{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"DDR4 m\u00e4chipsid j\u00e4\u00e4vad RowHammer r\u00fcnnakute suhtes haavatavaks, vaatamata lisatud kaitsele","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Amsterdamis vabade \u00fclikooli, Z\u00fcrichi tehnika\u00fclikooli ja Qualcommi teadlaste r\u00fchm l\u00e4bi<\/a><\/noindex> uurimus DDR4 m\u00e4lukiipide kaitse t\u00f5hususest r\u00fcnnakute vastu RowHammer<\/a><\/noindex>, mis v\u00f5imaldavad muuta d\u00fcnaamilise RAM-i (DRAM) \u00fcksikute bittide sisu. Tulemused olid pettumustvalmistavad ja peamised DDR4 tootjad on endiselt p\u00fcsivad<\/a><\/noindex> haavatavad (CVE-2020-10255<\/a><\/noindex>). <\/p>\n

RowHammeri haavatavus v\u00f5imaldab muuta m\u00e4lu \u00fcksikute bittide sisu naaberm\u00e4lu lahtrite andmetest ts\u00fcklilise lugemise kaudu. Kuna DRAM m\u00e4lu koosneb kahest m\u00f5\u00f5tmetest lahtrite massiivist, millest iga\u00fcks koosneb kondensaatorist ja transistorist, p\u00f5hjustab sama m\u00e4lu ala pidev lugemine pingefluktsuaatsioone ja anomaaliaid, mis p\u00f5hjustavad k\u00f5rvaliste lahtrite laengu v\u00e4ikest kadu. Kui lugemise intensiivsus on piisavalt suur, v\u00f5ib lahter kaotada piisavalt suures koguses laengu ja j\u00e4rgmine regeneratsioonits\u00fckkel ei suuda taastada selle algset olekut, mis toob kaasa salvestatud andmete v\u00e4\u00e4rtuste muutumise. <\/p>\n

Sellise m\u00f5ju blokeerimiseks rakendatakse kaasaegsetes DDR4 kiipides TRR (Target Row Refresh) tehnoloogiat, mis on m\u00f5eldud RowHammer r\u00fcnnakute ajal lahtrite moonutuste v\u00e4ltimiseks. Probleem on aga see, et puudub \u00fchtne l\u00e4henemine TRR rakendamisele ja iga CPU ja m\u00e4lu tootja t\u00f5lgendab TRR-d omamoodi, rakendades oma kaitsevariandid ja mitte avaldades rakenduse \u00fcksikasju.
\nTootjate rakendatud RowHammer blokeerimismeetodite uurimine aitas kergesti leida viise kaitse \u00fcletamiseks. Kontrollimise k\u00e4igus selgus, et tootjate praktiseeritud p\u00f5him\u00f5te «turvalisus l\u00e4bi h\u00e4gususe<\/a><\/noindex> (security by obscurity) TRR rakendamisel kaitseb vaid spetsiifilisi juhtumeid, mis h\u00f5lmavad t\u00fc\u00fcpilisi r\u00fcnnakuid, mis manipuleerivad laengute muutumisega \u00fches v\u00f5i kahes naaberreal. <\/p>\n

Teadlaste v\u00e4lja t\u00f6\u00f6tatud utiliit v\u00f5imaldab kontrollida kiipide vastuv\u00f5tlikkust RowHammeri r\u00fcnnakute mitmesuunalistele variantidele, kus katse m\u00f5jutada laengut toimub kohe mitme m\u00e4luridade puhul. Sellised r\u00fcnnakud v\u00f5imaldavad m\u00f6\u00f6da minna m\u00f5nedes tootjates rakendatud kaitset TRR ja viivad m\u00e4lubittide moonutamiseni isegi uutel seadmetel, millel on DDR4 m\u00e4lu.
\n42 uuritud DIMM-modulist olid 13 moodulit haavatavad mittestandardsete RowHammeri r\u00fcnnakute variantide suhtes, vaatamata v\u00e4idetavale kaitsele. Probleemsed moodulid on toodetud SK Hynix, Micron ja Samsungi, kelle tooted katavad<\/a><\/noindex> 95% DRAM turust.<\/p>\n

