{"id":114581,"date":"2024-03-26T12:25:42","date_gmt":"2024-03-26T10:25:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen"},"modified":"2024-03-26T12:25:42","modified_gmt":"2024-03-26T10:25:43","slug":"zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","title":{"rendered":"ZenHammer \u2014 um m\u00e9todo de ataque para corromper o conte\u00fado da mem\u00f3ria em plataformas AMD Zen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pesquisadores da Escola Polit\u00e9cnica Federal de Zurique, na Su\u00ed\u00e7a, desenvolveram um m\u00e9todo de ataque chamado ZenHammer, que \u00e9 uma variante de ataques da classe RowHammer, para modificar o conte\u00fado de bits individuais da mem\u00f3ria din\u00e2mica (DRAM), adaptado para uso em plataformas com processadores AMD. M\u00e9todos anteriores de ataques da classe RowHammer se limitavam a sistemas baseados em processadores Intel, mas a pesquisa realizada mostrou que distor\u00e7\u00f5es em c\u00e9lulas de mem\u00f3ria tamb\u00e9m podem ser alcan\u00e7adas em plataformas com controladores de mem\u00f3ria da AMD. <\/p>\n

O funcionamento do m\u00e9todo foi demonstrado em sistemas AMD Zen 2 e Zen 3 com mem\u00f3ria DDR4 de tr\u00eas dos principais fabricantes (Samsung, Micron e SK Hynix). O ataque permite contornar o mecanismo TRR (Target Row Refresh) implementado nos chips de mem\u00f3ria, que visa proteger contra a distor\u00e7\u00e3o de c\u00e9lulas de mem\u00f3ria em linhas adjacentes. De acordo com os pesquisadores, sistemas baseados em CPU AMD Zen 3 s\u00e3o mais vulner\u00e1veis do que sistemas com processadores Intel Coffee Lake, sendo mais f\u00e1ceis e eficazes de atacar. Em sistemas AMD Zen 2, distor\u00e7\u00f5es em c\u00e9lulas foram alcan\u00e7adas em 7 dos 10 chips DDR4 testados, enquanto em sistemas Zen 3, isso ocorreu em 6 de 10. Os pesquisadores tamb\u00e9m analisaram a possibilidade de realizar ataques em sistemas AMD Zen 4 com mem\u00f3ria DDR5, mas o m\u00e9todo desenvolvido para DDR4 foi reproduzido com sucesso apenas em 1 dos 10 chips de mem\u00f3ria DDR5 testados. Vale destacar que a possibilidade de ataque n\u00e3o \u00e9 descartada, mas requer o desenvolvimento de padr\u00f5es de leitura mais eficazes, adequados para dispositivos DDR5. <\/p>\n

Para trabalhar com chips AMD, foi poss\u00edvel adaptar exploits desenvolvidos anteriormente que alteram o conte\u00fado das entradas da tabela de p\u00e1ginas de mem\u00f3ria (PTE, page table entry) para obter privil\u00e9gios de kernel, contornando a verifica\u00e7\u00e3o de senha\/autoriza\u00e7\u00e3o por meio da modifica\u00e7\u00e3o da mem\u00f3ria do processo sudo e corrompendo a chave p\u00fablica RSA-2048 mantida na mem\u00f3ria em OpenSSH para recriar a chave privada. O ataque \u00e0s p\u00e1ginas de mem\u00f3ria foi reproduzido em 7 de 10 chips DDR4 testados, o ataque \u00e0 chave RSA em 6 chips e o ataque ao sudo em 4 chips, com os tempos de ataque de 164, 267 e 209 segundos, respectivamente.

\"ZenHammer<\/center> <\/p>\n

O m\u00e9todo tamb\u00e9m pode ser aplicado para atacar sistemas atrav\u00e9s de navegadores, para realizar altera\u00e7\u00f5es a partir de m\u00e1quinas virtuais<\/a> ou para organizar um ataque pela rede. No GitHub, sob licen\u00e7a MIT, est\u00e1 dispon\u00edvel o c\u00f3digo-fonte da ferramenta DARE para engenharia reversa da distribui\u00e7\u00e3o de endere\u00e7os na mem\u00f3ria DRAM, bem como dois conjuntos de utilit\u00e1rios para testes de fuzzing de distor\u00e7\u00e3o de bits na mem\u00f3ria \u2014 ddr4_zen2_zen3_pub para chips DDR4 (Zen 2 e Zen 3) e ddr5_zen4_pub para chips DDR5 (Zen 4), que podem ser usados para verificar a vulnerabilidade dos seus sistemas a ataques.

