PHPerのためのよくわかるCPU脆弱性解説 / What's the Spectre for PHPers

௕୩઒ஐر 1)1FSͷͨΊͷΑ͘Θ͔Δ $16੬ऑੑղઆ

௕୩઒ஐر !UPN[PI

ϥΠϑϫʔΫ ςοΫΧϯϑΝϨϯεӡӦࢀՃ 8FCJ04ΞϓϦ։ൃ Ϗʔϧ ిࢠ޻࡞ αοΧʔ؍ઓ Ϩϯλ ϧΧʔτϨʔε
ʜ σδλϧαʔΧεגࣜձࣾ ෭ஂ௕$50 !UPN[PI

8FC%FWFMPQNFOUXJUI 8&"3&)*3*/( IUUQXXXEHDJSDVTDPN 0NPUFTBOEP 5PLZP

ࠓ೔ͷςʔϚ

$16ͷ੬ऑੑ4QFDUSF ε ϖ Ϋ λ ʔ

೥݄೔

IUUQTHPPHMFQSPKFDU[FSPCMPHTQPUKQSFBEJOHQSJWJMFHFENFNPSZXJUITJEFIUNM

XJUIBTJEFDIBOOFM ࣙॻӳࣙ࿠POUIF8&# QSJWJMFHFE 3FBEJOH NFNPSZ

XJUIBTJEFDIBOOFM ࣙॻӳࣙ࿠POUIF8&# 3FBEJOH NFNPSZ QSJWJMFHFE

XJUIBTJEFDIBOOFM ࣙॻӳࣙ࿠POUIF8&# 3FBEJOH NFNPSZ QSJWJMFHFE QSJWJMFHFE ʲ໊ʳʬUIFʙʭಛݖ֊ڃʦ૚ʧ ʲܗʳಛݖΛ࣋ͭɺಛݖͷ͋Δ QSÍWɾJɾMFHFE

ಛݖྖҬͷϝϞϦΛ  αΠυνϟωϧ੬ऑੑΛ࢖ͬͯಡΈࠐΉ

ͭ·Γ

ಡΊͯ͸͍͚ͳ͍ϝϞϦྖҬΛ ಡΊͯ͠·͏

ͱͯ΋େ͖ͳ࿩୊ʹͳͬͨ

ͳͥେ͖ͳ࿩୊ʹͳ͔ͬͨ

ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍

7BSJBOUTPGUIJTJTTVFBSFLOPXOUPBGGFDU NBOZNPEFSOQSPDFTTPST JODMVEJOHDFSUBJO QSPDFTTPSTCZ*OUFM ".%BOE"3. ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍

7BSJBOUTPGUIJTJTTVFBSFLOPXOUPBGGFDU NBOZNPEFSOQSPDFTTPST JODMVEJOHDFSUBJO QSPDFTTPSTCZ*OUFM ".%BOE"3. .BD 8JOEPXTϚγϯ 8FCαʔόͳͲ֤छαʔό ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍

7BSJBOUTPGUIJTJTTVFBSFLOPXOUPBGGFDU NBOZNPEFSOQSPDFTTPST JODMVEJOHDFSUBJO QSPDFTTPSTCZ*OUFM ".%BOE"3. .BD 8JOEPXTϚγϯ 8FCαʔόͳͲ֤छαʔό J1IPOF "OESPJE
ϧʔλ *P5ػث ᶃର৅ʢͱࢥΘΕΔʣ$16͕͘͢͝ଟ͍

