{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"A DDR4 mem\u00f3riachipek tov\u00e1bbra is sebezhet\u0151ek a RowHammer t\u00e1mad\u00e1sokkal szemben, annak ellen\u00e9re, hogy v\u00e9delmet adtak hozz\u00e1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Az Amsterdami Szabad Egyetem, a Z\u00fcrichi M\u0171szaki Egyetem \u00e9s a Qualcomm kutat\u00f3csoportja v\u00e9geztek<\/a><\/noindex> a modern DDR4 mem\u00f3riachipek t\u00e1mad\u00e1sok elleni v\u00e9delm\u00e9nek hat\u00e9konys\u00e1g\u00e1t vizsg\u00e1l\u00f3 kutat\u00e1s RowHammer<\/a><\/noindex>, amely lehet\u0151v\u00e9 teszi a dinamikus RAM (DRAM) egyes bitjeinek tartalm\u00e1nak megv\u00e1ltoztat\u00e1s\u00e1t. Az eredm\u00e9nyek ki\u00e1br\u00e1nd\u00edt\u00f3ak voltak, \u00e9s a f\u0151 gy\u00e1rt\u00f3k DDR4 chipei tov\u00e1bbra is maradtak<\/a><\/noindex> sebezhet\u0151ek (CVE-2020-10255<\/a><\/noindex>). <\/p>\n

A RowHammer sebezhet\u0151s\u00e9g lehet\u0151v\u00e9 teszi az egyes mem\u00f3ria bitek tartalm\u00e1nak torz\u00edt\u00e1s\u00e1t az\u00e1ltal, hogy folyamatosan olvasunk adatokat k\u00f6zeli mem\u00f3riasejtekb\u0151l. Mivel a DRAM mem\u00f3ria egy k\u00e9tdimenzi\u00f3s elrendez\u00e9s, amely minden egyes cell\u00e1ja egy kondenz\u00e1torb\u00f3l \u00e9s tranzisztorb\u00f3l \u00e1ll, a mem\u00f3ria egy adott ter\u00fclet\u00e9nek folyamatos olvas\u00e1sa fesz\u00fclts\u00e9gingadoz\u00e1st \u00e9s anom\u00e1li\u00e1kat okoz, ami a szomsz\u00e9dos cell\u00e1k t\u00f6lt\u00e9s\u00e9nek kis m\u00e9rt\u00e9k\u0171 elveszt\u00e9s\u00e9t eredm\u00e9nyezi. Ha az olvas\u00e1s intenzit\u00e1sa el\u00e9g magas, a cella elegend\u0151 t\u00f6lt\u00e9st vesz\u00edthet, \u00e9s a k\u00f6vetkez\u0151 regener\u00e1l\u00e1si ciklus nem tudja helyre\u00e1ll\u00edtani az eredeti \u00e1llapot\u00e1t, ami a cell\u00e1ban t\u00e1rolt adatok \u00e9rt\u00e9k\u00e9nek megv\u00e1ltoz\u00e1s\u00e1hoz vezet. <\/p>\n

A DDR4 chipek ezen hat\u00e1s elleni blokkol\u00e1s\u00e1ra a TRR (Target Row Refresh) technol\u00f3gi\u00e1t alkalmazz\u00e1k, amely a RowHammer t\u00e1mad\u00e1sok sor\u00e1n a cell\u00e1k torzul\u00e1s\u00e1nak megakad\u00e1lyoz\u00e1s\u00e1ra szolg\u00e1l. A probl\u00e9ma az, hogy nincs egys\u00e9ges megk\u00f6zel\u00edt\u00e9s a TRR megval\u00f3s\u00edt\u00e1s\u00e1ra, \u00e9s minden CPU- \u00e9s mem\u00f3ria gy\u00e1rt\u00f3 saj\u00e1t \u00e9rtelmez\u00e9s\u00e9t alkalmazza, saj\u00e1t v\u00e9delmi v\u00e1ltozataikat alkalmazva, mik\u00f6zben a megval\u00f3s\u00edt\u00e1s r\u00e9szleteit nem hozz\u00e1k nyilv\u00e1noss\u00e1gra.
\nA gy\u00e1rt\u00f3k \u00e1ltal alkalmazott RowHammer blokkol\u00e1si m\u00f3dszerek vizsg\u00e1lata lehet\u0151v\u00e9 tette a v\u00e9delmi int\u00e9zked\u00e9sek megker\u00fcl\u00e9s\u00e9nek egyszer\u0171 megtal\u00e1l\u00e1s\u00e1t. A vizsg\u00e1lat alatt kider\u00fclt, hogy a gy\u00e1rt\u00f3k \u00e1ltal gyakorolt elva biztons\u00e1g hom\u00e1lyos\u00edt\u00e1s \u00fatj\u00e1n<\/a><\/noindex> (security by obscurity) elve a TRR megval\u00f3s\u00edt\u00e1sakor csak a klasszikus t\u00e1mad\u00e1sok elleni v\u00e9delemben seg\u00edt, amelyek a cell\u00e1k t\u00f6lt\u00e9s\u00e9nek megv\u00e1ltoztat\u00e1s\u00e1n manipul\u00e1lnak egy vagy k\u00e9t szomsz\u00e9dos sorban. <\/p>\n

