{"id":114581,"date":"2024-03-26T12:25:42","date_gmt":"2024-03-26T10:25:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen"},"modified":"2024-03-26T12:25:42","modified_gmt":"2024-03-26T10:25:43","slug":"zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","title":{"rendered":"ZenHammer \u2014 r\u00fcnnakutehnika, mis muudab AMD Zen platvormide m\u00e4lu sisu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u0160veitsi f\u00f6deraalne tehnolooga\u00fclikool Z\u00fcrichist on v\u00e4lja t\u00f6\u00f6tanud ZenHammeri r\u00fcnnaku meetodi, mis on RowHammeri r\u00fcnnakute klassi variatsioon d\u00fcnaamilise juhtm\u00e4luga (DRAM) bitiv\u00e4\u00e4rtuste muutmiseks, kohandatud AMD protsessoritega platvormidele. Varasemad RowHammeri r\u00fcnnakumeetodid piirdusid Intel protsessoritega s\u00fcsteemidega, kuid uuringud on n\u00e4idanud, et m\u00e4lu rakkude moonutusi saab saavutada ka AMD m\u00e4lukontrolleritega platvormidel. <\/p>\n

Meetodi t\u00f6\u00f6 on demonstreeritud AMD Zen 2 ja Zen 3 s\u00fcsteemides, kus kasutatakse DDR4 m\u00e4lu kolme juhtiva tootja (Samsung, Micron ja SK Hynix) tooteid. R\u00fcnnak v\u00f5imaldab edukalt \u00fcletada m\u00e4lakiipides rakendatud TRR (Target Row Refresh) mehhanismi, mis on suunatud naaberridade m\u00e4lu rakkude v\u00e4\u00e4rkasutuse kaitsmiseks. Uurijate hinnangul on AMD Zen 3 baasil t\u00f6\u00f6tavad s\u00fcsteemid rohkem haavatavad kui Intel Coffee Lake protsessoritega s\u00fcsteemid, ning neid on lihtsam ja efektiivsem r\u00fcnnata. AMD Zen 2 s\u00fcsteemides \u00f5nnestus m\u00e4lurakkude v\u00e4\u00e4rkasutust saavutada 7-l 10 testitud DDR4 kiibil, Zen 3 s\u00fcsteemides aga 6-l 10-st. Uurijad anal\u00fc\u00fcsisid ka r\u00fcnnaku v\u00f5imalust AMD Zen 4 s\u00fcsteemidele, kus kasutatakse DDR5 m\u00e4lu, kuid DDR4 jaoks v\u00e4lja t\u00f6\u00f6tatud r\u00fcndemeetod \u00f5nnestus edukalt reprodutseerida vaid 1-l 10 testitud DDR5 m\u00e4lu kiibil; see ei v\u00e4listanud r\u00fcnnaku v\u00f5imalust, kuid n\u00f5udis t\u00f5husamate lugemisviiside v\u00e4ljat\u00f6\u00f6tamist, mis sobiksid DDR5 seadmetele. <\/p>\n

AMD kiipidega t\u00f6\u00f6tamiseks \u00f5nnestus kohandada varasemalt v\u00e4lja t\u00f6\u00f6tatud eksploidid, mis muutvad m\u00e4lutabeli sisu (PTE, page table entry) tuumap\u00e4\u00e4su \u00f5iguste saamiseks, vahelesegades sudo protsessi m\u00e4lu kontrolli ja kahjustades m\u00e4lus hoitud RSA-2048 avalikku v\u00f5tit OpenSSH-s, et rekonstrueerida erasev\u00f5ti. M\u00e4lu lehtede r\u00fcnnak \u00f5nnestus korduda 7-l 10 testitud DDR4 kiibil, RSA v\u00f5ti r\u00fcnnak 6-l kiibil, ja sudo r\u00fcnnak 4-l kiibil, r\u00fcnnaku aeg oli vastavalt 164, 267 ja 209 sekundit.

\"ZenHammer<\/center> <\/p>\n

Meetod v\u00f5ib samuti olla rakendatav r\u00fcnnaku korraldamiseks s\u00fcsteemi kaudu brauserid, et muudatusi sisse viia virtuaalmasinad<\/a> v\u00f5i v\u00f5rgu r\u00fcnnaku korraldamiseks. GitHubis on MIT litsentsi alusel avaldatud DARE t\u00f6\u00f6riistade l\u00e4htekood m\u00e4luaadresside tagasip\u00f6\u00f6ramise jaoks DRAM-is, samuti kaks komplekti utiliite bitide fuzzing-testi l\u00e4biviimiseks - ddr4_zen2_zen3_pub DDR4 kiipide (Zen 2 ja Zen 3) jaoks ja ddr5_zen4_pub DDR5 kiipide (Zen 4) jaoks, milliseid saab kasutada oma s\u00fcsteemide kontrollimiseks r\u00fcnnaku vastuv\u00f5tlikkuse osas.

