{"id":37192,"date":"2018-03-13T16:51:14","date_gmt":"2018-03-13T15:51:14","guid":{"rendered":"http:\/\/www.planet3dnow.de\/cms\/?p=37192"},"modified":"2018-03-21T19:08:50","modified_gmt":"2018-03-21T18:08:50","slug":"security-firma-veroeffentlicht-sicherheitsluecken-in-amd-ryzen-und-epyc","status":"publish","type":"post","link":"https:\/\/www.planet3dnow.de\/cms\/37192-security-firma-veroeffentlicht-sicherheitsluecken-in-amd-ryzen-und-epyc\/","title":{"rendered":"Fake? \u2013 Security-Firma ver\u00f6ffentlicht Sicherheitsl\u00fccken in Ryzen und Epyc (Update)"},"content":{"rendered":"

Update vom 13.03.2018, 17:52 Uhr<\/strong>
\nUnge\u00adach\u00adtet aller ver\u00adwen\u00adde\u00adter \u201ch\u00e4t\u00adte\u201d, \u201csoll\u201d und \u201cangeb\u00adlich\u201d in der Ori\u00adgi\u00adnal\u00admel\u00addung; die\u00adses White\u00adpa\u00adper stinkt zum Him\u00admel! Wir haben eben die Way\u00adback-Maschi\u00adne bem\u00fcht. Die CTS-Web\u00adsei\u00adte hat vor Janu\u00adar 2018 kei\u00adne rele\u00advan\u00adten Inhal\u00adte ver\u00ad\u00f6f\u00adfent\u00adlicht. Daf\u00fcr exis\u00adtiert ein Hack von 2012 der angeb\u00adli\u00adchen Security-Webseite:<\/p>\n

<\/p>

<\/a><\/center>\n

Wom\u00f6g\u00adlich steckt hin\u00adter der Ver\u00ad\u00f6f\u00adfent\u00adli\u00adchung eine Short-Atta\u00adcke von Vice\u00adroy Rese\u00adarch<\/a>,\u2026<\/p>\n

<\/p>

<\/a><\/center>\n

\u2026die wegen \u00e4hn\u00adli\u00adcher Atta\u00adcken bereits ins Visier der BaFin<\/a> gera\u00adten sind.<\/p>\n

<\/p>

<\/a><\/center>\n

Ori\u00adgi\u00adnal\u00admel\u00addung<\/strong>
\nCTS-Labs ist nach Anga\u00adben auf der Web\u00adsei\u00adte<\/a> ein Bera\u00adtungs\u00adun\u00adter\u00adneh\u00admen f\u00fcr Cyber\u00adsi\u00adcher\u00adheit mit Sitz in Isra\u00adel, das sich auf die Sicher\u00adheit von ASICs und ein\u00adge\u00adbet\u00adte\u00adten Sys\u00adte\u00admen spe\u00adzia\u00adli\u00adsiert hat. Die\u00adse Fir\u00adma hat heu\u00adte ein White\u00adpa\u00adper<\/a> ver\u00ad\u00f6f\u00adfent\u00adlicht, das zahl\u00adrei\u00adche Sicher\u00adheits\u00adl\u00fc\u00adcken rund um die Ryzen- und Epyc-Platt\u00adfor\u00admen von AMD<\/span> auf\u00adzei\u00adgen soll. Dazu hat das Unter\u00adneh\u00admen eine eige\u00adne Web\u00adsei\u00adte auf\u00adge\u00adlegt, die AMDFLAWS<\/span><\/a> hei\u00dft.<\/p>\n

