{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"DDR4 m\u00e4lupidavad j\u00e4\u00e4vad RowHammer r\u00fcnnakutele haavatavaks, vaatamata lisatud kaitsele.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Amsterdam Free University, ETH Zurich ja Qualcommi teadlaste grupp l\u00e4bi<\/a><\/noindex> uuringu efektiivsuse kohta, mida kasutatakse kaasaegsete DDR4 m\u00e4chipide kaitseks r\u00fcnnakute vastu RowHammer<\/a><\/noindex>, mis v\u00f5imaldavad muuta d\u00fcnaamilise juhusliku juurdep\u00e4\u00e4su m\u00e4lu (DRAM) \u00fcksikute bitide sisu. Tulemused olid kahjuks eba\u00f5nnestunud ja peamised DDR4 m\u00e4etootjate chipid on endiselt ole praegu<\/a><\/noindex> haavatavad (CVE-2020-10255<\/a><\/noindex>). <\/p>\n

RowHammer haavatavus v\u00f5imaldab muuta \u00fcksikute m\u00e4lubitide sisu, lugedes andmeid j\u00e4rjestikku naaberm\u00e4lu rakkudest. Kuna DRAM-m\u00e4lu koosneb kahe m\u00f5\u00f5tmelise rakkude massiivi, mis koosneb iga\u00fcks kondensaatorist ja transistorist, viib pidev sama m\u00e4lu piirkonna lugemine pingefluktatsioonide ja anomaaliate esinemiseni, mis p\u00f5hjustavad naaberrakkude v\u00e4ikese laengukaotuse. Kui lugemise intensiivsus on piisavalt suur, v\u00f5ib rakk kaotada piisavalt palju laengut, ja j\u00e4rgmine regenereerimise ts\u00fckkel ei suuda taastada selle algset seisundit, mis viib salvestatud andmete v\u00e4\u00e4rtuse muutumiseni. <\/p>\n

Moderne DDR4 kiipide puhul kasutatakse RowHammeri r\u00fcnnete t\u00f5kestamiseks TRR (Target Row Refresh) tehnoloogiat, mis on m\u00f5eldud m\u00e4lurakkude moonutamise ennetamiseks. Probleem seisneb selles, et TRR rakendamise osas pole \u00fchtegi \u00fchtset l\u00e4henemist ning iga CPU ja m\u00e4lu tootja t\u00f5lgendab TRR-d omamoodi, rakendades oma kaitsevariandid ja avalikustamata rakenduse \u00fcksikasju.
\nTootmisettev\u00f5tete rakendatud RowHammeri blokeerimise meetodite uurimine v\u00f5imaldas h\u00f5lpsasti leida viise kaitse \u00fcletamiseks. Kontrollimise k\u00e4igus selgus, et tootjate j\u00e4rgitud p\u00f5him\u00f5te «turvalisus l\u00e4bi ebaselguse<\/a><\/noindex> (security by obscurity) TRR rakendamisel aitab ainult erandlike olukordade kaitsmisel, mis katab t\u00fc\u00fcpilisi r\u00fcnnakuid, mis manipuleerivad kaheteise m\u00e4luraku laengute muutmisega. <\/p>\n

Teadlaste loodud utiliit v\u00f5imaldab kontrollida kiipide haavatavust mitmekesiste RowHammeri r\u00fcnnakute suhtes, kus laadimise m\u00f5ju \u00fcritatakse kohe mitmele m\u00e4luridadele. Sellised r\u00fcnnakud v\u00f5imaldavad m\u00f6\u00f6da minna m\u00f5nede tootjate rakendatud TRR-kaitset ja viivad m\u00e4lu bittide moonutamiseni isegi uutel DDR4 m\u00e4luseadmetel.
\nNeljak\u00fcmne kahest uuritud DIMM-moodulist 13 moodulit osutusid RowHammeri r\u00fcnnakute ebarahuldavate variantide suhtes haavatavaks, vaatamata deklareeritud kaitsele. Probleemsed moodulid on tootnud SK Hynix, Micron ja Samsung, kelle tooted katab<\/a><\/noindex> 95% DRAM turust.<\/p>\n

