{"id":114581,"date":"2024-03-26T12:25:42","date_gmt":"2024-03-26T10:25:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen"},"modified":"2024-03-26T12:25:42","modified_gmt":"2024-03-26T10:25:43","slug":"zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","title":{"rendered":"ZenHammer \u2014 an attack method for manipulating memory content on AMD Zen platforms","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from ETH Zurich have developed the ZenHammer attack method, which is a variant of RowHammer attacks aimed at modifying individual bits in dynamic RAM (DRAM), adapted for use on platforms with AMD processors. Previous RowHammer attack methods were limited to Intel-based systems, but the conducted research has shown that memory cell corruption can also be achieved on platforms with AMD memory controllers. <\/p>\n
The method has been demonstrated on AMD Zen 2 and Zen 3 systems with DDR4 memory from three leading manufacturers (Samsung, Micron, and SK Hynix). The attack successfully bypasses the TRR (Target Row Refresh) mechanism implemented in memory chips, aimed at protecting against corruption of memory cells in adjacent rows. According to researchers, AMD Zen 3-based systems are more vulnerable than Intel Coffee Lake processor systems, and they are easier and more effective to attack. On AMD Zen 2 systems, cell corruption was achieved for 7 out of the 10 tested DDR4 chips, while on Zen 3 systems, this was the case for 6 out of 10. Researchers also analyzed the possibility of attacking AMD Zen 4 systems with DDR5 memory, but the method developed for DDR4 was successfully reproduced on only 1 out of the 10 tested DDR5 memory chips, while the possibility of an attack is not ruled out, it requires the development of more effective reading patterns suitable for DDR5 devices. <\/p>\n
For working with AMD chips, previously developed exploits have been adapted that alter the contents of memory page table entries (PTE) to gain kernel privileges, bypassing password\/authority checks by modifying the memory of the sudo process and corrupting the stored RSA-2048 public key in OpenSSH to reconstruct the private key. The memory page attack was reproduced on 7 out of 10 tested DDR4 chips, the RSA key attack on 6 chips, and the sudo attack on 4 chips, with attack times of 164, 267, and 209 seconds, respectively.
![\"ZenHammer](\"\/wp-content\/uploads\/2024\/03\/9a5190bb9b60a4ec9e2562d32e4808b8.png\")
<\/center> <\/p>\n![\"ZenHammer](\"\/wp-content\/uploads\/2024\/03\/289e9e4dfa35a8143ae06a0643a689c5.png\")
<\/center> <\/p>\n