cykliskt l\u00e4sa data fr\u00e5n n\u00e4rliggande celler, medan Plundervolt m\u00f6jligg\u00f6r bit\u00e4ndringar inuti CPU:n n\u00e4r data redan har laddats fr\u00e5n minnet f\u00f6r utf\u00f6rande av ber\u00e4kningar. Denna egenskap g\u00f6r det m\u00f6jligt att kringg\u00e5 de integritets- och krypteringsmekanismer som anv\u00e4nds i SGX, eftersom v\u00e4rdena i minnet f\u00f6rblir korrekta men kan f\u00f6rvr\u00e4ngas vid operationer med dem, innan resultatet skrivs tillbaka till minnet.<\/p>\n

Om detta \u00e4ndrade v\u00e4rde anv\u00e4nds i multiplikationsprocessen i krypteringen, s\u00e5 avvisas ett icke-korrekt krypterad text som utg\u00e5ng. Genom att kunna anropa hanteraren i SGX f\u00f6r att kryptera sina data kan en angripare, genom att orsaka kraschar, samla statistik om f\u00f6r\u00e4ndringen av den krypterade texten p\u00e5 utg\u00e5ngen och p\u00e5 n\u00e5gra minuter \u00e5terst\u00e4lla v\u00e4rdet av den nyckel som lagras i enklaven. Den ursprungliga texten p\u00e5 ing\u00e5ngen och den korrekta krypterade texten p\u00e5 utg\u00e5ngen \u00e4r k\u00e4nda, nyckeln \u00e4ndras inte, och utg\u00e5ngen av den icke-korrekta krypterade texten indikerar en f\u00f6rvr\u00e4ngning av n\u00e5gon bit till ett motsatt v\u00e4rde. <\/p>\n

Genom att analysera de insamlade paren av korrekta och f\u00f6rvr\u00e4ngda krypterade texter fr\u00e5n olika kraschar, med hj\u00e4lp av metoder f\u00f6r differentierande felanalys (DFA, Differential Fault Analysis<\/a><\/noindex>) kan man f\u00f6ruts\u00e4ga<\/a><\/noindex> sannolika nycklar som anv\u00e4nds f\u00f6r symmetrisk AES-kryptering, och sedan, genom att analysera korsningen av nycklar i olika upps\u00e4ttningar, best\u00e4mma den s\u00f6kta nyckeln.<\/p>\n

\r\n \"Spela\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Problemet drabbar olika modeller av Intel-processorer, inklusive Intel Core CPU fr\u00e5n 6
\n till 10 generationen, liksom femte och sj\u00e4tte generationen Xeon E3, den f\u00f6rsta och andra generationen Intel Xeon Scalable, Xeon D,
\nXeon W och Xeon E.<\/p>\n

L\u00e5t oss p\u00e5minna om att SGX-teknologin (Software Guard Extensions<\/a><\/noindex>) introducerades i Intel Core-processorer i den sj\u00e4tte generationen (Skylake) och erbjuder<\/a><\/noindex> \u0441\u0435\u0440\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u044b\u0434\u0435\u043b\u044f\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 — \u0430\u043d\u043a\u043b\u0430\u0432\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043d\u043e \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u043e \u0434\u0430\u0436\u0435 \u044f\u0434\u0440\u043e\u043c \u0438 \u043a\u043e\u0434\u043e\u043c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u043c \u0432 \u0440\u0435\u0436\u0438\u043c\u0430\u0445 ring0, SMM \u0438 VMM. \u041f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0443 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u043c\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f\u043c\u0438 \u0441 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u043c\u0438 \u0438 \u0441\u0442\u0435\u043a\u043e\u043c — \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u0430\u043d\u043a\u043b\u0430\u0432 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u0430\u044f \u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u043b\u043d\u043e\u043c\u043e\u0447\u0438\u0439. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0439 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432 \u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0432\u044b\u0437\u043e\u0432\u0430 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c \u0432\u043d\u0443\u0442\u0440\u0438 \u0430\u043d\u043a\u043b\u0430\u0432\u0430 \u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044e \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439. \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0430\u0442\u0430\u043a, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043c\u043e\u0434\u0443\u043b\u044e DRAM, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0430\u043d\u043a\u043b\u0430\u0432\u0430.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-14607), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u0435\u043c \u0438 \u0447\u0430\u0441\u0442\u043e\u0442\u043e\u0439 \u0432 CPU \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u044f\u0447\u0435\u0435\u043a \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044f\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u0430\u0445 Intel SGX. \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Plundervolt, \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0437\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53866","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Plundervolt - en ny attackmetod mot Intel-processorer som p\u00e5verkar SGX-teknologin | ProHoster","description":"Intel har sl\u00e4ppt en mikroprogramsuppdatering som \u00e5tg\u00e4rdar","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Plundervolt \u2014 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e SGX | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53866","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:05:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:28","updated":"2026-01-24 09:05:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=53866"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53866\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=53866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=53866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=53866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}