Peale DDR4 uuriti ka mobiilseadmetes kasutatavaid LPDDR4 kiipe, mis leidsid samuti tundlikkuse laiendatud RowHammeri r\u00fcnnakute suhtes. Eelk\u00f5ige osutus probleemseks m\u00e4lu, mida kasutatakse Google Pixel, Google Pixel 3, LG G7, OnePlus 7 ja Samsung Galaxy S10 nutitelefonides.<\/p>\n

Teadlased suutsid probleemsetes DDR4 kiipides paljusid ekspluatatsioonitehnikaid uuesti luua. N\u00e4iteks RowHammeri rakendamine-eksploid<\/a><\/noindex> PTE (Page Table Entries) jaoks oli tuumap\u00e4\u00e4su r\u00fcndamiseks vajalik aega 2.3 sekundist kuni kolme ja poole tunnini, olenevalt testitavatest kiipidest. R\u00fcnne<\/a><\/noindex> RSA-2048 avaliku v\u00f5tme m\u00e4lu kahjustamise r\u00fcnne kestis 74.6 sekundist kuni 39 minuti ja 28 sekundini. R\u00fcnne<\/a><\/noindex> sudo protsessi m\u00e4lumuudatustega \u00f5iguste kontrolli \u00fcmbersuunamise r\u00fcnne kestis 54 minutit ja 16 sekundit.<\/p>\n

DDR4 m\u00e4chipside kasutamise kontrollimiseks on avalikustatud utiliit TRRespass<\/a><\/noindex>. R\u00fcnnaku edukaks teostamiseks on vajalik teave f\u00fc\u00fcsiliste aadresside jaotuse kohta m\u00e4lukontrolleris, seostatuna m\u00e4lupankade ja ridadega. Jaotuse m\u00e4\u00e4ramiseks on t\u00e4iendavalt v\u00e4lja t\u00f6\u00f6tatud utiliit drama<\/a><\/noindex>, mis n\u00f5uab juur\u00f5igustega k\u00e4ivitamist. L\u00e4hip\u00e4evil avaldatakse ka rakendus nutitelefonide m\u00e4lu testimiseks. toetada<\/a><\/noindex> avalda nutitelefonide m\u00e4lutesti rakendust.<\/p>\n

Ettev\u00f5te Intel<\/a><\/noindex> ja AMD<\/a><\/noindex> soovitati kaitse tagamiseks kasutada vigade parandusega m\u00e4lu (ECC), m\u00e4lu kontrollerite maksimaalse aktiveerimise arvu (MAC) toetust ja rakendada suurenenud regeneratsioonifrekventsi. Uurijad usuvad, et juba v\u00e4lja antud kiipide puhul puudub lahendus Rowhammer'i garantii kaitsmiseks, ja ECC kasutamine ja m\u00e4lu regeneratsioonifrekventside suurendamine on osutunud ebaefektiivseks. N\u00e4iteks on varem juba pakutud meetodit<\/a><\/noindex> DRAM-m\u00e4lu r\u00fcnnaku jaoks ECC kaitse k\u00f5rvalehoidmiseks, samuti on n\u00e4idatud v\u00f5imalust r\u00fcnnata DRAM-i kohalikku v\u00f5rku<\/a><\/noindex>, l\u00e4bi k\u00fclaliss\u00fcsteemi<\/a><\/noindex> ja kasutades<\/a><\/noindex> JavaScripti k\u00e4ivitamise kaudu brauseris.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DDR4 m\u00e4luchipid j\u00e4\u00e4vad RowHammeri r\u00fcnnakute suhtes haavatavaks, hoolimata lisatud kaitsetest | ProHoster","description":"Amsterdam Free University, ETH Zurich ja Qualcommi teadlaste grupp","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}