{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"Pam\u011b\u0165ov\u00e9 \u010dipy DDR4 z\u016fst\u00e1vaj\u00ed n\u00e1chyln\u00e9 k \u00fatok\u016fm RowHammer, navzdory p\u0159idan\u00e9 ochran\u011b.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z Amsterdamsk\u00e9 svobodn\u00e9 univerzity, \u0160v\u00fdcarsk\u00e9ho feder\u00e1ln\u00edho technologick\u00e9ho institutu v Curychu a spole\u010dnosti Qualcomm provedli<\/a><\/noindex> zkoum\u00e1 \u00fa\u010dinnost ochrany proti \u00fatok\u016fm t\u0159\u00eddy, kter\u00e1 se pou\u017e\u00edv\u00e1 v modern\u00edch DDR4 \u010dipech RowHammer<\/a><\/noindex>, kter\u00e9 umo\u017e\u0148uj\u00ed zm\u011bnit obsah jednotliv\u00fdch bit\u016f dynamick\u00e9 opera\u010dn\u00ed pam\u011bti (DRAM). V\u00fdsledky byly nep\u0159\u00edzniv\u00e9 a \u010dipy DDR4 hlavn\u00edch v\u00fdrobc\u016f jsou st\u00e1le zraniteln\u00e9 (<\/a><\/noindex> CVE-2020-10255Zranitelnost RowHammer umo\u017e\u0148uje zkreslit obsah jednotliv\u00fdch bit\u016f pam\u011bti cyklick\u00fdm \u010dten\u00edm dat z sousedn\u00edch bun\u011bk pam\u011bti. Proto\u017ee DRAM pam\u011b\u0165 p\u0159edstavuje dvourozm\u011brn\u00e9 pole bun\u011bk, z nich\u017e ka\u017ed\u00e1 se skl\u00e1d\u00e1 z kondenz\u00e1toru a tranzistoru, neust\u00e1l\u00e9 \u010dten\u00ed stejn\u00e9 oblasti pam\u011bti vede k fluktuac\u00edm nap\u011bt\u00ed a anom\u00e1li\u00edm, kter\u00e9 zp\u016fsobuj\u00ed mal\u00e9 ztr\u00e1ty n\u00e1boje v sousedn\u00edch bu\u0148k\u00e1ch. Pokud je intenzita \u010dten\u00ed dostate\u010dn\u011b vysok\u00e1, m\u016f\u017ee bu\u0148ka ztratit dostate\u010dn\u00e9 mno\u017estv\u00ed n\u00e1boje a n\u00e1sleduj\u00edc\u00ed regenerace nestihne obnovit jej\u00ed p\u016fvodn\u00ed stav, co\u017e povede ke zm\u011bn\u011b hodnoty ulo\u017een\u00e9 v t\u00e9to bu\u0148ce.<\/a><\/noindex>). <\/p>\n

Pro blokov\u00e1n\u00ed tohoto efektu se v modern\u00edch DDR4 \u010dipech pou\u017e\u00edv\u00e1 technologie TRR (Target Row Refresh), kter\u00e1 m\u00e1 zabr\u00e1nit zkreslen\u00ed bun\u011bk p\u0159i prov\u00e1d\u011bn\u00ed \u00fatok\u016f typu RowHammer. Probl\u00e9m je v tom, \u017ee neexistuje jednotn\u00fd p\u0159\u00edstup k implementaci TRR a ka\u017ed\u00fd v\u00fdrobce CPU a pam\u011bti interpretuje TRR po sv\u00e9m, aplikuje vlastn\u00ed varianty ochrany a nezve\u0159ej\u0148uje podrobnosti implementace. <\/p>\n

