{"id":167488,"date":"2026-04-04T17:11:55","date_gmt":"2026-04-04T15:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataki-gddrhammer-i-geforge-iskazhayushhie-pamyat-gpu-dlya-dostupa-ko-vsej-pamyati-cpu"},"modified":"2026-04-04T17:11:55","modified_gmt":"2026-04-04T15:11:56","slug":"ataki-gddrhammer-i-geforge-iskazhayushhie-pamyat-gpu-dlya-dostupa-ko-vsej-pamyati-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataki-gddrhammer-i-geforge-iskazhayushhie-pamyat-gpu-dlya-dostupa-ko-vsej-pamyati-cpu","title":{"rendered":"\u00datoky GDDRHammer a GeForge, kter\u00e9 zkresluj\u00ed pam\u011b\u0165 GPU pro p\u0159\u00edstup ke v\u0161em pam\u011btem CPU","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z n\u011bkolika univerzit v USA a Austr\u00e1lii vyvinuli dv\u011b \u00fatoky t\u0159\u00eddy Rowhammer \u2014 GDDRHammer a GeForge, kter\u00e9 umo\u017e\u0148uj\u00ed p\u0159i prov\u00e1d\u011bn\u00ed neprivilegovan\u00e9ho j\u00e1dra CUDA na GPU NVIDIA dos\u00e1hnout zkreslen\u00ed jednotliv\u00fdch bit\u016f v pam\u011b\u0165ov\u00fdch \u010dipech GDDR. Na rozd\u00edl od metody GPUHammer, prezentovan\u00e9 minul\u00fd rok, nov\u00e9 \u00fatoky nejsou omezeny na data zpracov\u00e1van\u00e1 v pam\u011bti GPU, ale umo\u017e\u0148uj\u00ed pln\u00fd p\u0159\u00edstup k celkov\u00e9 hlavn\u00ed pam\u011bti souvisej\u00edc\u00ed s adresn\u00edm prostorem CPU. V\u00fdzkumn\u00edci demonstrovali exploity, kter\u00e9 poskytuj\u00ed root p\u0159\u00edstup k hlavn\u00edmu syst\u00e9mu p\u0159i prov\u00e1d\u011bn\u00ed neprivilegovan\u00e9ho CUDA j\u00e1dra na GPU. <\/p>\n

Oba \u00fatoky zp\u016fsobuj\u00ed p\u0159ed\u010dasnou ztr\u00e1tu n\u00e1boje v ur\u010dit\u00fdch bu\u0148k\u00e1ch grafick\u00e9 pam\u011bti, ke kter\u00fdm \u00fato\u010dn\u00edci nemaj\u00ed p\u0159\u00edm\u00fd p\u0159\u00edstup, co\u017e vede ke zm\u011bn\u011b bit\u016f ulo\u017een\u00fdch v t\u011bchto bu\u0148k\u00e1ch. Mo\u017enost \u010dten\u00ed a z\u00e1pisu do pam\u011bti, kter\u00e1 se vztahuje k adresn\u00edmu prostoru CPU, je realizov\u00e1na prost\u0159ednictv\u00edm z\u00e1sahu do pr\u00e1ce alok\u00e1toru pam\u011bti GPU (cudaMalloc), aby do\u0161lo k naru\u0161en\u00ed izolace pam\u011bti GPU a zobrazen\u00ed virtu\u00e1ln\u00edch adres GPU na libovoln\u00e9 adresy fyzick\u00e9 pam\u011bti GPU nebo CPU. <\/p>\n

Zasahov\u00e1n\u00ed se uskute\u010d\u0148uje prost\u0159ednictv\u00edm zkreslov\u00e1n\u00ed hodnot bit\u016f v pam\u011bti grafick\u00e9 karty, kde jsou ulo\u017eeny tabulky str\u00e1nek pam\u011bti GPU odpov\u011bdn\u00e9 za p\u0159evod virtu\u00e1ln\u00edch adres na fyzick\u00e9. Rozd\u00edly mezi \u00fatoky GDDRHammer a GeForge spo\u010d\u00edvaj\u00ed v tom, \u017ee metoda GDDRHammer modifikuje tabulku str\u00e1nek posledn\u00ed \u00farovn\u011b (PT \u2014 Last Level Page Table), zat\u00edmco metoda GeForge modifikuje katalog str\u00e1nek posledn\u00ed \u00farovn\u011b (PD0 \u2014 Last Level Page Directory). <\/p>\n

Mezi jin\u00fdmi se uveden\u00e9 tabulky pro p\u0159eklad adres pou\u017e\u00edvaj\u00ed k organizaci p\u0159\u00edm\u00e9ho p\u0159\u00edstupu GPU k pam\u011bti CPU, proto zm\u011bna adresy v tabulce str\u00e1nek GPU na fyzickou adresu v hlavn\u00ed opera\u010dn\u00ed pam\u011bti a nastaven\u00ed p\u0159\u00edznaku APERTURE, kter\u00fd zap\u00edn\u00e1 re\u017eim mapov\u00e1n\u00ed pam\u011bti CPU, umo\u017e\u0148uje \u010d\u00edst a zapisovat data s p\u0159\u00edstupem k hlavn\u00ed pam\u011bti p\u0159es sb\u011brnici PCIe p\u0159i vypnut\u00e9m IOMMU (ve v\u00fdchoz\u00edm stavu vypnuto).

\"\u00datoky<\/center>
\"\u00datoky<\/center> <\/p>\n

\u00dasp\u011b\u0161n\u00e9 \u00fatoky byly demonstrov\u00e1ny na vysoce v\u00fdkonn\u00fdch profesion\u00e1ln\u00edch grafick\u00fdch kart\u00e1ch NVIDIA RTX A6000 postaven\u00fdch na mikroarchitektu\u0159e Ampere (cena nov\u00fdch karet za\u010d\u00edn\u00e1 od $6850, zat\u00edmco pou\u017eit\u00e9 za\u010d\u00ednaj\u00ed od $4000) a b\u011b\u017en\u00fdch modelech NVIDIA RTX 3060 ($250-300). Vyvinut\u00e1 technika obch\u00e1zen\u00ed ochrany proti Rowhammer v kombinaci s vyu\u017eit\u00edm GPU zpracov\u00e1n\u00ed paraleln\u00edch operac\u00ed umo\u017enila 64n\u00e1sobn\u011b zv\u00fd\u0161it frekvenci v\u00fdskytu zkreslen\u00ed bun\u011bk ve srovn\u00e1n\u00ed s p\u0159edchoz\u00edmi \u00fatoky. Jako do\u010dasn\u00e9 opat\u0159en\u00ed k blokov\u00e1n\u00ed \u00fatok\u016f m\u016f\u017ee t\u00fdm zapnout re\u017eim opravy chyb ECC (Error Correcting Codes) p\u0159\u00edkazem 'nvidia-smi -e 1', ale to vede k dodate\u010dn\u00fdm n\u00e1klad\u016fm a potenci\u00e1ln\u011b m\u016f\u017ee b\u00fdt obch\u00e1zeno pomoc\u00ed metod \u00fatok\u016f, jako jsou ECCploit a ECC.fail.