{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"DDR4 hukommelseschips forbliver s\u00e5rbare over for RowHammer angreb, p\u00e5 trods af den tilf\u00f8jede beskyttelse.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra det frie universitet i Amsterdam, det schweiziske f\u00f8derale institut for teknologi i Z\u00fcrich og Qualcomm et<\/a><\/noindex> unders\u00f8ger effektiviteten af beskyttelsen mod angreb af typen, der anvendes i moderne DDR4 hukommelseschips RowHammer<\/a><\/noindex>, som muligg\u00f8r \u00e6ndring af indholdet af individuelle bits i dynamisk RAM (DRAM). Resultaterne var ikke opmuntrende, og DDR4-chips fra de st\u00f8rste producenter forbliver kritiske fejl, der blokkerer udgivelsen (for 10 dage siden var der 146, for halvanden m\u00e5ned siden - 316, for to m\u00e5neder siden - 577, p\u00e5 tidspunktet for frysepunktet i Debian 9 - 275, i Debian 8 - 350, Debian 7 - 650). Den endelige udgivelse af Debian 10 forventes om sommeren.<\/a><\/noindex> s\u00e5rbare (CVE-2020-10255<\/a><\/noindex>). <\/p>\n

RowHammer s\u00e5rbarheden tillader forvr\u00e6ngning af indholdet af individuelle hukommelsesskaber ved cyklisk at l\u00e6se data fra naboceller. Da DRAM-hukommelse best\u00e5r af et todimensionelt array af celler, hver best\u00e5ende af en kondensator og en transistor, f\u00f8rer kontinuerlig l\u00e6sning af det samme hukommelsesomr\u00e5de til sp\u00e6ndingsfluktuationer og anomalier, som for\u00e5rsager en lille ladetab i de n\u00e6rliggende celler. Hvis l\u00e6seintensiteten er tilstr\u00e6kkelig h\u00f8j, kan en celle miste en betydelig m\u00e6ngde ladning, og den efterf\u00f8lgende regenereringscyklus vil ikke v\u00e6re i stand til at gendanne dens oprindelige tilstand, hvilket f\u00f8rer til en \u00e6ndring af de lagrede data i cellen. <\/p>\n

For at blokere denne effekt anvender moderne DDR4-chips TRR-teknologi (Target Row Refresh), som er designet til at forhindre forvr\u00e6ngning af celler under en RowHammer-angreb. Problemet er, at der ikke er en ensartet tilgang til implementeringen af TRR, og hver producent af CPU'er og hukommelse fortolker TRR p\u00e5 sin egen m\u00e5de, anvender egne beskyttelsesmetoder og afsl\u00f8rer ikke detaljer om implementeringen.
\nUnders\u00f8gelsen af de metoder, som producenter anvender til at blokere RowHammer, har gjort det let at finde omg\u00e5rdninger af beskyttelsen. Ved kontrol viste det sig, at den princip, der anvendes af producenterne, «sikkerhed gennem uklarhed<\/a><\/noindex> (security by obscurity) ved implementeringen af TRR kun hj\u00e6lper til at beskytte i s\u00e6rlige tilf\u00e6lde, der d\u00e6kker typiske angreb, der manipulerer \u00e6ndringen af ladningen i en eller to n\u00e6rliggende r\u00e6kker. <\/p>\n

Et v\u00e6rkt\u00f8j udviklet af forskere g\u00f8r det muligt at teste chips for s\u00e5rbarhed over for multikantede RowHammer-angreb, hvor fors\u00f8get p\u00e5 at p\u00e5virke ladningen sker for flere r\u00e6kker hukommelsesceller p\u00e5 \u00e9n gang. S\u00e5danne angreb kan omg\u00e5 den beskyttelse mod TRR, som nogle producenter har implementeret, og f\u00f8rer til forvr\u00e6ngning af hukommelsesbits, selv p\u00e5 nyt udstyr med DDR4-hukommelse.
\nUd af 42 unders\u00f8gte DIMM-moduler viste 13 moduler sig at v\u00e6re s\u00e5rbare over for ikke-standardiserede RowHammer-angreb, p\u00e5 trods af den angivne beskyttelse. De problematiske moduler er produceret af SK Hynix, Micron og Samsung, hvis produkter d\u00e6kker<\/a><\/noindex> 95% af DRAM-markedet.<\/p>\n