<\/p>

<\/a><\/center>Das Unter\u00adneh\u00admen lis\u00adtet eine Samm\u00adlung aus 13 Sicher\u00adheits\u00adl\u00fc\u00adcken, die zwar alle\u00adsamt nicht direkt die Pro\u00adzes\u00adsor-Ker\u00adne betref\u00adfen, jedoch deren Umfeld. Sie sind ein\u00adge\u00adord\u00adnet in Mas\u00adter Key, Ryzen\u00adfall, Fall\u00adout und Chi\u00adme\u00adra. Seit dem AMD<\/span> Bee\u00adma besit\u00adzen alle AMD-Pro\u00adzes\u00adso\u00adren den Secu\u00adre Pro\u00adces\u00adsor (PSP<\/span>), einen klei\u00adnen ARM-Chip, der eine Trus\u00adted Zone errich\u00adten und eigent\u00adlich die Sicher\u00adheit ver\u00adbes\u00adsern soll. Das Intel-Pen\u00addant dazu ist die Manage\u00adment-Engi\u00adne, die bereits in den letz\u00adten Mona\u00adten mit zahl\u00adrei\u00adchen ent\u00addeck\u00adten L\u00fccken nega\u00adtiv auf\u00adge\u00adfal\u00adlen<\/a> war. Dass das AMD-Gegen\u00adst\u00fcck \u00e4hn\u00adli\u00adche L\u00fccken auf\u00adwei\u00adsen k\u00f6nn\u00adte, wur\u00adde seit lan\u00adgem vermutet.\n

Die zwei\u00adte Fami\u00adlie an L\u00fccken betrifft den AMD<\/span> Epyc Ser\u00adver-Pro\u00adzes\u00adsor, der sei\u00adnen lau\u00adfen\u00adden vir\u00adtu\u00adel\u00adlen Maschi\u00adnen jeweils ver\u00adschl\u00fcs\u00adsel\u00adte Spei\u00adcher\u00adbe\u00adrei\u00adche zur Ver\u00adf\u00fc\u00adgung stel\u00adlen kann. Auch hier wur\u00adde bereits vor eini\u00adgen Mona\u00adten Feh\u00adler bekannt, mit deren Hil\u00adfe es m\u00f6g\u00adlich sein k\u00f6nn\u00adte, die\u00adse Spei\u00adcher\u00adver\u00adschl\u00fcs\u00adse\u00adlung zu umgehen.<\/p>\n

Vul\u00adnerabi\u00adli\u00adties Impact
\nMASTERKEY<\/span>\u20111 MASTERKEY<\/span>\u20112 MASTERKEY<\/span>\u20113
\n# Per\u00adsis\u00adtent mal\u00adwa\u00adre run\u00adning insi\u00adde AMD<\/span> Secu\u00adre Processor
\n# Bypass firm\u00adware-based secu\u00adri\u00adty fea\u00adtures such as Secu\u00adre Encrypt\u00aded Vir\u00adtua\u00adliza\u00adti\u00adon (SEV<\/span>) and Firm\u00adware Trus\u00adted Plat\u00adform Modu\u00adle (fTPM)
\n# Net\u00adwork cre\u00adden\u00adti\u00adal theft. Bypass Micro\u00adsoft Vir\u00adtua\u00adliza\u00adti\u00adon-based Secu\u00adri\u00adty (VBS<\/span>), inclu\u00adding Win\u00addows Cre\u00adden\u00adti\u00adal Guard
\n# Phy\u00adsi\u00adcal dama\u00adge to hard\u00adware (SPI<\/span> flash wear-out, etc.)
\n# Affects: EPYC<\/span>, Ryzen, Ryzen Pro, Ryzen Mobi\u00adle. Suc\u00adcessful\u00adly exploi\u00adted on EPYC<\/span> and Ryzen
\nPage 6 of 20<\/p>\n

