Ruzivo nezve kirasi nyowani yekurwisa LVI mune michina kufungidzira kuuraya kunokanganisa Intel, iyo inogona kushandiswa pakubvisa makiyi uye data rakaomarara kubva kuIntel SGX enclaves uye nezvimwe maitiro.
Iyo kirasi nyowani yekurwisa yakavakirwa pamaitiro ine yakafanana microarchitectural zvivakwa senge mune MDS, Specter neMeltdown kurwisa. Panguva imwe, kurwiswa kutsva hakuna kuvharirwa nenzira dziripo kudzivirira kubva kuMeltdown, Specter, MDS uye kumwe kurwiswa kwakafanana.
Nezve LVI
Dambudziko akaonekwa muna Kubvumbi wegore rapfuura nemuongorori Jo Van Bulck kubva kuYunivhesiti yeLeuven, mushure meizvozvo, nekutora chikamu kwevaongorori vapfumbamwe kubva kumamwe mayunivhesiti, nzira shanu dzekurwisa dzakagadzirwa, imwe neimwe inobvumira zvimwe zvingasarudzwa.
Zvisinei, muna Kukadzi wegore rino, iyo Vatsva veBitdefender vakawanawo imwe yesarudzo dzekurwisa LVI ndokuzvizivisa kuIntel.
Idzo sarudzo dzekurwisa dzinosiyaniswa nekushandiswa kweakasiyana maumbirwo ediki, senge Chitoro Chekuchengetera (SB, Chitoro Chekuchengetera), Zadza Buffer (LFB, Line Fill Buffer), FPU Context Shandura Buffer, uye Yekutanga Chikamu Cache (L1D), yakamboshandiswa mukurwisa seZombieLoad, RIDL, Kudonha, LazyFP, Foreshadow, uye Kupera.
Musiyano mukuru pakati Ndinovarwisas LVI uye MDS ndeyekuti MDS inokonzeresa kutsunga kwemukati ye microarchitectural zvivakwa zvinosara mune cache mushure mekufungidzira kukanganisa kubata kana kutakura uye kuchengetedza mashandiro, nepo Kurwiswa uku LVI inobvumira anorwisa kuti atsivirwe muzvivakwa zvidiki kufurira kuita kwekufungidzira kunotevera kwekodhi yemunhu akuvara.
Uchishandisa izvi zvisirizvo, anorwisa anogona kutora zvirimo zvakavharwa zvemhando yedhata mune mamwe maitiro achiitisa imwe kodhi mumusoro weiyo yakatarwa CPU.
Zvekushandisa zvisirizvo, matambudziko anofanirwa kuwanikwa mukodhi yekuita uye utumire kuteedzana kwemakodhi akasarudzika (magajeti) umo iro rinodzorwa neanorwisa rinotakurwa uye kurodha kweiyi kukosha kunokanganisa izvo zvinorasa mhedzisiro uye kudzoreredza kuraira.
Paunenge uchigadzirisa kunze kwekunze, hwindo rekufungidzira rinoonekwa panguva iyo data rakagadziriswa mujeti rinosvinwa.
Kunyanya processor inotanga kufungidzira ichiita chidimbu chekodhi (gadget), zvobva zvaziva kuti fungidziro haina kururamiswa uye inodzosera mashandiro, asi iyo yakagadziriswa data Panguva yekufungidzira kuuraya inoiswa muL1D cache uye ma buffers microarchitecture uye inogona kuburitswa kubva kwavari vachishandisa nzira dzinozivikanwa kuona data rakasara kubva kune echitatu-bato nzira.
Icho chinetso chikuru kurwisa mamwe maitiro uyes maitiro ekutanga rubatsiro nekunyepedzera maitiro evanoitirwa.
Parizvino, hapana nzira dzakavimbika dzekuita izvi, asi mune ramangwana kuwanikwa kwaro hakuna kusiiwa. Parizvino mukana wekurwiswa wakasimbiswa chete kune Intel SGX enclaves, zvimwe zviitiko ndezvekufungidzira kana kubereka pasi pemamiriro ekugadzirwa.
Zvinogona kurwisa vectors
- Kuburitswa kwedata kubva kune zvimiro zvekernel kuenda kune yekushandisa-chikamu maitiro. Linux kernel dziviriro kurwisana neSpecter 1 kurwiswa uye iyo SMAP (Supervisor Mode Access Kudzivirira) nzira yekudzivirira zvakanyanya kudzora mukana wekurwiswa kweLVI. Kuunza yekuwedzera kernel dziviriro kunogona kudikanwa kana uchiona nzira dzakareruka dzekuita kurwisa kweLVI mune ramangwana.
- Dhata leakage pakati pezvakasiyana maitiro. Kurwiswa kunoda kuvepo kwemamwe makodhi mapikicha mukushandisa uye kutsunga kwenzira yekusimudza yakasarudzika mukutora kwekutarisa.
- Dhata inodonha kubva kunzvimbo yekutambira kuenda kune yevaenzi system. Kurwiswa kunoiswa senge kwakanyanyisa kuomarara, kunoda kuitiswa kweanoverengeka akaoma-kuita-matanho uye fungidziro yezviitiko pachirongwa.
- Dhata leakage pakati pezvakaitwa mumasisitimu akasiyana evashanyi. Iyo yekurwisa vector iri padyo nekuronga kudonhedza dhata pakati pezvakasiyana maitiro, asi zvakare zvinoda maitiro akaomarara kudzivirira kuzviparadzanisa pakati pevaenzi masisitimu.
Kuti upe dziviriro inoshanda kubva kuLVI, shanduko dzemidziyo kuCPU dzinodiwa. Nekuronga kuchengetedzwa zvakarongeka, kuwedzera iyo compiler LFENCE chirevo mushure mega mutoro mashandiro kubva mundangariro, uye kutsiva RET chirevo nePOP, LFENCE, uye JMP, inogadzirisa yakawandisa pamusoro; Sekureva kwevaongorori, yakazara software inodzivirira inozotungamira mukudzikisira kwekuita kwe2 kusvika ku19 nguva.
mabviro: https://www.intel.com