CPUの脆弱性 Spectre / Vulnerability of CPU, Spectre

CPUの脆弱性 Spectre / Vulnerability of CPU, Spectre

PHPer向けSpectre解説 / PHP勉強会#122の発表資料です

40575ebf9c2f4a6e3bcb68630f446a3b?s=128

HASEGAWA Tomoki

January 31, 2018
Tweet

Transcript

  1. ௕୩઒ஐر $16ͷ੬ऑੑ4QFDUSF

  2. ௕୩઒ஐر !UPN[PI

  3. ϥΠϑϫʔΫ 8FCJ04ΞϓϦ։ൃ  Ϗʔϧ ిࢠ޻࡞ αοΧʔ؍ઓ  ϨϯλϧΧʔτϨʔε ʜ σδλϧαʔΧεגࣜձࣾ

    ෭ஂ௕$50 !UPN[PI
  4. None
  5. None
  6. 8FC%FWFMPQNFOUXJUI 8&"3&)*3*/( IUUQXXXEHDJSDVTDPN 0NPUFTBOEP 5PLZP

  7. ࣗݾ঺հ͸͍͍͔Β ͜Ε͚ͩݴΘͤͯ

  8. None
  9. ϖνύʔΧΠΪχηϯδϡ΢ϋν

  10. None
  11. None
  12. ٕज़ΧϯϑΝϨϯε

  13. ٕज़ΧϯϑΝϨϯε ˺

  14. ٕज़ΧϯϑΝϨϯε ˺େษڧձ

  15. ٕज़ΧϯϑΝϨϯε ˺େษڧձ ே͔Β൩·Ͱ

  16. ٕज़ΧϯϑΝϨϯε ˺େษڧձ ே͔Β൩·Ͱ ٕज़τʔΫࡾດ

  17. ָ͍͠ίϯςϯπ

  18. None
  19. ࠙਌ձ

  20. ࠙਌ձ -5େձ

  21. ૬ஊձ ࠙਌ձ -5େձ

  22. ૬ஊձ -BSBWFM $BLF1)1 
 $*ςετͳͲͳͲ ࠙਌ձ -5େձ

  23. ૬ஊձ ΞϯΧϯϑΝϨϯε -BSBWFM $BLF1)1 
 $*ςετͳͲͳͲ ࠙਌ձ -5େձ

  24. None
  25. νέοτઈࢍൢചத

  26. νέοτઈࢍൢചத εϙϯαʔઈࢍืूத

  27. νέοτઈࢍൢചத IUUQTQIQFSLBJHJKQ εϙϯαʔઈࢍืूத

  28. ੋඇ͝ࢀՃΛʂ

  29. ੋඇ͝ࢀՃΛʂ IUUQTQIQFSLBJHJKQ

  30. ͯ͞ɻ

  31. ࠓ೔ͷςʔϚ

  32. $16ͷ੬ऑੑ4QFDUSF ε ϖ Ϋ λ ʔ

  33. ೥݄೔

  34. IUUQTHPPHMFQSPKFDU[FSPCMPHTQPUKQSFBEJOHQSJWJMFHFENFNPSZXJUITJEFIUNM

  35. XJUIBTJEFDIBOOFM ࣙॻӳࣙ࿠POUIF8&# QSJWJMFHFE 3FBEJOH NFNPSZ

  36. XJUIBTJEFDIBOOFM ࣙॻӳࣙ࿠POUIF8&# 3FBEJOH NFNPSZ QSJWJMFHFE

  37. XJUIBTJEFDIBOOFM QSJWJMFHFE ʲ໊ʳʬUIFʙʭಛݖ֊ڃʦ૚ʧ ʲܗʳಛݖΛ࣋ͭɺಛݖͷ͋Δ ࣙॻӳࣙ࿠POUIF8&# 3FBEJOH NFNPSZ QSJWJMFHFE

  38. ಡΊͯ͸͍͚ͳ͍ϝϞϦྖҬΛ ಡΊͯ͠·͏

  39. ͳͥେ͖ͳ࿩୊ʹͳ͍ͬͯΔ͔

  40. ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍

  41. 7BSJBOUTPGUIJTJTTVFBSFLOPXOUPBGGFDU NBOZNPEFSOQSPDFTTPST JODMVEJOHDFSUBJO QSPDFTTPSTCZ*OUFM ".%BOE"3. ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍

