{"id":143523,"date":"2025-09-16T17:11:57","date_gmt":"2025-09-16T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati"},"modified":"2025-09-16T17:11:57","modified_gmt":"2025-09-16T15:11:59","slug":"phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","title":{"rendered":"Phoenix \u2014 r\u00fcnnak DDR5 kiipidele, mis toob kaasa m\u00e4lusisu moonutamise","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u0160veitsi k\u00f5rgtehnika kooli teadlased koos Google'i inseneridega on v\u00e4lja t\u00f6\u00f6tanud uue Rowhammer r\u00fcnnaku tehnika - Phoenix (CVE-2025-6202), mis v\u00f5imaldab k\u00f5rvalda DDR5-m\u00e4 chipides rakendatavad TRR (Target Row Refresh) kaitsemehhanismid, mis takistavad m\u00e4lu rakkude moonutamist laadimise kadumise t\u00f5ttu. Avalikustatud on eksploiti protot\u00fc\u00fcp, mis v\u00f5imaldab muuta teatud bitti sisu s\u00fcsteemis ning saavutada privileegide t\u00f5stmist. R\u00fcnnaku demonstreerimine viidi l\u00e4bi AMD protsessoriga PC-l, millel on Zen 4 mikroarhitektuur ja SK Hynix DDR5 m\u00e4lu, millel t\u00e4ideti aastate jooksul tavalisi t\u00f6\u00f6jaama \u00fclesandeid. <\/p>\n

RowHammeri r\u00fcnnak v\u00f5imaldab moonutada individuaalsete DRAM m\u00e4lubittide sisu, lugedes andmeid naaberrakkudest ts\u00fckliliselt. Kuna DRAM m\u00e4lu on kahe m\u00f5\u00f5tmega rakke sisaldav array, kus iga rakk koosneb kondensaatorist ja transistorki, toob sama ala pidev lugemine kaasa pingefluktuaatsioone ja anomaaliaid, mis p\u00f5hjustavad naaberrakkude v\u00e4ikese laengukaotuse. Kui lugemise intensiivsus on suur, v\u00f5ib naabruses olev rakk kaotada piisavalt suurt laenguhulka, mille t\u00f5ttu j\u00e4rgmine regeneratsioonits\u00fckkel ei suuda taastada selle algset olekut, mis toob kaasa andmete v\u00e4\u00e4rtuse muutumise rakus. <\/p>\n

Rowhammer r\u00fcnnaku meetod pakuti v\u00e4lja 2014. aastal, p\u00e4rast mida algas turvauuringute ja seadmete tootjate vahel m\u00e4ng nimega \"kass ja hiir\" - m\u00e4luchipide tootjad p\u00fc\u00fcdsid haavatavust blokeerida, samas kui teadlased leidsid uusi viise selle m\u00f6\u00f6da minekuks. N\u00e4iteks aga kaitse tagamiseks RowHammer r\u00fcnnakute eest, lisasid m\u00e4lu tootjad TRR (Target Row Refresh) mehhanismi, kuid selgus, et see kaitseb rakkude moonutamise eest vaid teatud juhtudel, aga ei paku kaitset k\u00f5igi v\u00f5imalike r\u00fcnnaku variantide eest. R\u00fcnnaku meetodeid on arendatud DDR3, DDR4 ja DDR5 chipide jaoks Intel, AMD ja ARM protsessoritega s\u00fcsteemides ning samuti videom\u00e4lu jaoks, mida kasutatakse NVIDIA graafikakaartides. Veel enam, leiti viise ECC veakorrektsiooni m\u00f6\u00f6da minemiseks ja pakkusid v\u00e4lja variante r\u00fcnnaku teostamiseks \u00fcle v\u00f5rgu ja JavaScript-koodi t\u00e4itmise kaudu brauseris. <\/p>\n

M\u00e4lu rakkude moonutamise kaitse \u00fcletamise peamine tegur DRAM-is on TRR mehhanismi t\u00f6\u00f6 loogika m\u00f5istmine, mis tugineb peamiselt rakenduse detailide peitmisele ja \"turvalisus ebamugavuse kaudu (security by obscurity)\" p\u00f5him\u00f5ttele. T\u00f6\u00f6loogika m\u00e4\u00e4ratlemiseks ja tagasip\u00f6\u00f6rdumise inseneri v\u00e4ljatoomiseks on teadlased loonud spetsiaalseid plaate FGPA Arty-A7 ja ZCU104 p\u00f5hjal, mis v\u00f5imaldavad testida DDR5 SO-DIMM ja RDIMM m\u00e4lu mooduleid, avastada m\u00e4lu rakkudesse p\u00f6\u00f6rdumise mustreid, m\u00e4\u00e4rata, millised madalamate taseme DDR-k\u00e4sud saadetakse p\u00e4rast m\u00e4lutegevusi ja anal\u00fc\u00fcsida nende reaktsiooni.