\"ZenHammer<\/center> <\/p>\n

Para a degrada\u00e7\u00e3o de bits, \u00e9 utilizado o m\u00e9todo RowHammer, que se baseia no fato de que a mem\u00f3ria DRAM, que \u00e9 um array bidimensional de c\u00e9lulas compostas por um capacitor e um transistor, quando lida continuamente em uma mesma \u00e1rea, provoca flutua\u00e7\u00f5es de tens\u00e3o e anomalias que causam perda de carga nas c\u00e9lulas vizinhas. Se a intensidade de leitura for alta, uma c\u00e9lula vizinha pode perder uma quantidade significativa de carga e o pr\u00f3ximo ciclo de regenera\u00e7\u00e3o n\u00e3o consegue restaurar seu estado original, resultando em uma altera\u00e7\u00e3o no valor dos dados armazenados na c\u00e9lula. Durante a pesquisa, foram reveladas caracter\u00edsticas dos mecanismos de mapeamento de mem\u00f3ria f\u00edsica e sincroniza\u00e7\u00e3o de atualiza\u00e7\u00e3o de mem\u00f3ria em processadores AMD, o que permitiu recriar a endere\u00e7amento de baixo n\u00edvel da DRAM, determinar os endere\u00e7os das c\u00e9lulas vizinhas, desenvolver m\u00e9todos de contorno de cache e calcular padr\u00f5es e frequ\u00eancia de opera\u00e7\u00f5es que levam \u00e0 perda de carga. <\/p>\n

Para prote\u00e7\u00e3o contra RowHammer, os fabricantes de chips utilizam o mecanismo TRR (Target Row Refresh), que bloqueia a degrada\u00e7\u00e3o de c\u00e9lulas em casos espec\u00edficos, mas n\u00e3o protege contra todas as poss\u00edveis variantes de ataque. O m\u00e9todo de prote\u00e7\u00e3o mais eficaz continua sendo o uso de mem\u00f3ria com c\u00f3digos de corre\u00e7\u00e3o de erros (ECC), que complicam significativamente, mas n\u00e3o eliminam completamente, a realiza\u00e7\u00e3o de ataques do tipo RowHammer. Aumentar a frequ\u00eancia de regenera\u00e7\u00e3o da mem\u00f3ria tamb\u00e9m ajuda a reduzir a probabilidade de um ataque bem-sucedido. <\/p>\n

A empresa AMD publicou um relat\u00f3rio sobre o problema, afirmando que os processadores AMD utilizam controladores de mem\u00f3ria que atendem \u00e0s especifica\u00e7\u00f5es DDR, e como o sucesso do ataque depende principalmente das configura\u00e7\u00f5es do sistema e da mem\u00f3ria DRAM, quest\u00f5es sobre a resolu\u00e7\u00e3o do problema devem ser direcionadas aos fabricantes de mem\u00f3ria e sistemas. Entre as maneiras de dificultar a realiza\u00e7\u00e3o de ataques do tipo Rowhammer, mencionam-se o uso de mem\u00f3ria ECC, o aumento da frequ\u00eancia de regenera\u00e7\u00e3o de mem\u00f3ria, a desativa\u00e7\u00e3o do modo de regenera\u00e7\u00e3o atrasada e o uso de processadores com controladores que suportam o modo MAC (Maximum Activate Count) para DDR4 (1\u00ba, 2\u00ba e 3\u00ba gera\u00e7\u00e3o AMD EPYC 'Naple', 'Rome' e 'Milan') e RFM (Refresh Management) para DDR5 (4\u00aa gera\u00e7\u00e3o AMD EPYC).
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM), \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD. \u041f\u0440\u043e\u0448\u043b\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114582,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ZenHammer \u2014 m\u00e9todo de ataque para distorcer o conte\u00fado da mem\u00f3ria em plataformas AMD Zen | ProHoster","description":"Pesquisadores do Instituto Federal de Tecnologia de Zurique desenvolveram um m\u00e9todo de ataque ZenHammer, que \u00e9 uma variante dos ataques do tipo RowHammer para modificar o conte\u00fado de bits individuais na mem\u00f3ria din\u00e2mica.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ZenHammer \u2014 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 AMD Zen | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-26T10:25:43+00:00","article:modified_time":"2024-03-26T10:25:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114581","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:05","updated":"2026-02-09 17:11:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=114581"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114581\/revisions"}],"predecessor-version":[{"id":159263,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114581\/revisions\/159263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/114582"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=114581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=114581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=114581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}