  42. 7BSJBOUTPGUIJTJTTVFBSFLOPXOUPBGGFDU NBOZNPEFSOQSPDFTTPST JODMVEJOHDFSUBJO QSPDFTTPSTCZ*OUFM ".%BOE"3. .BD 8JOEPXTϚγϯ 8FCαʔόͳͲ֤छαʔό ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍

  43. 7BSJBOUTPGUIJTJTTVFBSFLOPXOUPBGGFDU NBOZNPEFSOQSPDFTTPST JODMVEJOHDFSUBJO QSPDFTTPSTCZ*OUFM ".%BOE"3. .BD 8JOEPXTϚγϯ 8FCαʔόͳͲ֤छαʔό J1IPOF "OESPJE

    ϧʔλ *P5ػث ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍
  44. ᶄରࡦ͕औΓͮΒ͍ ৄࡉ͸ޙड़

  45. ͲΜͳ੬ऑੑ͔

  46. ͷલʹ$16جૅ஌ࣝ

  47. جૅ஌ࣝΩϟογϡ

  48. Ωϟογϡ ݱ୅ͷ$16͸ΩϟογϡΛଟ༻͢Δ

  49. Ωϟογϡ ݱ୅ͷ$16͸ΩϟογϡΛଟ༻͢Δ ߴ଎ʹಈ࡞ͤ͞ΔͨΊ

  50. Ωϟογϡ ݱ୅ͷ$16͸ΩϟογϡΛଟ༻͢Δ ߴ଎ʹಈ࡞ͤ͞ΔͨΊ Ұ౓ಡΜͩσʔλ͸Ωϟογϡʹஔ͘

  51. جૅ஌ࣝ౤ػ࣮ߦ

  52. զʑ͸1)1FSͳͷͰ 1)1Ά͍ݴޠͰղઆ

  53. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  FDIP1$  FYJU    FDIPl8PSME
  54. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  FDIP1$  FYJU    FDIPl8PSME ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ
  55. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  FDIP1$  FYJU    FDIPl8PSME ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ΋࣮ߦ͢Δ
  56. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  FDIP1$  FYJU    FDIPl8PSME ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ΋࣮ߦ͢Δ ʣͷJGͷ݁ՌʹΑͬͯ͸ ແବʹͳΔ͚Ͳ౤ػ࣮ߦ͢Δ
  57. جૅ஌ࣝྫ֎

  58. $16 ΞυϨεۭؒ(# ΞυϨεόεCJU  G G G G G G

    G G GGGGGGGG   (#
  59. $16 ΞυϨεۭؒ(# ΞυϨεόεCJU  G G G G G G

    G G GGGGGGGG   (# 04
  60. $16 ΞυϨεۭؒ(# ΞυϨεόεCJU  G G G G G G

    G G GGGGGGGG   (# 04 ϢʔβϓϩάϥϜ
  61. $16 ΞυϨεۭؒ(# ΞυϨεόεCJU  G G G G G G

    G G GGGGGGGG   (# 04 ϢʔβϓϩάϥϜ ϢʔβϓϩάϥϜ͕
 04ͷྖҬͷϝϞϦʹ
 ΞΫηε͢Δͱྫ֎
 ൃੜ
  62. جૅ஌ࣝ౤ػ࣮ߦ جૅ஌ࣝΩϟογϡ جૅ஌ࣝྫ֎

  63. $16ͷ੬ऑੑ4QFDUSF ε ϖ Ϋ λ ʔ

  64. ͜ΜͳϓϩάϥϜ͕͋ͬͨͱ͢Δ

  65. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ  
  66. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ   ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ
  67. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ   ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ
  68. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ   ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ
  69. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ   ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ຊདྷ͸ྫ֎͕ൃੜ͢ΔΞΫηε ౤ػ࣮ߦத͸ྫ֎ൃੜ͠ͳ͍ ʢຊ࣮ߦ͡Όͳ͍ͷͰʣ
  70. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ   ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ʣ C  ͷ஋Λ
 Dʹ֨ೲɻ
  71. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ   ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ʣ C  ͷ஋Λ
 Dʹ֨ೲɻ w ʙGGͷൣғ w ϢʔβϓϩάϥϜ͔ΒΞΫηεͰ͖ΔྖҬ w ͜ͷΞΫηεͰʙGGͷ
 Ͳ͔͜ͷόΠτ͕Ωϟογϡʹ৐Δ
  72. ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B

    \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍ΞυϨεʣ   ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ʣ C  ͷ஋Λ
 Dʹ֨ೲɻ
  73. ΞυϨε ಺༰  YY  YY  YY  YY