\"Phoenix<\/center> <\/p>\n

Selgus, et kaitse anal\u00fc\u00fcsitud DDR5 kiipides on rakendatud ilma t\u00e4iendavate juhtimise k\u00e4skudeta m\u00e4lusuhete v\u00e4rskendamise sageduse osas ning see toetub muutuva laadimise sagedusega rakkude re\u017eiimidele. Rowhammer r\u00fcnnaku eduka l\u00e4biviimise jaoks on sellistes tingimustes vajalik tuvastada t\u00e4pselt tuhandeid rakkude v\u00e4rskendamise operatsioone. Nendes tingimustes osutusid varem olemas olnud Rowhammer r\u00fcnnakumeetodid mitten\u00e4itlikuks ning teadlased t\u00f6\u00f6tasid v\u00e4lja uue meetodi, mis kontrollib juurdep\u00e4\u00e4suternatiive ise, tuvastades m\u00e4lusuhete v\u00e4rskendamise operatsioonide puudumised r\u00fcnnaku k\u00e4igus. <\/p>\n

Meetod osutus efektiivseks ning testide l\u00e4biviimise ajal suutis see saavutada kontrollitud m\u00e4lubiti moonutuse k\u00f5ikides 15 testitud SK Hynix DDR5 kiibes (mille turuosa on 36% DRAM), mis on toodetud 2021. aasta l\u00f5pust 2024. aasta l\u00f5puni. \u00dche bitti moonutamine osutus piisavaks, et luua eksploite, mis v\u00f5imaldab saada juurpermitsiooni s\u00fcsteemis r\u00fcnde k\u00e4igus AMD Ryzen 7 7700X CPU ja SK Hynix DDR5 m\u00e4lu kasutamisel 109 sekundi jooksul. Et kaitsta pakutud r\u00fcnnakumeetodi eest, soovitatakse m\u00e4lu v\u00e4rskendamise sagedust kolm korda suurendada. <\/p>\n

J\u00e4rgmised meetodid, mis v\u00f5imaldavad saavutada juurpermitsioonide saamise l\u00e4bi \u00fche bitti moonutuse, on uuritud: m\u00e4lulehe rekordite (PTE, page table entry) sisu muutmine, et saada kerneliprognoosi privileeg; salajase RSA-2048 v\u00f5tme kahjustamine OpenSSH-s (avatud v\u00f5ti saab viia kolmanda osapoole vastavusse r\u00fcndaja salajase v\u00f5tmega, et \u00fchendada ohvri VM-iga); autoriteedi \u00fclevaatamise v\u00e4ltimine protsessi sudo m\u00e4lus toimimise kaudu. PTE meetod osutus t\u00f6\u00f6tavaks k\u00f5ikides 15 testitud kiibes, RSA kaudu \u00f5nnestus r\u00fcnnak k\u00fcmnes kiibes, kuid sudo kaudu ainult viies. virtuaalses masinas<\/a> r\u00fcndava v\u00f5tme r\u00fcndaja jaoks, et \u00fchendada ohvri VM-iga); autoriseerimise kontrollimise \u00fcmbersuunamine sudo protsessi m\u00e4lu modifitseerimise kaudu. PTE meetod osutus toimivaks k\u00f5igi 15 testitud kiibi jaoks, r\u00fcnnak RSA kaudu \u00f5nnestus 11 kiibi puhul, ning sudo kaudu 5 kiibi puhul.

