研究人員發現2011年到2019年的AMD處理器 - 3C
By Poppy
at 2020-03-10T11:19
at 2020-03-10T11:19
Table of Contents
研究人員發現2011年到2019年的AMD處理器皆存在旁路攻擊漏洞
奧地利格拉茨科技大學研究人員發表的論文指出,AMD為了最佳化CPU的效能和能耗,在
L1D快取採用一種預測器,以高效率的方式,預測特定記憶體位址位於哪一個快取路(Way
)中,研究人員可以透過操縱L1D快取預測器,來洩漏AMD處理器的機密資料。
這個被稱為Take A Way的漏洞,影響AMD從2011年到2019年的所有處理器,包括使用Zen微
基礎架構的處理器,不過,AMD在官網上對該漏洞的回應,僅提供針對推測執行漏洞的一
般性建議。
研究人員表示,他們對2011年和2019年晶片中,微基礎架構的快取預測器進行逆向工程,
找出了兩種新的攻擊方式,第一種是利用Collide+Probe方法,這將能讓攻擊者在分時邏
輯核心中,不需要記憶體實體位置或是共享記憶體,就能監控受害者記憶體存取。
第二種方法則是Load+Reload,可利用預測器的漏洞,在同一個實體核心中,獲得受害者
高精準度的記憶體存取追蹤,雖然Load+Reload方法仰賴共享記憶體,但是卻不會使快取
塊(Cache Line)無效化,可在不觸發末級快取(Last-Level-Cache)驅除(Eviction)
的情況下,悄悄地進行攻擊。
研究人員展示漏洞的實際攻擊範例,利用在Chrome和Firefox瀏覽器上執行JavaScript程
式碼,存取AES加密金鑰。且不只是沙盒化的JavaScript,由於受影響的處理器也被用在
雲端資料中心中,研究人員也展示了將該漏洞用在虛擬化雲端環境的攻擊方法。
論文中也提及該漏洞的補救措施,但未評估修復程式所帶來的效能損失,研究人員表示,
Take A Way漏洞與Spectre和Meltdown漏洞不同之處在於,Take A Way僅會洩漏少量元資
料,並非提供完整的資料存取權限。
而AMD也在3月7日回應Take A Way漏洞,他們提到,研究人員將此資料路徑和已經緩解的
軟體和推測性漏洞連結,而AMD並不認為這是新的攻擊,並且建議使用者更新平臺軟體和
韌體,讓作業系統採用現有推測執行漏洞的緩解措施,同時實作軟體的重要函式庫,最好
也要使用最新版本,避免受到旁路攻擊,除了針對推測執行漏洞的一般性建議,AMD並沒
有提供任何額外針對Take A Way漏洞的韌體補丁或是具體建議。
而漏洞主要研究者在3月8日於推特上表示,這項漏洞仍然沒有受到修正,攻擊者依然可以
尋論文說明的步驟,攻擊AMD的處理器。
有趣的是,這篇論文的致謝,特別感謝了英特爾提供額外的資金,作為慷慨的禮物這篇
研究受注意的原因是,Take A Way漏洞共同作者,過去也揭露了許多英特爾的漏洞,包括
Spectre和Meltdown,還有ARM、AMD和IBM多個漏洞,論文第一作者也負責任的在推特上,
揭露了學校以及學生的資助來源,並提到英特爾尊重學術自由與獨立性,並且已資助該計
畫兩年。
https://www.ithome.com.tw/news/136231?fbclid=IwAR0BHAnh1utGVkSbhPGZkPPn3sGa9cnqAN-L6KCtkM2tp0RFO_eSorkNwrE
--
Tags:
3C
All Comments
By Dinah
at 2020-03-13T16:08
at 2020-03-13T16:08
By John
at 2020-03-17T20:04
at 2020-03-17T20:04
By Barb Cronin
at 2020-03-21T05:04
at 2020-03-21T05:04
By Vanessa
at 2020-03-23T09:13
at 2020-03-23T09:13
By Xanthe
at 2020-03-25T00:47
at 2020-03-25T00:47
By Lily
at 2020-03-29T15:28
at 2020-03-29T15:28
By Dinah
at 2020-04-02T18:21
at 2020-04-02T18:21
By Edith
at 2020-04-05T04:35
at 2020-04-05T04:35
By Callum
at 2020-04-05T12:24
at 2020-04-05T12:24
By Sierra Rose
at 2020-04-09T22:53
at 2020-04-09T22:53
By Tristan Cohan
at 2020-04-10T06:43
at 2020-04-10T06:43
By Kama
at 2020-04-15T01:11
at 2020-04-15T01:11
By Sierra Rose
at 2020-04-15T14:52
at 2020-04-15T14:52
By Skylar Davis
at 2020-04-17T14:55
at 2020-04-17T14:55
By Daniel
at 2020-04-18T19:33
at 2020-04-18T19:33
By Damian
at 2020-04-20T01:43
at 2020-04-20T01:43
By Zanna
at 2020-04-22T18:11
at 2020-04-22T18:11
By Olive
at 2020-04-23T03:06
at 2020-04-23T03:06
By Zora
at 2020-04-23T21:33
at 2020-04-23T21:33
By Andy
at 2020-04-26T10:51
at 2020-04-26T10:51
By Olive
at 2020-04-27T13:30
at 2020-04-27T13:30
By Noah
at 2020-04-27T15:24
at 2020-04-27T15:24
By Una