Studium metod bloc\u00edrov\u00e1n\u00ed RowHammer u v\u00fdrobc\u016f umo\u017enilo snadno naj\u00edt cesty k obch\u00e1zen\u00ed ochrany. P\u0159i kontrole bylo zji\u0161t\u011bno, \u017ee praktikovan\u00fd princip \u201e
\nStudium metod blokov\u00e1n\u00ed RowHammer, kter\u00e9 v\u00fdrobci pou\u017e\u00edvaj\u00ed, umo\u017enilo snadno naj\u00edt cesty, jak obej\u00edt ochranu. P\u0159i kontrole se uk\u00e1zalo, \u017ee princip, kter\u00fd v\u00fdrobci praktikuji, je \u201e(security by obscurity) p\u0159i implementaci TRR pom\u00e1h\u00e1 pouze pro ochranu v konkr\u00e9tn\u00edch p\u0159\u00edpadech, kter\u00e9 pokr\u00fdvaj\u00ed typov\u00e9 \u00fatoky manipuluj\u00edc\u00ed se zm\u011bnou n\u00e1boje bun\u011bk v jedn\u00e9 nebo dvou sousedn\u00edch \u0159\u00e1dc\u00edch.<\/a><\/noindex> (security by obscurity) p\u0159i realizaci TRR pom\u00e1h\u00e1 pouze k ochran\u011b v soukrom\u00fdch p\u0159\u00edpadech, pokr\u00fdvaj\u00edc\u00edch typov\u00e9 \u00fatoky, manipuluj\u00edc\u00ed zm\u011bnou n\u00e1boje bun\u011bk v jedn\u00e9 nebo dvou sousedn\u00edch \u0159ad\u00e1ch. <\/p>\n

N\u00e1stroj vyvinut\u00fd v\u00fdzkumn\u00edky umo\u017e\u0148uje testovat zranitelnost \u010dip\u016f v\u016f\u010di v\u00edce\u00farov\u0148ov\u00fdm variant\u00e1m \u00fatoku RowHammer, p\u0159i kter\u00e9m se pokus o ovlivn\u011bn\u00ed n\u00e1boje prov\u00e1d\u00ed sou\u010dasn\u011b pro n\u011bkolik \u0159\u00e1dk\u016f pam\u011b\u0165ov\u00fdch bun\u011bk. Takov\u00e9to \u00fatoky umo\u017e\u0148uj\u00ed obch\u00e1zet ochranu TRR implementovanou n\u011bkter\u00fdmi v\u00fdrobci a vedou k po\u0161kozen\u00ed bit\u016f pam\u011bti i na nov\u00e9m za\u0159\u00edzen\u00ed s pam\u011bt\u00ed DDR4.
\nZ 42 zkouman\u00fdch DIMM modul\u016f se 13 modul\u016f uk\u00e1zalo b\u00fdt zraniteln\u00fdch v\u016f\u010di nekonven\u010dn\u00edm variant\u00e1m \u00fatoku RowHammer, navzdory proklamovan\u00e9 ochran\u011b. Problematick\u00e9 moduly byly vyrobeny spole\u010dnostmi SK Hynix, Micron a Samsung, jejich\u017e produkty pokryly<\/a><\/noindex> 95% trhu DRAM.<\/p>\n

Krom\u011b DDR4 byly zkoum\u00e1ny tak\u00e9 \u010dipy LPDDR4 pou\u017e\u00edvan\u00e9 v mobiln\u00edch za\u0159\u00edzen\u00edch, kter\u00e9 se tak\u00e9 uk\u00e1zaly b\u00fdt citliv\u00e9 na roz\u0161\u00ed\u0159en\u00e9 varianty \u00fatoku RowHammer. Konkr\u00e9tn\u011b byla na probl\u00e9m citliv\u00e1 pam\u011b\u0165 pou\u017e\u00edvan\u00e1 ve smartphonech Google Pixel, Google Pixel 3, LG G7, OnePlus 7 a Samsung Galaxy S10.<\/p>\n