     YY  YY  YY   GG YY ΞυϨε ಺༰  GPS JJJ \  TUBSUUJNF   ESFBE J    FOEUJNF   JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^  ^  SFUVSO
  74. ΞυϨε ಺༰  YY  YY  YY  YY

     YY  YY  YY   GG YY ΞυϨε ಺༰  GPS JJJ \  TUBSUUJNF   ESFBE J    FOEUJNF   JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^  ^  SFUVSO ॱ൪ʹಡΈࠐΈ͔͔ͯͬͨ࣌ؒ͠Λଌఆ
  75. ΞυϨε ಺༰  YY  YY  YY  YY

     YY  YY  YY   GG YY ΞυϨε ಺༰  GPS JJJ \  TUBSUUJNF   ESFBE J    FOEUJNF   JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^  ^  SFUVSO ॱ൪ʹಡΈࠐΈ͔͔ͯͬͨ࣌ؒ͠Λଌఆ ͚ͩ͘͢͝ಡΈࠐΈ͕଎͔ͬͨ
 ‎͕Ωϟογϡʹ৐͍ͬͯͨ ‎ຊདྷಡΊͳ͍ͷ಺༰͸ͩͬͨ
  76. ΞυϨε ಺༰  YY  YY  YY  YY

     YY  YY  YY   GG YY ΞυϨε ಺༰  GPS JJJ \  TUBSUUJNF   ESFBE J    FOEUJNF   JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^  ^  SFUVSO ॱ൪ʹಡΈࠐΈ͔͔ͯͬͨ࣌ؒ͠Λଌఆ ΞυϨε ಺༰  FDIP)FMMP  BSBOE   JG B \HPUP^  CSFBE    DSFBE C    ʢΞΫηεݖͷͳ͍஋ʣ   ͚ͩ͘͢͝ಡΈࠐΈ͕଎͔ͬͨ
 ‎͕Ωϟογϡʹ৐͍ͬͯͨ ‎ຊདྷಡΊͳ͍ͷ಺༰͸ͩͬͨ
  77. $16ͷ੬ऑੑ4QFDUSF ε ϖ Ϋ λ ʔ ʢݫີʹ͸4QFDUSFͱ.FMUEPXOͷ૊߹ͤʣ

  78. ͜Μͳ͓࿩Ͱͨ͠

  79. ͓΋͠Ζ͍Ͱ͢Ͷʂ

  80. ͱ͜ΖͰʜ

  81. ᶄରࡦ͕औΓͮΒ͍

  82. ᶄରࡦ͕औΓͮΒ͍ wۙ୅ͷ$16͸ɺ໋ྩΛ୯७Խͯ͠$16಺ͷσό ΠεͰ෼ۀͯ͠ॲཧ͢Δ͜ͱͰߴ଎Խ͍ͯ͠Δɻ w$16ͷ֎ͷ஗͍σόΠεΛͨͩ଴ͪͨ͘ͳ͍ɻ w౤ػ࣮ߦͦ͜ߴ଎ԽͷΩϞ͔ͩΒɻ

  83. ͜ΕͰऴΘΓͰ͕͢ʜ

  84. ΋͏ճ͚ͩࠂ஌

  85. νέοτઈࢍൢചத IUUQTQIQFSLBJHJKQ εϙϯαʔઈࢍืूத

  86. ͱΓ͋͑ͣࠓ೥͸༷ࢠݟʁ

  87. དྷ೥͕͋Δͱࢥ͏ͳΑʂʂ

  88. ʢࠓ೥͕੒ޭ͢Ε͹དྷ೥΋Ͱ͖·͢ʂ དྷͯԼ͍͓͞ئ͍͠·͢ʂʣ

  89. νέοτઈࢍൢചத IUUQTQIQFSLBJHJKQ εϙϯαʔઈࢍืूத

  90. ສ͕Ұ͕࣌ؒ༨ͬͨͱ͖ͷͨΊͷ ͓·͚

  91. %ʙ% "ʙ" *OUFM1FOUJVN

  92. %ʙ% "ʙ" *OUFM1FOUJVN ΞυϨεόεϏοτ ʙGGGGGGGGͷ(# "ʙ"͸ݻఆ όΠτʢϏοτʣ୯ҐͷΞΫηε

  93. ()[   ճTFDԯճTFD ʢʢ5#TFDˠ5#TFDˠ(#TFDʣˠ(#TFDˠ(#TFDʣˠ.#TFD FUIFS ˠ.#TFD JOUFSFOU $16ͷΩϟογϡͱϝϞϦ $16

