{"id":114581,"date":"2024-03-26T12:25:42","date_gmt":"2024-03-26T10:25:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen"},"modified":"2024-03-26T12:25:42","modified_gmt":"2024-03-26T10:25:43","slug":"zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","title":{"rendered":"ZenHammer \u2014 en angrebsmetode til at forvr\u00e6nge indholdet i hukommelsen p\u00e5 AMD Zen-platforme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra Z\u00fcrichs tekniske universitet har udviklet en ZenHammer-angrebsmetode, som er en variant af RowHammer-angreb til at \u00e6ndre indholdet af enkelt bits i dynamisk random access memory (DRAM), tilpasset brug p\u00e5 platforme med AMD-processorer. Tidligere RowHammer-angrebsmetoder var begr\u00e6nset til systemer baseret p\u00e5 Intel-processorer, men den udf\u00f8rte forskning har vist, at forvridning af hukommelsesceller ogs\u00e5 kan opn\u00e5s p\u00e5 platforme med AMDs hukommelseskontrollere. <\/p>\n

Metodens funktion er demonstreret p\u00e5 AMD Zen 2- og Zen 3-systemer med DDR4-hukommelse fra tre f\u00f8rende producenter (Samsung, Micron og SK Hynix). Angrebet giver effektivt mulighed for at omg\u00e5 den implementerede TRR (Target Row Refresh) -mekanisme i hukommelseschipsene, der er designet til at beskytte mod forvridning af hukommelsesceller i n\u00e6rliggende r\u00e6kker. Forskere vurderer, at systemer baseret p\u00e5 AMD Zen 3 er mere s\u00e5rbare end systemer med Intel Coffee Lake-processorer, og de er lettere og mere effektive at angrebe. P\u00e5 AMD Zen 2-systemer lykkedes det at for\u00e5rsage forvridning af hukommelsesceller i 7 ud af 10 testede DDR4-chips, mens det i Zen 3-systemer var i 6 ud af 10. Forskere har ogs\u00e5 analyseret muligheden for at udf\u00f8re angreb p\u00e5 AMD Zen 4-systemer med DDR5-hukommelse, men den metode, der er udviklet til DDR4, blev kun med succes reproduceret p\u00e5 1 ud af 10 testede DDR5-hukommelseschips, dog udelukkes muligheden for angreb ikke, men det kr\u00e6ver udvikling af mere effektive l\u00e6sem\u00f8nstre, der er velegnede til DDR5-enheder. <\/p>\n

For working with AMD chips, it was possible to adapt previously developed exploits that modify the contents of entries in the memory page table (PTE) to gain kernel privileges, bypassing password\/authorization checks through process memory modification of sudo and corrupting the stored RSA-2048 public key in OpenSSH to recreate the private key. The attack on memory pages was successfully reproduced on 7 out of 10 tested DDR4 chips, the attack on the RSA key on 6 chips, and the attack on sudo on 4 chips, with attack times of 164, 267, and 209 seconds, respectively.

\"ZenHammer<\/center> <\/p>\n

Metoden kan ogs\u00e5 anvendes til at angrebe systemet via browsere for at foretage \u00e6ndringer fra virtual machines<\/a> or to organize a network attack. The source code of the DARE toolkit for reverse engineering address layouts in DRAM memory, as well as two sets of utilities for fuzzing testing bit distortions in memory \u2014 ddr4_zen2_zen3_pub for DDR4 chips (Zen 2 and Zen 3) and ddr5_zen4_pub for DDR5 chips (Zen 4) \u2014 has been published on GitHub under the MIT license, which can be used to check your systems for vulnerability to the attack.

\"ZenHammer<\/center> <\/p>\n

Til at forvr\u00e6nge bits anvendes metoden RowHammer, som er baseret p\u00e5, at DRAM-hukommelse, der best\u00e5r af et todimensionalt array af celler best\u00e5ende af en kondensator og en transistor, ved kontinuerlig l\u00e6sning af det samme hukommelsesomr\u00e5de f\u00f8rer til sp\u00e6ndingsfluktuationer og anomalier, der for\u00e5rsager et lille tab af ladning i naboceller. Hvis l\u00e6seintensiteten er h\u00f8j, kan en nabocelle miste s\u00e5 meget ladning, at den f\u00f8lgende regenereringscyklus ikke har tid til at genskabe dens oprindelige tilstand, hvilket vil medf\u00f8re \u00e6ndring af de gemte data i cellen. Forskeren har identificeret s\u00e6rlige aspekter af de mappingsmekanismer, der anvendes i AMD-processorer, og synkroniseringen med hukommelsesopdatering, hvilket har gjort det muligt at genskabe low-level adressering af DRAM, identificere adresser for naboceller, udvikle metoder til at omg\u00e5 caching, beregne m\u00f8nstrene og frekvensen af operationer, der f\u00f8rer til tab af ladning. <\/p>\n

For at beskytte mod RowHammer anvender chipproducenterne TRR-mekanismen (Target Row Refresh), som blokerer forvr\u00e6ngning af celler i s\u00e6rlige tilf\u00e6lde, men ikke beskytter mod alle mulige angreb. Den mest effektive beskyttelsesmetode forbliver brugen af hukommelse med fejlkorrektionskoder (ECC), som v\u00e6sentligt komplicerer, men ikke fuldst\u00e6ndigt udelukker gennemf\u00f8relsen af RowHammer-kategoriske angreb. At \u00f8ge frekvensen af hukommelsesregenerering kan ogs\u00e5 reducere risikoen for et succesfuldt angreb. <\/p>\n

AMD has published a report on the issue stating that AMD processors use memory controllers that comply with DDR specifications, and since the success of the attack largely depends on system settings and DRAM memory, inquiries regarding the resolution of the problem should be directed to memory and system manufacturers. Among the existing methods to complicate the execution of Rowhammer-class attacks, the use of ECC memory, increasing the refresh rate of memory, disabling the deferred refresh mode, and using processors with controllers that support the MAC (Maximum Activate Count) mode for DDR4 (1st, 2nd, and 3rd generation AMD EPYC \"Naples\", \"Rome\", and \"Milan\") and RFM (Refresh Management) for DDR5 (4th generation AMD EPYC) are mentioned.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM), \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD. \u041f\u0440\u043e\u0448\u043b\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114582,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ZenHammer \u2014 angrebsmetode til forvr\u00e6ngning af hukommelsesindhold p\u00e5 AMD Zen-platforme | ProHoster","description":"Forskere fra ETH Z\u00fcrich har udviklet en angrebsmetode kaldet ZenHammer, som er en variant af RowHammer-angreb, der \u00e6ndrer indholdet af individuelle bits i dynamisk RAM.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ZenHammer \u2014 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 AMD Zen | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-26T10:25:43+00:00","article:modified_time":"2024-03-26T10:25:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114581","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:05","updated":"2026-02-09 17:11:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=114581"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114581\/revisions"}],"predecessor-version":[{"id":159263,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114581\/revisions\/159263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/114582"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=114581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=114581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=114581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}