at 2020-04-27T20:25
at 2020-04-27T20:25
By Daph Bay
at 2020-05-02T17:23
at 2020-05-02T17:23
By Elma
at 2020-05-04T04:01
at 2020-05-04T04:01
By Ula
at 2020-05-08T01:30
at 2020-05-08T01:30
By Ivy
at 2020-05-12T19:06
at 2020-05-12T19:06
By Oliver
at 2020-05-13T11:47
at 2020-05-13T11:47
By Adele
at 2020-05-13T21:57
at 2020-05-13T21:57
By Lauren
at 2020-05-16T02:44
at 2020-05-16T02:44
By Brianna
at 2020-05-17T01:41
at 2020-05-17T01:41
By Dorothy
at 2020-05-18T08:05
at 2020-05-18T08:05
By Adele
at 2020-05-19T16:12
at 2020-05-19T16:12
By Anonymous
at 2020-05-22T04:32
at 2020-05-22T04:32
By Mason
at 2020-05-23T09:31
at 2020-05-23T09:31
By Isla
at 2020-05-26T21:20
at 2020-05-26T21:20
By Doris
at 2020-05-28T11:34
at 2020-05-28T11:34
By Dorothy
at 2020-05-31T17:04
at 2020-05-31T17:04
By Dorothy
at 2020-06-01T10:29
at 2020-06-01T10:29
By Skylar DavisLinda
at 2020-06-02T14:23
at 2020-06-02T14:23
By Irma
at 2020-06-06T17:55
at 2020-06-06T17:55
By Ingrid
at 2020-06-09T06:12
at 2020-06-09T06:12
By Edward Lewis
at 2020-06-13T16:33
at 2020-06-13T16:33
By Megan
at 2020-06-17T09:16
at 2020-06-17T09:16
By Ivy
at 2020-06-19T14:49
at 2020-06-19T14:49
By Connor
at 2020-06-20T19:18
at 2020-06-20T19:18
By Sarah
at 2020-06-25T01:28
at 2020-06-25T01:28
By Hazel
at 2020-06-29T11:35
at 2020-06-29T11:35
By Quintina
at 2020-07-01T13:27
at 2020-07-01T13:27
By Donna
at 2020-07-03T00:03
at 2020-07-03T00:03
By Kumar
at 2020-07-03T04:48
at 2020-07-03T04:48
By Bethany
at 2020-07-06T07:25
at 2020-07-06T07:25
By Rosalind
at 2020-07-07T18:21
at 2020-07-07T18:21
By Emily
at 2020-07-09T12:18
at 2020-07-09T12:18
By Wallis
at 2020-07-10T22:16
at 2020-07-10T22:16
By Candice
at 2020-07-12T22:15
at 2020-07-12T22:15
By Vanessa
at 2020-07-13T04:58
at 2020-07-13T04:58
By Charlie
at 2020-07-16T07:11
at 2020-07-16T07:11
By Regina
at 2020-07-20T01:35
at 2020-07-20T01:35
By Frederic
at 2020-07-21T04:52
at 2020-07-21T04:52
By Eartha
at 2020-07-23T03:00
at 2020-07-23T03:00
By Rachel
at 2020-07-27T09:05
at 2020-07-27T09:05
By Donna
at 2020-08-01T08:16
at 2020-08-01T08:16
By Callum
at 2020-08-01T14:11
at 2020-08-01T14:11
By Robert
at 2020-08-05T02:46
at 2020-08-05T02:46
By Frederica
at 2020-08-09T14:27
at 2020-08-09T14:27
By Daph Bay
at 2020-08-12T22:25
at 2020-08-12T22:25
Related Posts
舊電腦想玩PUBG
By Blanche
at 2020-03-10T09:24
at 2020-03-10T09:24
哀家10代CPU售價流出
By Jack
at 2020-03-10T05:53
at 2020-03-10T05:53
Intel:10nm很快過去 5nm重奪領導地位
By Jack
at 2020-03-10T02:06
at 2020-03-10T02:06
20k 電腦升級
By Xanthe
at 2020-03-10T01:30
at 2020-03-10T01:30
55-60K PTT 看片 打GAME
By Freda
at 2020-03-10T01:04
at 2020-03-10T01:04