[情報] 新的幽靈漏洞昨天被發佈

[ejsizmmy (pigChu)]

新聞來源：
https://www.tomshardware.com/news/intel-alder-lake-arm-cpus-affected-by-new-spec
tre-vulnerability

縮網址：https://bit.ly/3hOskDS

新的幽靈漏洞昨天被發佈，
這個屬於Specture-V2的漏洞，主要影響Intel跟Arm CPU系統，
Intel從Haswell開始到Alderlake都有影響，
會出一個新的軟體更新去修正這問題，

Arms則是影響Cortex A15, A57, A72 及 Neoverse V1, N1, and N2

可由Intel之 CVE-2022-0001、CVE-2022-0002
 及 Arm 之 CVE-2022-23960 了解漏洞及修正

漏洞演示：
https://twitter.com/vu5ec/status/1501256481097883648

https://youtu.be/537HUwV36ME


底下為原文：
VUSec security research group and Intel on Tuesday disclosed a yet another Spect
re-class speculative execution vulnerability called branch history injection (BH
I). The new exploit affects all of Intel processors released in the recent years
, including the latest Alder Lake CPUs, and select Arm cores. By contrast, AMD's
 chips are believed to be unaffected.

BHI is a proof-of-concept attack that affects CPUs already vulnerable to Spectre
 V2 exploits, but with all kinds of mitigations already in place. The new exploi
t bypasses Intel's eIBRS and Arm's CSV2 mitigations, reports Phoronix. BHI re-en
ables cross-privilege Spectre-v2 exploits, allows kernel-to-kernel (so-called in
tra-mode BTI) exploits, and allows perpetrators to inject predictor entries into
 the global branch prediction history to make kernel leak data, reports VUSec. A
s a result, arbitrary kernel memory on select CPUs can be leaked and potentially
 reveal confidential information, including passwords. An example of how such a
leak can happen was published here.

VUSec
圖片我就不附上，因為有影片
(Image credit: VUSec)
All of Intel's processors beginning with Haswell (launched in 2013) and extendin
g to the latest Ice Lake-SP and Alder Lake are affected by the vulnerability, bu
t Intel is about to release a software patch that will mitigate the issue.

Numerous cores from Arm, including Cortex A15, A57, A72 as well as Neoverse V1,
N1, and N2  are also affected. Arm is expected to release software mitigations f
or its cores. What is unclear is whether custom versions of these cores (e.g., s
elect cores from Qualcomm) are also affected and when the potential security hol
es will be covered.

Since this is a proof-of-concept vulnerability and it is being mitigated by Inte
l and Arm, it should not be able to be used to attack a client or server machine
 — as long as all the latest patches are installed. There's no indication how m
uch the mitigations will impact performance.

----------
https://i.imgur.com/RVYbywG.jpg

----
Sent from BePTT on my SHARP FS8002

--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 49.216.134.64 (臺灣)
※ 文章網址: https://www.ptt.cc/bbs/PC_Shopping/M.1646801901.A.FFE.html
推 aioloslin   : 是AMD運氣好嗎？常常都沒他的事
→ ejsizmmy    : 架構不同，分支預測做法不同
→ ejsizmmy    : 不會說都沒有，但是會比較少
推 oopFoo      : https://bit.ly/3hOWZRF
→ oopFoo      : 其實沒有比較少，只是沒人無聊一直
→ oopFoo      : 貼。這一個還算蠻有趣的
推 a3831038    : AMD自己bug就夠搞了
推 hcwang1126  : Designer: 又要多浪費電晶體了
推 marunaru    : 一直都有，看大不大條和好不好修而
→ marunaru    : 已，以前的漏洞是修完-50%效能才被
→ marunaru    : 幹
→ ltytw       : AMD被炮是因為效能原本就沒有intel
→ ltytw       : 好  修完BUG例如當年TLB BUG效能
→ ltytw       : 又更少
推 ltytw       : 安全漏洞無感吧  用AMD的很少
→ ltytw       :                    的人
→ Medic       : i皇「跟上!! AMD快跟上!!」
推 ww578912tw  : I皇就靠漏洞偷效能
推 yymeow      : 當年分支預測漏洞號稱修補後最多會
→ yymeow      : 降20%效能，但是實測之後影響很小
→ yymeow      : 不過這個一系列漏洞的確打亂了i社
→ yymeow      : 的處理器布局，黑暗的九代U大部分都
→ yymeow      : 拿掉了HT，整個市場定位亂掉
→ yymeow      : 九代可以說是最亂的一代
推 sincere77   : 打了補丁又要降幾%效能
推 art1        : 原來是宣稱喔？我還以為是真的 XD
推 yymeow      : 那時很多團隊都測試過了，是有影響
→ yymeow      : 但是對於一般user的影響很小。分支
→ yymeow      : 預測的漏洞影響最大的是server用戶
→ yymeow      : 當時比較擔心的是ssh key會被這種小
→ yymeow      : 刀掘牆滴水穿石的方式偷走。但以結
→ yymeow      : 果而言，駭客寧願去選更有效率的方
→ yymeow      : 式
→ Risedo      : e3 1231 v3被吃很多校能幹
推 tint        : #1TD5NRWH (PC_Shopping)
→ tint        : 之前九代 還更新了步進從硬體層面修
推 saimeitetsu : Xeon E5 那時候I/O影響比較大
推 aegis43210  : 12代分支預測已經改良過了
推 tuwile      : 又有漏洞了喔...