RYZENFALL<\/span>\u20111 FALLOUT<\/span>\u20111
\n# Wri\u00adte to pro\u00adtec\u00adted memo\u00adry are\u00adas, including:
\no Win\u00addows Iso\u00adla\u00adted User Mode and Iso\u00adla\u00adted Ker\u00adnel Mode (VTL1<\/span>)
\no AMD<\/span> Secu\u00adre Pro\u00adces\u00adsor Fen\u00adced DRAM<\/span> \u2013 Allows direct tam\u00adpe\u00adring with trus\u00adted code run\u00adning on AMD<\/span> Secu\u00adre Pro\u00adces\u00adsor. Only appli\u00adca\u00adble to sel\u00adect Ryzen motherboards
\n# Net\u00adwork cre\u00adden\u00adti\u00adal theft. Bypass Micro\u00adsoft Vir\u00adtua\u00adliza\u00adti\u00adon-based Secu\u00adri\u00adty (VBS<\/span>) inclu\u00adding Win\u00addows Cre\u00adden\u00adti\u00adal Guard
\n# Enables memo\u00adry-resi\u00addent VTL1<\/span> mal\u00adwa\u00adre that is resi\u00adli\u00adent against most end\u00adpoint secu\u00adri\u00adty solutions
\n# Affects: EPYC<\/span>, Ryzen, Ryzen Pro, Ryzen Mobi\u00adle. Suc\u00adcessful\u00adly exploi\u00adted on EPYC<\/span>, Ryzen, Ryzen Pro and Ryzen Mobile<\/p>\n

RYZENFALL<\/span>\u20112 FALLOUT<\/span>\u20112
\n# Disable Secu\u00adre Manage\u00adment RAM<\/span> (SMRAM<\/span>) read\/write protection
\n# Enables memo\u00adry-resi\u00addent SMM<\/span> mal\u00adwa\u00adre, resi\u00adli\u00adent against most end\u00adpoint secu\u00adri\u00adty solutions
\n# Affects: EPYC<\/span>, Ryzen, Ryzen Pro. Suc\u00adcessful\u00adly exploi\u00adted on EPYC<\/span>, Ryzen, Ryzen Pro. Ryzen Mobi\u00adle is not affected<\/p>\n

RYZENFALL<\/span>\u20113 FALLOUT<\/span>\u20113
\n# Read from pro\u00adtec\u00adted memo\u00adry are\u00adas, including:
\no Win\u00addows Iso\u00adla\u00adted User Mode and Iso\u00adla\u00adted Ker\u00adnel Mode (VTL1<\/span>)
\no Secu\u00adre Manage\u00adment RAM<\/span> (SMRAM<\/span>)
\no AMD<\/span> Secu\u00adre Pro\u00adces\u00adsor Fen\u00adced DRAM<\/span>. Only appli\u00adca\u00adble to sel\u00adect Ryzen motherboards
\n# Net\u00adwork cre\u00adden\u00adti\u00adal theft. Bypass Win\u00addows Cre\u00adden\u00adti\u00adal Guard by rea\u00adding secrets from VTL1<\/span> memory
\n# Affects: EPYC<\/span>, Ryzen, Ryzen Pro. Suc\u00adcessful\u00adly exploi\u00adted on EPYC<\/span>, Ryzen, Ryzen Pro. Ryzen Mobi\u00adle is not affected<\/p>\n

RYZENFALL<\/span>\u20114
\n# Arbi\u00adtra\u00adry code exe\u00adcu\u00adti\u00adon on AMD<\/span> Secu\u00adre Processor
\n# Bypass firm\u00adware-based secu\u00adri\u00adty fea\u00adtures such as Firm\u00adware Trus\u00adted Plat\u00adform Modu\u00adle (fTPM)
\n# Net\u00adwork cre\u00adden\u00adti\u00adal theft. Bypass Micro\u00adsoft Vir\u00adtua\u00adliza\u00adti\u00adon-based Secu\u00adri\u00adty (VBS<\/span>), inclu\u00adding Win\u00addows Cre\u00adden\u00adti\u00adal Guard
\n# Phy\u00adsi\u00adcal dama\u00adge to hard\u00adware (SPI<\/span> flash wear-out, etc.)
\n# Affects: Ryzen, Ryzen Pro. Suc\u00adcessful\u00adly exploi\u00adted on Ryzen, Ryzen Pro.<\/p>\n