V\u00fdzkumn\u00edci byli schopni na probl\u00e9mov\u00fdch \u010dipech DDR4 reprodukovat n\u011bkolik technik exploitace. Nap\u0159\u00edklad pou\u017eit\u00ed RowHammer-exploitu<\/a><\/noindex> pro PTE (Page Table Entries) vy\u017eadovalo pro z\u00edsk\u00e1n\u00ed privilegovan\u00fdch pr\u00e1v j\u00e1dra prov\u00e9st \u00fatok v rozmez\u00ed od 2,3 sekundy do t\u0159\u00ed hodin patn\u00e1cti sekund, v z\u00e1vislosti na testovan\u00fdch \u010dipech. \u00datok<\/a><\/noindex> na po\u0161kozen\u00ed ulo\u017een\u00e9ho otev\u0159en\u00e9ho kl\u00ed\u010de RSA-2048 trval od 74,6 sekundy do 39 minut 28 sekund. \u00datok<\/a><\/noindex> na obch\u00e1zen\u00ed ov\u011b\u0159en\u00ed opr\u00e1vn\u011bn\u00ed prost\u0159ednictv\u00edm modifikace pam\u011bti procesu sudo trval 54 minut 16 sekund.<\/p>\n

Pro kontrolu pam\u011bt\u00ed DDR4 pou\u017e\u00edvan\u00fdch u\u017eivateli byla publikov\u00e1na utilita TRRespass<\/a><\/noindex>. Pro \u00fasp\u011b\u0161nou realizaci \u00fatoku je pot\u0159eba informace o pou\u017eit\u00ed fyzick\u00fdch adres v \u0159adi\u010di pam\u011bti v\u00e1zan\u00e9 na banky a \u0159\u00e1dky pam\u011b\u0165ov\u00fdch bun\u011bk. Pro stanoven\u00ed rozlo\u017een\u00ed byla d\u00e1le vyvinuta utilita drama<\/a><\/noindex>, kter\u00e1 vy\u017eaduje spu\u0161t\u011bn\u00ed s pr\u00e1vy root. V nejbli\u017e\u0161\u00ed dob\u011b tak\u00e9 pl\u00e1nuje<\/a><\/noindex> publikovat aplikaci pro testov\u00e1n\u00ed pam\u011bti smartphones.<\/p>\n

Spole\u010dnosti Intel<\/a><\/noindex> a AMD<\/a><\/noindex> Byli doporu\u010deni pro ochranu pou\u017e\u00edvat pam\u011b\u0165 s korekc\u00ed chyb (ECC), pam\u011b\u0165ov\u00e9 \u0159adi\u010de se podporou Maximum Activate Count (MAC) a aplikovat zv\u00fd\u0161enou frekvenci regenerace. V\u011bdci v\u0161ak tvrd\u00ed, \u017ee pro ji\u017e vydan\u00e9 \u010dipy neexistuje \u0159e\u0161en\u00ed, kter\u00e9 by zaru\u010dilo ochranu proti Rowhammer, a pou\u017eit\u00ed ECC a zv\u00fd\u0161en\u00ed frekvence regenerace pam\u011bti se uk\u00e1zalo jako neefektivn\u00ed. Nap\u0159\u00edklad ji\u017e byl navr\u017een zp\u016fsob<\/a><\/noindex> \u00fatoku na DRAM pam\u011b\u0165 obch\u00e1zej\u00edc\u00ed ochranu ECC, a tak\u00e9 byla prok\u00e1z\u00e1na mo\u017enost prov\u00e9st \u00fatok na DRAM p\u0159es lok\u00e1ln\u00ed s\u00edt\u011b<\/a><\/noindex>, z hostitelsk\u00e9ho syst\u00e9mu<\/a><\/noindex> a pomoc\u00ed<\/a><\/noindex> spu\u0161t\u011bn\u00ed JavaScriptu v prohl\u00ed\u017ee\u010di.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pam\u011b\u0165ov\u00e9 \u010dipy DDR4 z\u016fst\u00e1vaj\u00ed zraniteln\u00e9 v\u016f\u010di \u00fatok\u016fm RowHammer, p\u0159esto\u017ee byla p\u0159id\u00e1na ochrana | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Amsterdamsk\u00e9 svobodn\u00e9 univerzity, \u0160v\u00fdcarsk\u00e9ho feder\u00e1ln\u00edho technologick\u00e9ho institutu v Curychu a spole\u010dnosti Qualcomm","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}