\"ZenHammer<\/center> <\/p>\n

Bittide moonutamiseks kasutatakse RowHammer'i meetodit, mis p\u00f5hineb DRAM m\u00e4lu omadustel, mis on kahe m\u00f5\u00f5tmega ruum, koosnedes kondensaatoritest ja transistoritest. Kui sama m\u00e4lu piirkonda j\u00e4rjestikku lugeda, p\u00f5hjustab see pingefluktuatsioone ja anomaaliaid, mis v\u00f5ivad p\u00f5hjustada naaberrakkude v\u00e4ikeseid laadimiskaotusi. Suure lugemissageduse korral v\u00f5ib naaberrakk kaotada piisavalt suures mahus laadimist, et j\u00e4rgmine regeneratsioonits\u00fckkel ei suuda taastada selle algset seisundit, mille tulemusena muutuvad rakkude andmed. Uurija tuvastas AMD protsessorites kasutatud f\u00fc\u00fcsilise m\u00e4lu kaardistamise ja m\u00e4lu uuendamise s\u00fcnkroniseerimise erip\u00e4rad, mis v\u00f5imaldasid luua DRAM-i madalama taseme aadressimist, m\u00e4\u00e4rata naaberrakkude aadressid, v\u00e4lja t\u00f6\u00f6tada vahem\u00e4lu \u00fcmbersuunamise meetodid ning arvutada mustrid ja operatsioonide sageduse, mis viivad laadimise kadumiseni. <\/p>\n

RowHammeri kaitsmiseks kasutavad kiibitootjad TRR-mehhanismi (Target Row Refresh), mis blokeerib rakkude moonutamise teatud juhtudel, kuid ei kaitse k\u00f5igi v\u00f5imalike r\u00fcnnakute eest. K\u00f5ige t\u00f5husam kaitsemeetod j\u00e4\u00e4b endiselt vigade paranduse m\u00e4lu (ECC) kasutamiseks, mis keerukustab r\u00fcnnakute l\u00e4biviimist, kuid ei v\u00e4lista neid t\u00e4ielikult. Eduka r\u00fcnnaku t\u00f5en\u00e4osust v\u00e4hendab ka m\u00e4lu regeneratsiooni sageduse suurendamine. <\/p>\n

AMD on avaldanud aruande probleemist, milles \u00f6eldakse, et AMD protsessorites kasutatakse DDR spetsifikatsioonidele vastavaid m\u00e4lukontrollereid. Kuna r\u00fcnnaku \u00f5nnestumine s\u00f5ltub peamiselt s\u00fcsteemi seadistustest ja DRAM-m\u00e4lust, tuleks probleemide lahendamise k\u00fcsimustes p\u00f6\u00f6rduda m\u00e4letootjate ja s\u00fcsteemide poole. R\u00fcnnakute sooritamise raskuse suurendamiseks on olemas mitmeid meetodeid, sealhulgas ECC-m\u00e4lu kasutamine, m\u00e4luregeneratsiooni sageduse suurendamine, viivitamise re\u017eiimi v\u00e4ljal\u00fclitamine ja protsessorite kasutamine, mille kontrollerid toetavad MAC (Maximum Activate Count) re\u017eiimi DDR4 jaoks (AMD EPYC 1., 2. ja 3. p\u00f5lvkond \u00abNaple\u00bb, \u00abRome\u00bb ja \u00abMilan\u00bb) ning RFM (Refresh Management) DDR5 jaoks (AMD EPYC 4. p\u00f5lvkond).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM), \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD. \u041f\u0440\u043e\u0448\u043b\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114582,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ZenHammer \u2014 m\u00e4lu sisu moonutamise r\u00fcnnaku meetod AMD Zen platvormidel | ProHoster","description":"\u0160veitsi federatsiooni tehnika\u00fclikooli teadlased on v\u00e4lja t\u00f6\u00f6tanud ZenHammeri r\u00fcnnaku meetodi, mis on RowHammeri r\u00fcnnakute variatsioon, et muuta d\u00fcnaamilise juhusliku m\u00e4luse (DRAM) \u00fcksikute bittide sisu, kohandatud kasutamiseks AMD protsessoritega platvormidel. Eelmised RowHammeri r\u00fcnnakumeetodid piirdusid Intel'i protsessoritega s\u00fcsteemidega, kuid tehtud uuringud on n\u00e4idanud, et m\u00e4lu rakkude moonutusi saab samuti","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ZenHammer \u2014 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 AMD Zen | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM), \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD. \u041f\u0440\u043e\u0448\u043b\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-26T10:25:43+00:00","article:modified_time":"2024-03-26T10:25:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114581","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:05","updated":"2026-02-09 17:11:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114581"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114581\/revisions"}],"predecessor-version":[{"id":159263,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114581\/revisions\/159263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/114582"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}