Lisaks DDR4-le uuriti ka mobiilseadmetes kasutatavaid LPDDR4 kiipe, mis osutusid samuti vastuv\u00f5tlikeks RowHammeri r\u00fcnnakute laiendatud variantidele. Eelk\u00f5ige oli probleemne m\u00e4lu, mida kasutatakse Google Pixel, Google Pixel 3, LG G7, OnePlus 7 ja Samsung Galaxy S10 nutitelefonides.<\/p>\n

Uurijad suutsid probleemsetes DDR4 kiipides mitmeid ekspluateerimistehnikate paljundada. N\u00e4iteks, RowHammer-eksploid<\/a><\/noindex> PTE (Page Table Entries) jaoks n\u00f5udis tuuma \u00f5iguse saamine r\u00fcnnaku l\u00e4biviimist vahemikus 2.3 sekundist kuni kolme tunni ja viieteistk\u00fcmne sekundi jooksul, olenevalt testitavatest kiipidest. R\u00fcnnak<\/a><\/noindex> m\u00e4lus olevate RSA-2048 avaklahvi kahjustamise t\u00f5ttu kestis 74.6 sekundist kuni 39 minuti ja 28 sekundi. R\u00fcnnak<\/a><\/noindex> volituste kontrolli \u00fcmbersuunamine sudo protsessi m\u00e4lu modifitseerimise kaudu kestis 54 minuti ja 16 sekundi.<\/p>\n

Kasutajate poolt kasutatavate DDR4 m\u00e4kiipide kontrollimiseks on avalikustatud utiliit TRRespass<\/a><\/noindex>. R\u00fcnnaku edukaks l\u00e4biviimiseks on vajalik teave, kuidas on m\u00e4lu kontrolleris f\u00fc\u00fcsiliste aadresside jaotumine panganduse ja m\u00e4luridade suhtes. Jaotuse m\u00e4\u00e4ramiseks on t\u00e4iendavalt v\u00e4lja t\u00f6\u00f6tatud utiliit drama<\/a><\/noindex>, mis n\u00f5uab k\u00e4ivitamist root \u00f5igustes. Peagi avaldatakse ka rakendus nutitelefonide m\u00e4lutestimiseks. planeeritud<\/a><\/noindex> Ettev\u00f5tted<\/p>\n

Ettev\u00f5ttele Intel<\/a><\/noindex> ja AMD<\/a><\/noindex> soovitati kaitseks kasutada ECC m\u00e4luseid, m\u00e4lju \u00fcle v\u00e4hendatud maksimumarvu (MAC) toetavatega ja rakendada suurendatud regeneratsiooni sagedust. Uurijad aga arvavad, et juba v\u00e4ljastatud kiipide puhul puudub lahendus garanteeritud kaitseks Rowhammeri vastu ning ECC rakendamine ja m\u00e4lu regeneratsiooni sageduse suurendamine osutusid ebaefektiivseteks. N\u00e4iteks on varem juba pakutud meetod<\/a><\/noindex> DRAM-m\u00e4lu r\u00fcnnakute jaoks, mis m\u00f6\u00f6dub ECC kaitse, ning on n\u00e4idatud r\u00fcnnaku v\u00f5imalust DRAM-i kaudu kohalikku v\u00f5rku<\/a><\/noindex>, s\u00fcsteemi k\u00fclalisest s\u00fcsteemist<\/a><\/noindex> ja kohtudes<\/a><\/noindex> JavaScripti k\u00e4ivitamise kaudu brauseris.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DDR4 m\u00e4lukiibid on endiselt RowHammeri r\u00fcnnakute suhtes haavatavad, ehkki kaitse on lisatud | ProHoster","description":"Amsterdamis vabade \u00fclikooli, Z\u00fcrichi tehnika\u00fclikooli ja Qualcommi teadlaste r\u00fchm","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}