\"Phoenix<\/center> <\/p>\n

Eksploidis, mis h\u00f5lmab m\u00e4lulehek\u00fclgede tabelite paigutamist valitud DRAM-rakkudesse, kasutatakse Rubiconi tehnikat, mis ilmus samal ajal arutletava Phoenixi r\u00fcnnakuga. Rubicon manipuleerib Linuxi tuuma m\u00e4lu jaotuse optimeerimise erip\u00e4radega ja v\u00f5imaldab saavutada m\u00e4lu eraldamist piirkondades, kus on erinev 'migratetype' v\u00e4\u00e4rtus, mis on reserveeritud privileeritud toiminguteks. Probleemi on kinnitatud Linuxi tuumades alates 5.4 kuni 6.8, kuid teoreetiliselt katab haavatavus k\u00f5ik tuumad, kellel on Zoned Buddy Allocator m\u00e4lu eraldamise mehhanism. <\/p>\n

Lisaks Rowhammeri klassi r\u00fcnnakute lihtsustamisele on Rubiconi tehnika samuti rakendatav mikroarhitektuursete r\u00fcnnakute efektiivsuse suurendamiseks, nagu n\u00e4iteks Spectre, ja saladuste m\u00e4lu asukoha m\u00e4\u00e4ramise lihtsustamiseks, mida tuleb lekitamiste kaudu v\u00e4lja v\u00f5tta spekulatiivsete t\u00e4itmis\u00f5petuste k\u00e4igus. Rubicon v\u00f5imaldab v\u00e4ltida pikka m\u00e4lu skaneerimise ja failide m\u00e4\u00e4ramise etappi, nagu n\u00e4iteks \/etc\/shadow. Selle asemel on v\u00f5imalik kohe alustada mikroarhitektuursete haavatavuste \u00e4rakasutamist, t\u00e4nu eelnevalt m\u00e4\u00e4ratud faili paigutusele tuntud f\u00fc\u00fcsilisel aadressil. N\u00e4iteks Rubiconi meetodi rakendamine aitas andmeleket kiirendada s\u00fcsteemis CPU Intel i7-8700K 2698 sekundilt 9.5 sekundile (284 korda) ning CPU AMD EPYC 7252-l 189 sekundilt 27.9 sekundile (6.8 korda).

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Vahepeal on teise uurijate grupi George Masoni \u00fclikoolist n\u00e4idanud Rowhammeri klassi r\u00fcnnakute rakendatavust AI-s\u00fcsteemide kompromiteerimiseks. Uurijad on v\u00e4lja pakkunud OneFlip meetodi, mis v\u00f5imaldab sihtm\u00e4rklikult muuta AI mudelite k\u00e4itumist \u00fche biti teabe m\u00e4lu moonutamise kaudu. On olemas koodin\u00e4idis trooja muutumise sisestamiseks n\u00e4rviv\u00f5rku. N\u00e4idatakse, kuidas \u00fche biti muutmine v\u00f5ib m\u00f5jutada autopiloodi mudeli t\u00f6\u00f6d, muutes 'Stop' liiklusm\u00e4rgiks 'Kiiruspiirang'. Samuti on arutatud meetodi kasutamise v\u00f5imalust n\u00e4otuvastuss\u00fcsteemide \u00fcmbersuunamiseks. Mudelitel, mis salvestavad kaalud 32-bitise terviknumbrina, on r\u00fcnnaku edukus hinnatud 99,9% ulatuses ilma mudeli algsete omaduste kahjustamiseta.

\"Phoenix<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 Rowhammer — Phoenix (CVE-2025-6202), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0447\u0438\u043f\u0430\u0445 DDR5 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b TRR (Target Row Refresh), \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044e\u0449\u0438\u0439 \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u0435 \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u0437-\u0437\u0430 \u043f\u043e\u0442\u0435\u0440\u0438 \u0437\u0430\u0440\u044f\u0434\u0430. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0431\u0438\u0442\u0430 \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":143524,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-143523","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Phoenix \u2014 r\u00fcnnak DDR5 kiipidele, mis p\u00f5hjustab m\u00e4lu sisu moonutamist | ProHoster","description":"\u0160veitsi tehnika k\u00f5rgkooli teadlased koos Google'i inseneridega on v\u00e4lja t\u00f6\u00f6tanud uue Rowhammeri r\u00fcnnaku tehnika - Phoenix (CVE-2025-6202), mis v\u00f5imaldab m\u00f6\u00f6da minna rakendatust.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Phoenix \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0447\u0438\u043f\u044b DDR5, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 Rowhammer - Phoenix (CVE-2025-6202), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-16T15:11:59+00:00","article:modified_time":"2025-09-16T15:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"143523","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:49:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:49:19","updated":"2026-01-23 14:49:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/143523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=143523"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/143523\/revisions"}],"predecessor-version":[{"id":164232,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/143523\/revisions\/164232"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/143524"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=143523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=143523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=143523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}