ᶄରࡦ͕औΓͮΒ͍

ᶄରࡦ͕औΓͮΒ͍ ৄࡉ͸ޙड़

ͲΜͳ੬ऑੑ͔

ͷલʹ$16جૅ஌ࣝ

جૅ஌ࣝΩϟογϡ

Ωϟογϡ

Ωϟογϡ $16ʹ಺ଂ͞Εͨߴ଎ͳϝϞϦ

Ωϟογϡ Ұ౓ಡΜͩσʔλ͸Ωϟογϡʹஔ͘ $16ʹ಺ଂ͞Εͨߴ଎ͳϝϞϦ

Ωϟογϡ ߴ଎ʹಈ࡞ͤ͞ΔͨΊʢϝϞϦ͸஗͍ʣ Ұ౓ಡΜͩσʔλ͸Ωϟογϡʹஔ͘ $16ʹ಺ଂ͞Εͨߴ଎ͳϝϞϦ

Ωϟογϡ ݱ୅ͷ$16͸ΩϟογϡΛଟ༻͢Δ ߴ଎ʹಈ࡞ͤ͞ΔͨΊʢϝϞϦ͸஗͍ʣ Ұ౓ಡΜͩσʔλ͸Ωϟογϡʹஔ͘ $16ʹ಺ଂ͞Εͨߴ଎ͳϝϞϦ

جૅ஌ࣝ౤ػత࣮ߦ

զʑ͸1)1FSͳͷͰ 1)1Ά͍ݴޠͰղઆ

ΞυϨε ಺༰ FDIP)FMMP BSBOE JG B
\HPUP^ FDIP1$ FYJU FDIPl8PSME

\HPUP^ FDIP1$ FYJU FDIPl8PSME ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ

\HPUP^ FDIP1$ FYJU FDIPl8PSME ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ΋࣮ߦ͢Δ

\HPUP^ FDIP1$ FYJU FDIPl8PSME ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ΋࣮ߦ͢Δ ʣͷJGͷ݁ՌʹΑͬͯ͸ ແବʹͳΔ͚Ͳ౤ػతʹ࣮ߦ͢Δ

جૅ஌ࣝྫ֎

$16 ΞυϨεۭؒ(# ΞυϨεόεCJU G G G G G G
G G GGGGGGGG (#

G G GGGGGGGG (# 04

G G GGGGGGGG (# 04 ϢʔβϓϩάϥϜ ϢʔβϓϩάϥϜ

G G GGGGGGGG (# 04 ϢʔβϓϩάϥϜ ϢʔβϓϩάϥϜ͕  $16͕ڐՄ͠ͳ͍  ྖҬͷϝϞϦʹ  ΞΫηε͢Δͱྫ֎  ϢʔβϓϩάϥϜ

IUUQMBCPSBUPSZTVCKQD IUNM

جૅ஌ࣝ౤ػత࣮ߦ جૅ஌ࣝΩϟογϡ جૅ஌ࣝྫ֎

جૅ஌ࣝ౤ػత࣮ߦ جૅ஌ࣝΩϟογϡ جૅ஌ࣝྫ֎ Ұ౓ϝϞϦ͔ΒಡΜͩσʔλΛߴ଎ͳϝϞϦʹஔ͍͓ͯ͘

جૅ஌ࣝ౤ػత࣮ߦ جૅ஌ࣝΩϟογϡ جૅ஌ࣝྫ֎ Ұ౓ϝϞϦ͔ΒಡΜͩσʔλΛߴ଎ͳϝϞϦʹஔ͍͓ͯ͘ ઌͷํΛ࣮ߦ͓ͯ͘͠

جૅ஌ࣝ౤ػత࣮ߦ جૅ஌ࣝΩϟογϡ جૅ஌ࣝྫ֎ Ұ౓ϝϞϦ͔ΒಡΜͩσʔλΛߴ଎ͳϝϞϦʹஔ͍͓ͯ͘ ઌͷํΛ࣮ߦ͓ͯ͘͠ $16͕ڐՄ͠ͳ͍ϝϞϦʹΞΫηε͢ΔͱΤϥʔ

