Ukuba sengozini kungenxa yezici zokuthuthukisa inkumbulo kuma-Intel processors.
Futhi, kutholwe ubungozi ohlelweni lokuqagela lwemiyalelo lwe-Intel processors, futhi kulokhu umcwaningi we-Google, umemezele ukuthi uhlonze ubungozi obusha (obuvele bufakwe kuhlu ngaphansi I-CVE-2022-40982), ebizwa ngokuthi "Ukuwa"
Ukwehla, ukuba sengozini okuvumela ukunquma okuqukethwe kwe-XMM, YMM kanye namarejista evektha e-ZMM, ayesetshenziswa ngaphambilini ezinye izinqubo lapho kusetshenziswa imiyalelo ye-AVX kumongo ofanayo we-CPU.
Mayelana Nokuwa
Mayelana nokuba sengozini, kuyashiwo lokho umhlaseli ongenalungelo ngokukwazi ukusebenzisa ikhodi yakho kusistimu, ingasebenzisa ubungozi ukuvuza idatha kwezinye izinqubo zabasebenzisi, i-kernel yesistimu, i-Intel SGX enclaves ehlukanisiwe, nemishini ebonakalayo.
Amarejista e-vector ahlungwayo asetshenziswa kakhulu ekubetheni, emisebenzini yekhophi yenkumbulo, nasekucubunguleni izintambo, isibonelo, lawa marejista asetshenziswa kulabhulali ye-Glibc emisebenzini ye-memcpy, strcmp, ne-strlen, phakathi kwezinye izinto. Ngokombono ongokoqobo, ubungozi bungase busetshenziswe ukuze kunqunywe idatha ecutshungulwa ku-AES-NI noma ku-REP-MOVS imiyalelo (esetshenziswa kumsebenzi we-memcpy) kwezinye izinqubo, ezingavuza okhiye bokubethela, idatha ebucayi kanye namaphasiwedi omsebenzisi.
Ukuba sengozini kuzibonakalisa kuma-Intel processors esekela i-AVX2 ne-AVX-512 amasethi emfundo anwetshiwe (okusho ukuthi ithinta amaphrosesa esizukulwane sesi-6 kuya kwese-11), kuyilapho ama-Intel processors asekelwe ku-Alder Lake, i-Raptor Lake ne-Sapphire Rapids microarchitectures awabonakali ethintekile.
Njengasengozini esanda kutholwa ye-Zenbleed ethinta abacubunguli be-AMD Zen2, kokuthi Downfall, isizathu sokuba sengozini ukuvuza kwedatha kumafayela okungena, asetshenziselwa ukwabelana ngokuqukethwe kwelogi kuzo zonke izinhlelo zokusebenza. imisebenzi kumongo ofanayo we-CPU.
Ukuvuza kungenxa yokudluliswa kwedatha okuqagelayo lapho kusetshenziswa isitatimende se-GATHER, etholakala ngezandiso ze-AVX2 ne-AVX-512, futhi yakhelwe ukunikeza ukufinyelela okusheshayo kudatha ehlukene esenkumbulweni. Ngesikhathi sokwenziwa kwesitatimende se-GATHER, idatha endala kufayela lokubhalisa isetshenziselwa ukukhishwa okucatshangelwayo kwemiyalelo encike. Le datha ayiboniswa ngokuqondile kulogi lwesofthiwe, kodwa inganqunywa kusetshenziswa amasu okuhlasela esiteshi eseceleni adizayinelwe ukuhlasela kwe-Meltdown, njengokudlulisa idatha esele kunqolobane ye-CPU.
Ukuxhaphaza i-Downfall, kwasungulwa indlela yokuhlasela ebizwa ngokuthi Gather Data Sampling (GDS) nokuthi izibonelo zokuxhaphaza zishicilelwe ukuze kukhishwe okhiye be-cryptographic enqubweni yomunye umsebenzisi, ukuvuza idatha ngemva kokuthi ikopishelwe ku-Linux kernel ngomsebenzi we-memcpy, futhi kunqandwe izinhlamvu eziphrintiwe ezishiywe kumarejista e-vector ngemva kokusebenza kwezinye izinqubo. Isibonelo, ibonisa ikhono lokuchaza okhiye be-AES abasetshenziselwa ukubethela idatha kunqubo yomunye umsebenzisi kusetshenziswa ilabhulali ye-OpenSSL.
Indlela yabonisa ukusebenza kahle okuphezulu: ngokwenza ukuhlolwa ngokhiye abayi-100 abahlukene, u-100% wokhiye be-AES-128 kanye no-86% wokhiye be-AES-256 banqunywa ngesikhathi somzamo ngamunye wokunquma amasekhondi angekho ngaphezu kwe-10. Kumasistimu wamafu, ukuhlasela kungasetshenziswa ukucacisa ukuthi iyiphi idatha ecutshungulwayo kweminye imishini ebonakalayo. Kungenzeka ukuthi ubungozi bungasetshenziswa ngokusayinda ikhodi ye-JavaScript kusiphequluli sewebhu.
Kufanele kukhulunywe ukuthi Ii-ntel ithole ngale nkinga ngonyaka odlule (ncamashi ngenyanga ka-Agasti) nokuthi ubungozi benziwe esidlangalaleni kulo nyaka kuphela engqungqutheleni yeBlackHat USA. kanye nokulungiswa kokuqapha ukuba sengozini sekuvele kufakiwe kuzibuyekezo ezihlukahlukene ze-Linux kernel kusukela kunguqulo 6.4.9 6.1.44 kuya ku-4.14.321.
Ngaphezu kwalokhu, phakathi kwezinyathelo ezingase zibe khona zokugwema umthelela omubi wokuvikela ekubeni sengozini Yokwehla ekusebenzeni, kukhulunywa ngokwenza izinguquko kubadidiyeli ukuze kukhubazwe ukusetshenziswa kwesitatimende se-GATHER noma ukwengeza isitatimende ngokushesha ngemva kwe-GATHER LFENCE, okuvimbela ukuqaliswa kokuqala kwezitatimende ezilandelayo ngaphambi kokuthi kuqedwe konke ukuzinikela kwangaphambilini.
Kuzinhlelo lapho ukulungiswa kwe-firmware kungatholakali khona, ukusekela kwazo zonke izandiso ze-AVX kukhutshaziwe, kuyilapho engxenyeni ye-Intel microcode update, futhi inikeza amandla okusebenzisa isixhumi esibonakalayo se-MSR ukukhubaza i-firmware ngokukhetha. ukuvikelwa kumongo wezinqubo ngazinye.
Ekugcineni, uma unentshisekelo yokwazi kabanzi ngakho, ungabheka imininingwane kufayela le- isixhumanisi esilandelayo.