{"id":61492,"date":"2021-03-02T10:34:36","date_gmt":"2021-03-02T09:34:36","guid":{"rendered":"https:\/\/www.planet3dnow.de\/cms\/?p=61492"},"modified":"2021-03-02T11:06:54","modified_gmt":"2021-03-02T10:06:54","slug":"erste-exploits-fuer-cpu-sicherheitsluecke-spectre-verfuegbar","status":"publish","type":"post","link":"https:\/\/www.planet3dnow.de\/cms\/61492-erste-exploits-fuer-cpu-sicherheitsluecke-spectre-verfuegbar\/","title":{"rendered":"Erste Exploits f\u00fcr CPU-Sicherheitsl\u00fccke Spectre verf\u00fcgbar"},"content":{"rendered":"<p>Nach einem <a href=\"https:\/\/dustri.org\/b\/spectre-exploits-in-the-wild.html\" target=\"_blank\" rel=\"noopener\">Bericht des Sicher\u00adheits\u00adexper\u00adten Juli\u00aden Voi\u00adsin<\/a> sind f\u00fcr die Spect\u00adre-Sicher\u00adheits\u00adl\u00fc\u00adcke (Ver\u00adsi\u00adon 1 \/ <span class=\"caps\">CVE-2017<\/span>\u20135753) \u2014 von der nahe\u00adzu alle moder\u00adnen CPUs betrof\u00adfen sind \u2014 ers\u00adte Exploits f\u00fcr Win\u00addows und Linux nun in Benut\u00adzung, so dass alle nicht gepatch\u00adten Sys\u00adte\u00adme ver\u00adwund\u00adbar sein d\u00fcrf\u00adten. Sowohl die Betriebssystem\u2011, als auch die CPU-Her\u00adstel\u00adler hat\u00adten in der Ver\u00adgan\u00adgen\u00adheit L\u00f6sun\u00adgen \u2014 ent\u00adwe\u00adder in Soft\u00adware oder per Micro\u00adco\u00adde\u00adup\u00addate \u2014 bereitgestellt.<\/p>\n<blockquote><p>Tho\u00adse run\u00adning older <span class=\"caps\">OS<\/span> ver\u00adsi\u00adons on older sili\u00adcon (2015-era PCs with Has\u00adwell or older Intel pro\u00adces\u00adsors) are pro\u00adba\u00adb\u00adly the most expo\u00adsed to Spect\u00adre attacks.<\/p>\n<p>\u2026<\/p>\n<p>Adding to that, even if an atta\u00adcker would get their hands on any of the two exploits, only&nbsp;run\u00adning them will not get any results as they both have to be exe\u00adcu\u00adted with the right arguments.<\/p>\n<p>Quel\u00adle: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/working-windows-and-linux-spectre-exploits-found-on-virustotal\/\" target=\"_blank\" rel=\"noopener\">Blee\u00adping Computer<\/a><\/p><\/blockquote>\n<p>Laut&nbsp;<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/working-windows-and-linux-spectre-exploits-found-on-virustotal\/\" target=\"_blank\" rel=\"noopener\">Blee\u00adping Com\u00adpu\u00adter<\/a> \u2014 einer Infor\u00adma\u00adti\u00adons\u00adsei\u00adte f\u00fcr Com\u00adpu\u00adter\u00adsi\u00adcher\u00adheit \u2014 d\u00fcrf\u00adten vor allem PCs mit \u00e4lte\u00adren Intel-Pro\u00adzes\u00adso\u00adren (Has\u00adwell und fr\u00fc\u00adher) und nicht aktu\u00adel\u00adlen Betriebs\u00adsys\u00adte\u00admen gegen\u00ad\u00fcber Spect\u00adre anf\u00e4l\u00adlig sein. Die Exploits sol\u00adlen aber zus\u00e4tz\u00adlich erfor\u00addern, dass sich ein poten\u00adti\u00adel\u00adler Angrei\u00adfer pri\u00advi\u00adle\u00adgier\u00adte Rech\u00adte auf dem jewei\u00adli\u00adgen Sys\u00adtem verschafft.&nbsp;<\/p>\n<h3>Was ist Spectre f\u00fcr ein&nbsp;Bug?