$16ͷ੬ऑੑ4QFDUSF ε ϖ Ϋ λ ʔ

ઌʹ֓ཁΛղઆ

4QFDUSF֓ཁ

4QFDUSF֓ཁ wຊདྷ͸ΞΫηεͰ͖ͳ͍ྖҬʢ"ʣͷϝϞϦ಺༰Λ  ಡΈࠐΈɺಡΈࠐΜͩ஋Λ࢖ͬͯผͷΞΫηεͰ͖ ΔྖҬʢ#ʣͷϝϞϦ಺༰ΛಡΈࠐΉɻ  ˠྖҬʢ#ʣͷಛఆΞυϨε͕Ωϟογϡʹ৐Δ

4QFDUSF֓ཁ wຊདྷ͸ΞΫηεͰ͖ͳ͍ྖҬʢ"ʣͷϝϞϦ಺༰Λ  ಡΈࠐΈɺಡΈࠐΜͩ஋Λ࢖ͬͯผͷΞΫηεͰ͖ ΔྖҬʢ#ʣͷϝϞϦ಺༰ΛಡΈࠐΉɻ  ˠྖҬʢ#ʣͷಛఆΞυϨε͕Ωϟογϡʹ৐Δ wྖҬʢ#ʣͷϝϞϦΛ্͔Βॱ൪ʹಡΈࠐΈɺΧॴ ͚ͩಡΈࠐΈ଎౓͕଎͔ͬͨΞυϨεΛݟ͚ͭΔɻ 

͜ΜͳϝϞϦϚοϓΛ૝ఆ

''' ϢʔβϓϩάϥϜ ϢʔβϓϩάϥϜ ผͷϓϩάϥϜ

͜ΜͳϓϩάϥϜ͕͋ͬͨͱ͢Δ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ຊདྷ͸ྫ֎͕ൃੜ͢ΔΞΫηε ౤ػ࣮ߦத͸ྫ֎ൃੜ͠ͳ͍ ʢൃੜͨ͠ΒࠔΔʣ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ʣ C ͷ஋Λ  Dʹ֨ೲɻ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ʣ C ͷ஋Λ  Dʹ֨ೲɻ w ʙGGͷൣғ w ϢʔβϓϩάϥϜ͔ΒΞΫηεͰ͖ΔྖҬ w ͜ͷΞΫηεͰʙGGͷ  Ͳ͔͜ͷόΠτ͕Ωϟογϡʹ৐Δ

\HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍ΞυϨεʣ ʣ͜͜Β΁ΜΛ࣮ߦ͍ͯ͠Δ࣌ʹʜ ʣઌߦͯ͜͜͠Β΁Μ͕࣮ߦ͞ΕΔ ʣͷ஋ΛCʹ֨ೲɻ ʣ C ͷ஋Λ  Dʹ֨ೲɻ

ΞυϨε ಺༰ YY YY YY YY
YY YY YY GG YY ΞυϨε ಺༰ GPS JJJ \ TUBSUUJNF ESFBE J FOEUJNF JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^ ^ SFUVSO

YY YY YY GG YY ΞυϨε ಺༰ GPS JJJ \ TUBSUUJNF ESFBE J FOEUJNF JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^ ^ SFUVSO ॱ൪ʹಡΈࠐΈ͔͔ͯͬͨ࣌ؒ͠Λଌఆ

YY YY YY GG YY ΞυϨε ಺༰ GPS JJJ \ TUBSUUJNF ESFBE J FOEUJNF JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^ ^ SFUVSO ॱ൪ʹಡΈࠐΈ͔͔ͯͬͨ࣌ؒ͠Λଌఆ ͚ͩ͘͢͝ಡΈࠐΈ͕଎͔ͬͨ  ‎͕Ωϟογϡʹ৐͍ͬͯͨ ‎ຊདྷಡΊͳ͍ͷ಺༰͸ͩͬͨ

