Iqembu labacwaningi abavela e-Technical University of Graz (Austria) kanye neHelmholtz Centre for Information Security (CISPA), () i-vector entsha yokusebenzisa ukuhlasela kwesiteshi eseceleni (L1TF), ekuvumela ukuthi ukhiphe idatha kumemori ye-Intel SGX enclaves, i-SMM (Imodi Yokulawulwa Kwesistimu), izindawo zenkumbulo ze-OS kernel nemishini ebonakalayo ezinhlelweni ze-virtualization. Ngokungafani nokuhlasela kwasekuqaleni okuhlongozwayo ngo-2018 Okuhlukile okusha akuqondile kuma-Intel processors futhi kuthinta ama-CPU avela kwabanye abakhiqizi abafana ne-ARM, IBM ne-AMD. Ngaphezu kwalokho, okuhlukile okusha akudingi ukusebenza okuphezulu futhi ukuhlasela kungenziwa ngisho nangokusebenzisa i-JavaScript ne-WebAssembly kusiphequluli sewebhu.
Ukuhlasela kwe-Foreshadow kusizakala ukuthi lapho inkumbulo ifinyelelwa ekhelini elibonakalayo eliphumela kokuhlukile (iphutha lekhasi lesiphetho), iphrosesa ibala ngokuqagela ikheli lendawo bese ilayisha idatha uma itholakala kunqolobane ye-L1. Ukufinyelela okucatshangelwayo kwenziwa ngaphambi kokuba ukusesha kwetafula lememori kuqedwe futhi kungakhathalekile ukuthi isiphi isimo sokufakwa kwetafula lememori (PTE), i.e. ngaphambi kokuhlola ubukhona bedatha kwinkumbulo yomzimba kanye nokufundeka kwayo. Ngemva kokuba ukuhlola ukutholakala kwenkumbulo sekuqediwe, lapho ifulegi le-Present lingekho ku-PTE, ukusebenza kuyalahlwa, kodwa idatha isala kunqolobane futhi ingabuyiswa kusetshenziswa izindlela zokunquma okuqukethwe kwenqolobane ngokusebenzisa amashaneli aseceleni (ngokuhlaziya izinguquko esikhathini sokufinyelela. kudatha egcinwe kunqolobane nengagciniwe).
Abacwaningi babonise ukuthi izindlela ezikhona zokuvikela ngokumelene ne-Foreshadow azisebenzi futhi zenziwa ngokuchazwa okungalungile kwenkinga. Ukuba sengozini
I-Foreshadow ingaxhashazwa kungakhathaliseki ukuthi yiziphi izindlela zokuphepha ze-kernel ngaphambilini ebezithathwa njengezanele. Ngenxa yalokho, abacwaningi babonise ukuthi kungenzeka ukwenza ukuhlaselwa kwe-Foreshadow kumasistimu anezinhlamvu ezindala, lapho zonke izindlela zokuvikela i-Foreshadow zinikwe amandla, kanye nama-kernels amasha, lapho ukuvikelwa kwe-Specter-v2 kuphela kukhutshaziwe (kusetshenziswa inketho ye-Linux kernel nospectre_v2).
Kutholakale ukuthi ayihlobene nemiyalelo yokulanda kuqala isofthiwe noma umphumela wehadiwe
ukulanda kuqala ngesikhathi sokufinyelela inkumbulo, kodwa kwenzeka lapho ukuhoxiswa kokuqagela kwesikhala somsebenzisi kubhaliswa ku-kernel. Lokhu kuchazwa kabi kwembangela yokuba sengozini ekuqaleni kwaholela ekucabangeni ukuthi ukuvuza kwedatha ku-Foreshadow kungenzeka kuphela ngenqolobane ye-L1, kuyilapho ukuba khona kwamazwibela athile ekhodi (amagajethi okulanda ngaphambilini) ku-kernel kungaba nomthelela ekuvuzeni kwedatha ngaphandle kwenqolobane ye-L1, isibonelo, kunqolobane ye-L3.
Isici esihlonziwe siphinde sivule amathuba okudala ukuhlaselwa okusha okuhloswe ezinqubweni zokuhumusha amakheli abonakalayo abe awangempela ezindaweni ezingazodwa kanye nokunquma amakheli nedatha egcinwe kumarejista e-CPU. Njengomboniso, abacwaningi babonise ukuthi kungenzeka ukusebenzisa umphumela okhonjiwe ukukhipha idatha kusuka kunqubo eyodwa kuya kwenye ngokusebenza okungaba yizibhithi eziyi-10 ngomzuzwana ohlelweni olune-Intel Core i7-6500U CPU. Amathuba okuvuza kokuqukethwe kwerejista ku-Intel SGX enclave nawo ayaboniswa (kuthathe imizuzu eyi-32 ukucacisa inani lamabhithi angama-64 elibhalwe kurejista engamabhithi angama-15). Ezinye izinhlobo zokuhlasela zikwazile ukusetshenziswa ku-JavaScript naku-WebAssembly, isibonelo, bekungenzeka ukunquma ikheli lendawo le-JavaScript variable futhi ugcwalise amarejista angama-64-bit ngenani elilawulwa umhlaseli.
Ukuze uvimbele ukuhlasela kwe-Foreshadow ngokusebenzisa inqolobane ye-L3, indlela yokuvikela ye-Specter-BTB (Branch Target Buffer) esetshenziswe kusethi yesichibi se-retpoline iyasebenza. Ngakho-ke, abacwaningi bakholelwa ukuthi kuyadingeka ukushiya i-retpoline inikwe amandla ngisho nasezinhlelweni ezinama-CPU amasha asevele enesivikelo ezingozini ezaziwayo kumshini wokuqagela we-CPU. Ngaso leso sikhathi, abamele i-Intel bathi abahleli ukwengeza izindlela zokuvikela ezengeziwe kuma-Foreshadow kuma-processor futhi bakubheke njengokwanele ukufaka ukuvikelwa ekuhlaselweni kwe-Specter V2 kanye ne-L1TF (Foreshadow).
Source: opennet.ru