Ud over DDR4 blev der ogs\u00e5 unders\u00f8gt chips LPDDR4, der anvendes i mobile enheder, som ogs\u00e5 viste sig at v\u00e6re f\u00f8lsomme over for udvidede RowHammer-angreb. Is\u00e6r var hukommelsen, der anvendes i Google Pixel-smartphones, Google Pixel 3, LG G7, OnePlus 7 og Samsung Galaxy S10, udsat for problemet.<\/p>\n

Forskere var i stand til at reproducere flere udnyttelsesteknikker p\u00e5 de problematiske DDR4-chips. For eksempel kr\u00e6vede brugen af RowHammer-af exploit-en<\/a><\/noindex> til PTE (Page Table Entries) at udf\u00f8re angrebet i en periode p\u00e5 mellem 2,3 sekunder og tre timer og femten sekunder, afh\u00e6ngigt af de testede chips. Angreb<\/a><\/noindex> at beskadige den RSA-2048 offentlige n\u00f8gle lagret i hukommelsen tog mellem 74,6 sekunder og 39 minutter og 28 sekunder. Angreb<\/a><\/noindex> til at omg\u00e5 godkendelseskontrol ved at modificere sudo-processens hukommelse tog 54 minutter og 16 sekunder.<\/p>\n

For at teste de anvendte DDR4-hukommelseschips er v\u00e6rkt\u00f8jet TRRespass<\/a><\/noindex>. For at gennemf\u00f8re et angreb med succes kr\u00e6ves oplysninger om den fysisk adressefordeling, der anvendes i hukommelseskontrolleren, i relation til bankerne og r\u00e6kkerne af hukommelsesceller. For at bestemme fordelingen er der desuden udviklet et v\u00e6rkt\u00f8j drama<\/a><\/noindex>, som kr\u00e6ver k\u00f8rsel med root-rettigheder. Snart vil der ogs\u00e5 er planlagt<\/a><\/noindex> blive offentliggjort en applikation til test af smartphone-hukommelse.<\/p>\n

Virksomheden Intel<\/a><\/noindex> og AMD<\/a><\/noindex> blev anbefalet at bruge h\u00f8jfejlsikker hukommelse (ECC), hukommelseskontrollere, der underst\u00f8tter Maximum Activate Count (MAC), og anvende h\u00f8jere regenereringshastigheder for at beskytte sig. Forskere mener dog, at der ikke er nogen garanti for beskyttelse mod Rowhammer for allerede producerede chips, og at anvendelsen af ECC og \u00f8gning af hukommelsens regenereringshastighed har vist sig ineffektivt. Tidligere er der eksempelvis blevet foresl\u00e5et metode<\/a><\/noindex> angreb p\u00e5 DRAM-hukommelse forbi ECC-beskyttelse, samt muligheden for at udf\u00f8re et angreb p\u00e5 DRAM gennem det lokale netv\u00e6rk<\/a><\/noindex>, fra g\u00e6stesystemet<\/a><\/noindex> og ved hj\u00e6lp af<\/a><\/noindex> k\u00f8rsel af JavaScript i browseren.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DDR4-hukommelseschips forbliver s\u00e5rbare over for RowHammer-angreb, p\u00e5 trods af den tilf\u00f8jede beskyttelse | ProHoster","description":"En gruppe forskere fra det frie universitet i Amsterdam, det schweiziske f\u00f8derale institut for teknologi i Z\u00fcrich og Qualcomm","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}