CHIMERA-FW<\/span> CHIMERA-HW<\/span>
\n# Two sets of manu\u00adfac\u00adtu\u00adrer back\u00addoors: One imple\u00admen\u00adted in firm\u00adware, the other in hard\u00adware (ASIC<\/span>)
\n# Allows mal\u00adwa\u00adre to inject its\u00adelf into the chipset\u2019s inter\u00adnal 8051 archi\u00adtec\u00adtu\u00adre processor
\n# The chip\u00adset links the CPU<\/span> to USB<\/span>, SATA<\/span>, and PCI<\/span>\u2011E devices. Net\u00adwork, WiFi and Blue\u00adtooth traf\u00adfic often flows through the chip\u00adset as well
\n# Mal\u00adwa\u00adre run\u00adning insi\u00adde the chip\u00adset could take advan\u00adta\u00adge of the chipset\u2019s uni\u00adque posi\u00adti\u00adon as a midd\u00adle\u00adman for hard\u00adware peripherals
\n# Affects: Ryzen, Ryzen Pro. Suc\u00adcessful\u00adly exploi\u00adted on Ryzen and Ryzen Pro.<\/p><\/blockquote>\n

Die eigent\u00adli\u00adche Neu\u00adig\u00adkeit des White\u00adpa\u00adpers ist der Vor\u00adwurf, dass die Aus\u00adla\u00adge\u00adrung der Chip\u00adsatz-Ent\u00adwick\u00adlung f\u00fcr die Zen-Platt\u00adfor\u00admen<\/a> an ASMe\u00addia, einer Toch\u00adter von ASUS\u00adtek, f\u00fcr zahl\u00adrei\u00adche wei\u00adte\u00adre L\u00fccken gesorgt haben soll. So soll der Pro\u00admon\u00adto\u00adry-Zusatz\u00adchip (gemein\u00adhin als \u201cChip\u00adsatz\u201d bezeich\u00adnet, obwohl die Zen-Platt\u00adfor\u00admen bekannt\u00adlich kei\u00adnen klas\u00adsi\u00adschen Chip\u00adsatz mehr haben, da sie SoCs sind) ein\u00adge Back\u00addoors (Hin\u00adter\u00adt\u00fcr\u00adchen) ent\u00adhal\u00adten, \u00fcber die man etwa \u00fcber USB<\/span>, Netz\u00adwerk, SATA<\/span>, WiFi usw. Schad\u00adcode ein\u00adschleu\u00adsen k\u00f6nne.<\/p>\n

<\/p>

<\/a><\/center>Grund\u00ads\u00e4tz\u00adlich wirft das White\u00adpa\u00adper AMD<\/span> eine schlech\u00adte Qua\u00adli\u00adt\u00e4ts\u00adkon\u00adtrol\u00adle in Sachen Sicher\u00adheit vor:\n

Many of the vul\u00adnerabi\u00adli\u00adties descri\u00adbed in this docu\u00adment are indi\u00adca\u00adti\u00adons of poor secu\u00adri\u00adty prac\u00adti\u00adces and insuf\u00adfi\u00adci\u00adent secu\u00adri\u00adty qua\u00adli\u00adty con\u00adtrols. The Ryzen and Ryzen Pro chip\u00adsets, curr\u00adent\u00adly ship\u00adping with explo\u00adita\u00adble back\u00addoors, could not have pas\u00adsed even the most rudi\u00admen\u00adta\u00adry white-box secu\u00adri\u00adty review. The Secu\u00adre Pro\u00adces\u00adsor, curr\u00adent\u00adly ship\u00adping with no fewer than ten cri\u00adti\u00adcal vul\u00adnerabi\u00adli\u00adties that bypass most of its secu\u00adri\u00adty fea\u00adtures, is aff\u00adlic\u00adted with basic secu\u00adri\u00adty design errors. Fur\u00adther\u00admo\u00adre, neither the Secu\u00adri\u00adty Pro\u00adces\u00adsor nor the Chip\u00adset offer any signi\u00adfi\u00adcant miti\u00adga\u00adti\u00adons against explo\u00adita\u00adti\u00adon should a vul\u00adnerabi\u00adli\u00adty be discovered.<\/p><\/blockquote>\n

<\/p>