YY YY YY GG YY ΞυϨε ಺༰ GPS JJJ \ TUBSUUJNF ESFBE J FOEUJNF JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^ ^ SFUVSO ॱ൪ʹಡΈࠐΈ͔͔ͯͬͨ࣌ؒ͠Λଌఆ ΞυϨε ಺༰ FDIP)FMMP BSBOE JG B \HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍஋ʣ ͚ͩ͘͢͝ಡΈࠐΈ͕଎͔ͬͨ  ‎͕Ωϟογϡʹ৐͍ͬͯͨ ‎ຊདྷಡΊͳ͍ͷ಺༰͸ͩͬͨ

YY YY YY GG YY ΞυϨε ಺༰ GPS JJJ \ TUBSUUJNF ESFBE J FOEUJNF JG FOETUBSU \ FDIPͷ஋͸JͰͨ͠ʂʂ ^ ^ SFUVSO ॱ൪ʹಡΈࠐΈ͔͔ͯͬͨ࣌ؒ͠Λଌఆ ΞυϨε ಺༰ FDIP)FMMP BSBOE JG B \HPUP^ CSFBE DSFBE C ʢΞΫηεݖͷͳ͍஋ʣ

$16ͷ੬ऑੑ4QFDUSF ε ϖ Ϋ λ ʔ ʢݫີʹ͸4QFDUSFͱ.FMUEPXOͷ૊߹ͤʣ

͜Μͳ͓࿩Ͱͨ͠

͓΋͠Ζ͍Ͱ͢Ͷʂ

ͱ͜ΖͰʜ

ᶄରࡦ͕औΓͮΒ͍

ᶄରࡦ͕औΓͮΒ͍ wۙ୅ͷ$16͸ɺ໋ྩΛ୯७Խͯ͠$16಺ͷσό ΠεͰ෼ۀͯ͠ॲཧ͢Δ͜ͱͰߴ଎Խ͍ͯ͠Δɻ w$16ͷ֎ͷ஗͍σόΠεΛͨͩ଴ͪͨ͘ͳ͍ɻ  $16಺ʹख͕ۭ͘σόΠεΛ࡞Γͨ͘ͳ͍ɻ w౤ػత࣮ߦͦ͜ߴ଎ԽͷΩϞɻ

͓͠·͍ !UPN[PI w ࠙਌ձ w 1)1ΧϯϑΝϨϯεؔ੢  ٳܜࣨʢʁʣ w 5XJUUFS w
#MPH

ສ͕Ұ͕࣌ؒ༨ͬͨͱ͖ͷͨΊͷ ͓·͚

%ʙ% "ʙ" *OUFM1FOUJVN

%ʙ% "ʙ" *OUFM1FOUJVN ΞυϨεόεϏοτ ʙGGGGGGGGͷ(# "ʙ"͸ݻఆ όΠτʢϏοτʣ୯ҐͷΞΫηε

ᶄରࡦ͕औΓͮΒ͍ wۙ୅ͷ$16͸ɺ໋ྩΛ୯७Խͯ͠$16಺ͷσό ΠεͰ෼ۀͯ͠ॲཧ͢Δ͜ͱͰߴ଎Խ͍ͯ͠Δɻ w$16ͷ֎ͷ஗͍σόΠεΛͨͩ଴ͪͨ͘ͳ͍ɻ  $16಺ʹख͕ۭ͘σόΠεΛ࡞Γͨ͘ͳ͍ɻ w౤ػత࣮ߦͦ͜ߴ଎ԽͷΩϞɻ

Ͳ͏΍ͬͯରࡦ͍ͯ͠Δ͔

G G GGGGGGGG (# 04 ϢʔβϓϩάϥϜ

෼ذ༧ଌόοϑΝ

෼ذ༧ଌόοϑΝ w෼ذΛ༧ଌͰ͖Δͱ౤ػ࣮ߦ͕ແବʹͳΓʹ͍͘ɻخ͍͠ɻ wաڈͷ෼ذΛهԱ͓͍ͯͯ͠ɺ֬཰తͳφχͰ༧ଌ͢Δɻ  ʢ෼ذ༧ଌόοϑΝʣ wϐϯϙΠϯτʹʮ͜ͷ෼ذ໋ྩʯͱ͍͏όοϑΝͱɺ৔ॴʹ ݶΒͣʮ͜͜෼ذʯͱ͍͏࣌ؒతͳൣғͰఆΊͨόοϑΝ ΋͋Δɻ