<\/h3>\n<p>Von dem <a href=\"https:\/\/www.planet3dnow.de\/cms\/35759-massive-sicherheitsluecke-in-intel-cpus-update-amd-arm-bugfixes-2\/\">Anfang 2018 bekannt gewor\u00adde\u00adnen Feh\u00adler<\/a> waren damals zwei bekannt, die sogar Namen erhal\u00adten haben: Melt\u00addown und Spect\u00adre. Von letz\u00adte\u00adrem sind meh\u00adre\u00adre Sze\u00adna\u00adri\u00aden m\u00f6g\u00adlich \u2013 damals zum Zeit\u00adpunkt der Erst\u00adver\u00ad\u00f6f\u00adfent\u00adli\u00adchung waren es&nbsp;zwei:<\/p>\n<ul>\n<li>Vari\u00adan\u00adte 1 \u201cSpect\u00adre 1\u201d : Bounds check bypass (<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2017-5753\" target=\"_blank\" rel=\"noopener\"><span class=\"caps\">CVE-2017<\/span>\u20135753<\/a>)\n<ul>\n<li>Vari\u00adan\u00adte 1.1 : Bounds check bypass store (<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2018-3693\" target=\"_blank\" rel=\"noopener\"><span class=\"caps\">CVE-2018<\/span>\u20133693<\/a>)<\/li>\n<\/ul>\n<\/li>\n<li>Vari\u00adan\u00adte 2 \u201cSpect\u00adre 2\u201d : Branch tar\u00adget injec\u00adtion (<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2017-5715\" target=\"_blank\" rel=\"noopener\"><span class=\"caps\">CVE-2017<\/span>\u20135715<\/a>)<\/li>\n<li>Vari\u00adan\u00adte 3 \u201cMelt\u00addown\u201d : Rogue data cache load (<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2017-5754\" target=\"_blank\" rel=\"noopener\"><span class=\"caps\">CVE-2017<\/span>\u20135754<\/a>)<\/li>\n<\/ul>\n<p>Sei\u00adner\u00adzeit haben die bei\u00adden sogar <a href=\"https:\/\/meltdownattack.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">eine Web\u00adsei\u00adte<\/a> erhal\u00adten, auf der Infor\u00adma\u00adtio\u00adnen gesam\u00admelt werden.<\/p>\n<p>Gemein ist allen drei\u00aden, dass durch leis\u00adtungs\u00adstei\u00adgern\u00adde Fea\u00adtures der <span class=\"caps\">CPU<\/span> \u2013 Out-of-Order-Exe\u00adcu\u00adti\u00adon, Branch Pre\u00addic\u00adtion und Spe\u00adcu\u00adla\u00adti\u00adve-Exe\u00adcu\u00adti\u00adon \u2013 die Tren\u00adnung der Daten zwi\u00adschen Pro\u00adzes\u00adsen und gar Rings nicht mehr 100-pro\u00adzen\u00adtig gew\u00e4hr\u00adleis\u00adtet ist. Mit trick\u00adrei\u00adchen Ans\u00e4t\u00adzen ist es m\u00f6g\u00adlich, Daten eines ande\u00adren Pro\u00adzes\u00adses aus\u00adzu\u00adle\u00adsen, was selbst\u00adre\u00addend ins\u00adbe\u00adson\u00adde\u00adre bei Anbie\u00adtern von Cloud-Diens\u00adten ein <span class=\"caps\">GAU<\/span> ist, wo sich vie\u00adle VMs auf einer Maschi\u00adne tum\u00admeln, denn der Trick funk\u00adtio\u00adniert \u00fcber VM-Gren\u00adzen hin\u00adweg. Da in moder\u00adnen Betriebs\u00adsys\u00adte\u00admen Ker\u00adnel-Spei\u00adcher in den User-Space gemappt wird \u2013 eben\u00adfalls zur Leis\u00adtungs\u00adstei\u00adge\u00adrung \u2013 kann so auch in den h\u00f6her pri\u00advi\u00adle\u00adgier\u00adten Sys\u00adtem\u00adspei\u00adcher\u00adbe\u00adreich vor\u00adge\u00addrun\u00adgen wer\u00adden, um Rech\u00adte zu ergat\u00adtern, Pass\u00adw\u00f6r\u00adter aus\u00adzu\u00adle\u00adsen oder Daten zu stehlen.<\/p>\n<h3>Wer hat die Bugs entdeckt und&nbsp;wann?