Intel isibuyekezo se-microcode esilungisayo (I-CVE-2019-14607), ngokusebenzisa ukuguqulwa kwamandla kagesi aguquguqukayo kanye nendlela yokulawula imvamisa ku-CPU, qalisa ukulimala kokuqukethwe amaseli edatha, okuhlanganisa nezindawo ezisetshenziselwa izibalo ezindaweni ezingazodwa ze-Intel SGX. Ukuhlasela kubizwa nge-Plundervolt, futhi kuvumela umsebenzisi wendawo ukuthi akhuphule amalungelo akhe ohlelweni, abangele ukunqatshelwa kwesevisi futhi athole ukufinyelela kudatha ebucayi.
Ukuhlasela kuyingozi kuphela kumongo wokukhohlisa ngezibalo kuma-SGX enclaves, ngoba kudinga amalungelo ezimpande ohlelweni ukuze kwenziwe. Esimweni esilula, umhlaseli angakwazi ukuzuza ukuhlanekezelwa kolwazi olucutshungulwe ku-enclave, kodwa ezimweni eziyinkimbinkimbi kakhulu, ithuba lokudala kabusha okhiye abayimfihlo abagcinwe ku-enclave esetshenziselwa ukubethela usebenzisa i-RSA-CRT kanye ne-AES-NI algorithms ayikho. ngaphandle. Indlela yokusebenza ingase isetshenziselwe ukukhiqiza amaphutha kuma-algorithms alungile ekuqaleni ukuze kuvuse ubungozi lapho usebenza ngenkumbulo, isibonelo, ukuhlela ukufinyelela endaweni engaphandle komngcele webhafa enikeziwe.
Ikhodi ye-prototype yokwenza ukuhlasela ku-GitHub
Ingqikithi yendlela iwukudala izimo zokuvela kokonakala kwedatha okungalindelekile ngesikhathi sokubala ku-SGX, lapho ukusetshenziswa kokubethela kanye nokuqinisekiswa kwememori ku-enclave kungavikeli. Ukwethula ukuhlanekezela, kuvele ukuthi bekungenzeka ukusebenzisa ukuxhumana kwesoftware okujwayelekile ukulawula imvamisa namandla kagesi, okuvamise ukusetshenziselwa ukunciphisa ukusetshenziswa kwamandla ngesikhathi sokungenzi lutho kwesistimu nokwenza kusebenze ukusebenza okuphezulu ngesikhathi sokusebenza kanzima. Imvamisa nezici ze-voltage zidlula yonke i-chip, okuhlanganisa nomthelela wekhompuyutha endaweni engayodwa.
Ngokushintsha i-voltage, ungakha izimo lapho ukushaja kunganele ukuvuselela iseli yememori ngaphakathi kwe-CPU, futhi inani layo liyashintsha. Umehluko oyinhloko ekuhlaselweni ukuthi i-RowHammer ikuvumela ukuthi uguqule okuqukethwe kwezingcezu ngazinye kumemori ye-DRAM ngokufunda idatha ngomjikelezo kumaseli angomakhelwane, kuyilapho i-Plundervolt ikuvumela ukuthi ushintshe izingcezu ngaphakathi kwe-CPU lapho idatha isivele ilayishwe kwimemori ukuze ibalwe. Lesi sici sikuvumela ukuthi udlule ukulawulwa kobuqotho kanye nezindlela zokubethela ezisetshenziswa ku-SGX ukuze uthole idatha esenkumbulweni, njengoba amanani enkumbulweni ahlala elungile, kodwa angahlanekezelwa ngesikhathi sokusebenza nawo ngaphambi kokuthi umphumela ubhalwe ekhanda.
Uma leli nani elishintshiwe lisetshenziswa enqubweni yokuphindaphinda yenqubo yokubethela, okukhiphayo kuyenqatshwa ngombhalo we-cipher ongalungile. Njengoba inamandla okuxhumana nesibambi ku-SGX ukuze ibethele idatha yayo, umhlaseli angakwazi, okubangela ukwehluleka, aqongelele izibalo mayelana nezinguquko kumbhalo wemfihlo ophumayo futhi, emizuzwini embalwa, abuyisele inani lokhiye ogcinwe ku-enclave. Umbhalo wokokuqala ofakiwe kanye nombhalo olungile ophumayo uyaziwa, ukhiye awushintshi, futhi okukhiphayo kwe-ciphertext engalungile kubonisa ukuthi ingxenye ethile ihlanekezelwe enaluni eliphambene.
Ngemva kokuhlaziya amapheya wamanani we-ciphertexts elungile neyonakele eqoqwe ngesikhathi sokwehluleka okuhlukahlukene, kusetshenziswa izindlela zokuhlaziya ukwehluleka okuhlukile (i-DFA, ) Ingakwazi okhiye okungenzeka basetshenziselwe ukubethela kwe-AES symmetric, bese, ngokuhlaziya ukuphambana kokhiye kumasethi ahlukene, thola ukhiye owufunayo.
Amamodeli ahlukahlukene ama-Intel processors athintwa inkinga, okuhlanganisa ama-Intel Core CPU ane-6
Isizukulwane se-10, kanye nesizukulwane sesihlanu nesithupha sika-Xeon E3, isizukulwane sokuqala nesesibili se-Intel Xeon Scalable, Xeon D,
U-Xeon W no-Xeon E.
Ake sikukhumbuze ukuthi ubuchwepheshe be-SGX () ivele ku-Intel Core processors (Skylake) yesizukulwane sesithupha kanye uchungechunge lwemiyalo evumela izinhlelo zokusebenza ezisezingeni lomsebenzisi ukuthi zihlukanise izindawo zememori evaliwe - i-enclaves, okuqukethwe kwayo okungakwazi ukufundwa noma ukuguqulwa ngisho nayi-kernel kanye nekhodi egijima ngezindlela ze-ring0, SMM kanye ne-VMM. Akwenzeki ukudlulisa ukulawula kukhodi eku-enclave kusetshenziswa imisebenzi evamile yokugxuma kanye nokukhohlisa ngamarejista nesitaki; ukudlulisa ukulawula ku-enclave, kusetshenziswa umyalo omusha owenziwe ngokukhethekile owenza ukuhlola kweziphathimandla. Kulokhu, ikhodi ebekwe ku-enclave ingasebenzisa izindlela zokushaya zakudala ukuze ufinyelele imisebenzi ngaphakathi kwe-enclave kanye nemiyalelo ekhethekile yokubiza imisebenzi yangaphandle. Ukubethela kwenkumbulo ye-Enclave kusetshenziselwa ukuvikela ekuhlaselweni kwezingxenyekazi zekhompuyutha njengokuxhuma kumojula ye-DRAM.
Source: opennet.ru