A utility developed by researchers allows checking the susceptibility of chips to multi-faceted RowHammer attack variants, in which the attempt to influence the charge is made simultaneously for several lines of memory cells. Such attacks can bypass the TRR protection implemented by some manufacturers and lead to bit corruption even on new DDR4 memory hardware.
\nOf the 42 studied DIMM modules, 13 modules were found vulnerable to non-standard RowHammer attack variants, despite declared protection. The problematic modules were produced by SK Hynix, Micron, and Samsung, whose products cover<\/a><\/noindex> 95% of the DRAM market.<\/p>\n

In addition to DDR4, chips LPDDR4 used in mobile devices were also studied, which turned out to be sensitive to extended RowHammer attack variants. In particular, the memory used in Google Pixel smartphones, Google Pixel 3, LG G7, OnePlus 7, and Samsung Galaxy S10 was affected.<\/p>\n

Researchers were able to reproduce several exploitation techniques on the problematic DDR4 chips. For example, using the RowHammer-exploit<\/a><\/noindex> for PTE (Page Table Entries) required conducting the attack for a period ranging from 2.3 seconds to three hours and fifteen seconds, depending on the tested chips. T\u00e1mad\u00e1s<\/a><\/noindex> The attack on the RSA-2048 open key stored in memory took from 74.6 seconds to 39 minutes and 28 seconds. T\u00e1mad\u00e1s<\/a><\/noindex> The attack on circumventing permission checks by modifying the sudo process memory took 54 minutes and 16 seconds.<\/p>\n

To check the DDR4 memory chips used by users, a utility has been published TRRespass<\/a><\/noindex>. To successfully conduct the attack, information is required about the physical address layout used in the memory controller in relation to banks and memory cell rows. An additional utility has been developed for layout determination drama<\/a><\/noindex>, which requires root privileges to run. Soon, an application for testing smartphone memory will also be published. tervezik<\/a><\/noindex> publik\u00e1lni kell a mobiltelefonok mem\u00f3ria tesztel\u00e9s\u00e9re szolg\u00e1l\u00f3 alkalmaz\u00e1st.<\/p>\n

A c\u00e9gnek Intel<\/a><\/noindex> \u00e9s AMD<\/a><\/noindex> Aj\u00e1nlott\u00e1k, hogy a v\u00e9delem \u00e9rdek\u00e9ben haszn\u00e1ljunk hibajav\u00edt\u00f3 (ECC) mem\u00f3ri\u00e1t, Maximum Activate Count (MAC) t\u00e1mogat\u00e1s\u00fa mem\u00f3ria vez\u00e9rl\u0151ket, \u00e9s alkalmazzunk megn\u00f6velt regener\u00e1l\u00e1si frekvenci\u00e1t. A kutat\u00f3k azonban \u00fagy v\u00e9lik, hogy a m\u00e1r kiadott chipek eset\u00e9ben nincs megold\u00e1s az Rowhammer garant\u00e1lt v\u00e9delm\u00e9re, \u00e9s az ECC alkalmaz\u00e1sa, valamint a mem\u00f3ri\u00e1nak a regener\u00e1l\u00e1si frekvenci\u00e1j\u00e1nak n\u00f6vel\u00e9se nem bizonyult hat\u00e9konynak. P\u00e9ld\u00e1ul kor\u00e1bban m\u00e1r javasolt\u00e1k m\u00f3dszer<\/a><\/noindex> a DRAM mem\u00f3ria ECC v\u00e9delem megker\u00fcl\u00e9s\u00e9re, \u00e9s bemutatt\u00e1k, hogy lehets\u00e9ges DRAM t\u00e1mad\u00e1st v\u00e9grehajtani helyi h\u00e1l\u00f3zatba<\/a><\/noindex>, a vend\u00e9g rendszerb\u0151l<\/a><\/noindex> \u00e9s a<\/a><\/noindex> JavaScript b\u00f6ng\u00e9sz\u0151ben val\u00f3 futtat\u00e1s\u00e1val.<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A DDR4 mem\u00f3riachipek tov\u00e1bbra is sebezhet\u0151ek a RowHammer t\u00e1mad\u00e1sokkal szemben, annak ellen\u00e9re, hogy v\u00e9delmet adtak hozz\u00e1 | ProHoster","description":"Az Amsterdami Szabad Egyetem, a Z\u00fcrichi M\u0171szaki Egyetem \u00e9s a Qualcomm kutat\u00f3csoportja","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}