<\/h3>\n<p>Ein For\u00adscher\u00adteam bei Goog\u00adle ist offen\u00adbar bereits im Juni 2017 auf die Pro\u00adble\u00adme gesto\u00ad\u00dfen und hat die Hard\u00adware- und Betriebs\u00adsys\u00adtem-Her\u00adstel\u00adler infor\u00admiert. Eine sehr aus\u00adf\u00fchr\u00adli\u00adche Ana\u00adly\u00adse ist <a href=\"https:\/\/googleprojectzero.blogspot.de\/2018\/01\/reading-privileged-memory-with-side.html\" target=\"_blank\" rel=\"noopener noreferrer\">hier<\/a> zu fin\u00adden. In Hacker\u00adkrei\u00adsen ist das Pro\u00adblem mit den Side-Chan\u00adnel-Atta\u00adcken \u00fcber Cache und <span class=\"caps\">TLB<\/span> aller\u00addings schon weit l\u00e4n\u00adger bekannt, wie eine Ver\u00ad\u00f6f\u00adfent\u00adli\u00adchung auf der <a href=\"https:\/\/www.blackhat.com\/docs\/us-16\/materials\/us-16-Jang-Breaking-Kernel-Address-Space-Layout-Randomization-KASLR-With-Intel-TSX.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">Black Hat <span class=\"caps\">USA<\/span> 2016<\/a> zeigt.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Nach einem <a href=\"https:\/\/dustri.org\/b\/spectre-exploits-in-the-wild.html\" target=\"_blank\" rel=\"noopener\">Bericht des Sicher\u00adheits\u00adexper\u00adten Juli\u00aden Voi\u00adsin<\/a> sind f\u00fcr die Spect\u00adre-Sicher\u00adheits\u00adl\u00fc\u00adcke (Ver\u00adsi\u00adon 1 \/ <span class=\"caps\">CVE-2017<\/span>\u20135753) \u2014 von der nahe\u00adzu alle moder\u00adnen CPUs betrof\u00adfen sind \u2014 ers\u00adte Exploits f\u00fcr Win\u00addows und Linux nun in Benut\u00adzung, so dass alle nicht gepatch\u00adten Sys\u00adte\u00adme ver\u00adwund\u00adbar sein d\u00fcrf\u00adten. Sowohl die Betriebssystem\u2011, als auch die CPU-Her\u00adstel\u00adler hat\u00adten in der Ver\u00adgan\u00adgen\u00adheit L\u00f6sun\u00adgen \u2014 ent\u00adwe\u00adder in Soft\u00adware oder per Micro-Code-Update \u2014 bereit\u00adge\u00adstellt. (\u2026) <a class=\"moretag\" href=\"https:\/\/www.planet3dnow.de\/cms\/61492-erste-exploits-fuer-cpu-sicherheitsluecke-spectre-verfuegbar\/\">Wei\u00adter\u00adle\u00adsen&nbsp;\u00bb<\/a><\/p>\n","protected":false},"author":593,"featured_media":35751,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"ngg_post_thumbnail":0,"footnotes":""},"categories":[12,11],"tags":[966,1010,1004,1420],"class_list":["post-61492","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aktuelles","category-news","tag-amd","tag-arm","tag-intel","tag-spectre","entry"],"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/posts\/61492","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/users\/593"}],"replies":[{"embeddable":true,"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/comments?post=61492"}],"version-history":[{"count":6,"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/posts\/61492\/revisions"}],"predecessor-version":[{"id":61498,"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/posts\/61492\/revisions\/61498"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/media\/35751"}],"wp:attachment":[{"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/media?parent=61492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/categories?post=61492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.planet3dnow.de\/cms\/wp-json\/wp\/v2\/tags?post=61492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}