෼ذ༧ଌόοϑΝ w෼ذΛ༧ଌͰ͖Δͱ౤ػ࣮ߦ͕ແବʹͳΓʹ͍͘ɻخ͍͠ɻ wաڈͷ෼ذΛهԱ͓͍ͯͯ͠ɺ֬཰తͳφχͰ༧ଌ͢Δɻ  ʢ෼ذ༧ଌόοϑΝʣ wϐϯϙΠϯτʹʮ͜ͷ෼ذ໋ྩʯͱ͍͏όοϑΝͱɺ৔ॴʹ ݶΒͣʮ͜͜෼ذʯͱ͍͏࣌ؒతͳൣғͰఆΊͨόοϑΝ ΋͋Δɻ ‎$16͕ϓϩάϥϚͷบΛಡΜͰ͍Δ  ʢͱ΋ݴ͑ΔͷͰ͸ͳ͍ͩΖ͏͔ʣ

()[ ճTFDԯճTFD ʢʢ5#TFDˠ5#TFDˠ(#TFDʣˠ(#TFDˠ(#TFDʣˠ.#TFD FUIFS ˠ.#TFD JOUFSFOU $16ͷΩϟογϡͱϝϞϦ $16
-.# (#TFD ίΞ -,#  5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD

-.# (#TFD ίΞ -,#  5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ

-.# (#TFD ίΞ -,#  5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ ഒ

-.# (#TFD ίΞ -,#  5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ ഒ ഒ

-.# (#TFD ίΞ -,#  5#TFD -,# 5#TFD ॲཧ૷ஔ ϝΠϯϝϞϦ (#(#TFD 44% 5#(#TFD ഒ ഒ ഒ ഒ

σʔλͷہॴੑ wϓϩάϥϜ͕σʔλΛΞΫηε͢Δ৔߹ɺ ͍ۙྖҬʹ࿈ଓͯ͠ΞΫηε͢Δ͜ͱ͕ ଟ͍ɻ w͍ۭۙؒతPS࣌ؒత

QIQ GPS JJJ \ FDIP)FMMP8PSME ^ L2 #0 EXT_STMT
L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1

L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1 ۭؒతʹ͍ۙ  ಉ͡ͱ͜ΖΛճ͍ͬͯΔ

L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1

L2 #1 ASSIGN $i 0 L2 #2 JMP J7 L3 #3 EXT_STMT L3 #4 ECHO "Hello World." L2 #5 POST_INC $i ~1 L2 #6 FREE ~1 L2 #7 IS_SMALLER $i 10 ~2 L2 #8 EXT_STMT L2 #9 JMPNZ ~2 J3 L6 #10 RETURN 1 Jʹසൟʹ ΞΫηε  ͍ͯ͠Δ

ࠂ஌

ʢۚʣʙʢ೔ʣ 1)1FS,BJHJ

ʢ໦ʣʙʢ೔ʣ

CVJMEFSTDPOUPLZP 5JDLFUPOTBMF

͓͠·͍ !UPN[PI w ࠙਌ձ w 1)1ΧϯϑΝϨϯεؔ੢  ٳܜࣨʢʁʣ w 5XJUUFS w
#MPH

PHPerのためのよくわかるCPU脆弱性解説 / What's the Spectre for...

PHPerのためのよくわかるCPU脆弱性解説 / What's the Spectre for PHPers

More Decks by HASEGAWA Tomoki

Other Decks in Technology

Featured

Transcript