    -.# (#TFD ίΞ -,#
 5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD
  94. ()[   ճTFDԯճTFD ʢʢ5#TFDˠ5#TFDˠ(#TFDʣˠ(#TFDˠ(#TFDʣˠ.#TFD FUIFS ˠ.#TFD JOUFSFOU $16ͷΩϟογϡͱϝϞϦ $16

    -.# (#TFD ίΞ -,#
 5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ
  95. ()[   ճTFDԯճTFD ʢʢ5#TFDˠ5#TFDˠ(#TFDʣˠ(#TFDˠ(#TFDʣˠ.#TFD FUIFS ˠ.#TFD JOUFSFOU $16ͷΩϟογϡͱϝϞϦ $16

    -.# (#TFD ίΞ -,#
 5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ ഒ
  96. ()[   ճTFDԯճTFD ʢʢ5#TFDˠ5#TFDˠ(#TFDʣˠ(#TFDˠ(#TFDʣˠ.#TFD FUIFS ˠ.#TFD JOUFSFOU $16ͷΩϟογϡͱϝϞϦ $16

    -.# (#TFD ίΞ -,#
 5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ ഒ ഒ
  97. ()[   ճTFDԯճTFD ʢʢ5#TFDˠ5#TFDˠ(#TFDʣˠ(#TFDˠ(#TFDʣˠ.#TFD FUIFS ˠ.#TFD JOUFSFOU $16ͷΩϟογϡͱϝϞϦ $16

    -.# (#TFD ίΞ -,#
 5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ ഒ ഒ ഒ
  98. σʔλͷہॴੑ wϓϩάϥϜ͕σʔλΛΞΫηε͢Δ৔߹ɺ ͍ۙྖҬʹ࿈ଓͯ͠ΞΫηε͢Δ͜ͱ͕ ଟ͍ɻ w͍ۭۙؒతPS࣌ؒత

  99.  QIQ GPS JJJ \ FDIP)FMMP8PSME ^ L2 #0 EXT_STMT

    L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1
  100.  QIQ GPS JJJ \ FDIP)FMMP8PSME ^ L2 #0 EXT_STMT

    L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1 ۭؒతʹ͍ۙ
 ಉ͡ͱ͜ΖΛճ͍ͬͯΔ
  101.  QIQ GPS JJJ \ FDIP)FMMP8PSME ^ L2 #0 EXT_STMT

    L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1
  102.  QIQ GPS JJJ \ FDIP)FMMP8PSME ^ L2 #0 EXT_STMT

    L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1 Jʹසൟʹ ΞΫηε
 ͍ͯ͠Δ
  103. ෼ذ༧ଌόοϑΝ

  104. ෼ذ༧ଌόοϑΝ w෼ذΛ༧ଌͰ͖Δͱ౤ػ࣮ߦ͕ແବʹͳΓʹ͍ɻخ͍͠ɻ wաڈͷ෼ذΛهԱ͓͍ͯͯ͠ɺ֬཰తͳφχͰ༧ଌ͢Δɻ
 ʢ෼ذ༧ଌόοϑΝʣ wϐϯϙΠϯτʹʮ͜ͷ෼ذ໋ྩʯͱ͍͏όοϑΝͱɺ৔ॴ ʹݶΒͣʮ͜͜෼ذʯͱ͍͏࣌ؒతͳൣғͰఆΊͨόο ϑΝ΋͋Δɻ

  105. ෼ذ༧ଌόοϑΝ w෼ذΛ༧ଌͰ͖Δͱ౤ػ࣮ߦ͕ແବʹͳΓʹ͍ɻخ͍͠ɻ wաڈͷ෼ذΛهԱ͓͍ͯͯ͠ɺ֬཰తͳφχͰ༧ଌ͢Δɻ
 ʢ෼ذ༧ଌόοϑΝʣ wϐϯϙΠϯτʹʮ͜ͷ෼ذ໋ྩʯͱ͍͏όοϑΝͱɺ৔ॴ ʹݶΒͣʮ͜͜෼ذʯͱ͍͏࣌ؒతͳൣғͰఆΊͨόο ϑΝ΋͋Δɻ ‎$16͕ϓϩάϥϚͷบΛಡΜͰ͍Δ
 ʢͱ΋ݴ͑ΔͷͰ͸ͳ͍ͩΖ͏͔ʣ

  106. νέοτઈࢍൢചத IUUQTQIQFSLBJHJKQ εϙϯαʔઈࢍืूத