{"id":114581,"date":"2024-03-26T12:25:42","date_gmt":"2024-03-26T10:25:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen"},"modified":"2024-03-26T12:25:42","modified_gmt":"2024-03-26T10:25:43","slug":"zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","title":{"rendered":"ZenHammer \u2014 o metod\u0103 de atac pentru distorsionarea con\u021binutului memoriei pe platformele AMD Zen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la ETH Zurich au dezvoltat o metod\u0103 de atac denumit\u0103 ZenHammer, care reprezint\u0103 o variant\u0103 a atacurilor din clasa RowHammer pentru a modifica con\u021binutul anumitor bi\u021bi din memoria RAM dinamic\u0103 (DRAM), adaptat\u0103 pentru utilizarea pe platformele cu procesoare AMD. Metodele anterioare de atac din clasa RowHammer au fost limitate la sistemele bazate pe procesoare Intel, dar cercetarea realizat\u0103 a ar\u0103tat c\u0103 distorsiunile celulelor de memorie pot fi ob\u021binute \u0219i pe platforme cu controlere de memorie de la AMD. <\/p>\n

Func\u021bionarea metodei a fost demonstrat\u0103 pe sistemele AMD Zen 2 \u0219i Zen 3 cu memorie DDR4 de la trei mari produc\u0103tori (Samsung, Micron \u0219i SK Hynix). Atacul reu\u0219e\u0219te s\u0103 ocoleasc\u0103 mecanismul TRR (Target Row Refresh) implementat \u00een cipurile de memorie, care are rolul de a proteja \u00eempotriva distorsiunilor celulelor de memorie din r\u00e2ndurile adiacente. Potrivit cercet\u0103torilor, sistemele bazate pe CPU AMD Zen 3 sunt mai vulnerabile dec\u00e2t sistemele cu procesoare Intel Coffee Lake \u0219i sunt mai u\u0219or \u0219i eficient de atacat. Pe sistemele AMD Zen 2, distorsiuni ale celulelor au fost ob\u021binute pentru 7 din cele 10 cipuri DDR4 testate, iar pe sistemele Zen 3 pentru 6 din 10. Cercet\u0103torii au analizat, de asemenea, posibilitatea de a efectua un atac pe sistemele AMD Zen 4 cu memorie DDR5, \u00eens\u0103 metoda dezvoltat\u0103 pentru DDR4 a reu\u0219it s\u0103 fie reprodus\u0103 cu succes doar pe 1 din cele 10 cipuri de memorie DDR5 testate, f\u0103r\u0103 a exclude \u00eens\u0103 posibilitatea atacului, care necesit\u0103 dezvoltarea unor \u0219abloane de citire mai eficiente, potrivite pentru dispozitivele DDR5. <\/p>\n

Pentru func\u021bionarea cu cipuri AMD, a fost posibil\u0103 adaptarea exploiturilor deja dezvoltate care modific\u0103 con\u021binutul \u00eenregistr\u0103rilor din tabelul paginilor de memorie (PTE, page table entry) pentru ob\u021binerea privilegilor de kernel, ocolind verificarea parolei\/autoriz\u0103rii prin modificarea memoriei procesului sudo \u0219i corup\u00e2nd cheia public\u0103 RSA-2048 stocat\u0103 \u00een memorie \u00een OpenSSH pentru a recrea cheia secret\u0103. Atacul asupra paginilor de memorie a fost reprodus pe 7 din cele 10 cipuri DDR4 testate, atacul asupra cheii RSA - pe 6 cipuri, iar atacul asupra sudo - pe 4 cipuri, av\u00e2nd \u00een vedere c\u0103 timpul de atac a fost de 164, 267 \u0219i 209 secunde, respectiv.

\"ZenHammer<\/center> <\/p>\n

Metoda poate fi, de asemenea, aplicat\u0103 pentru a ataca sistemul prin intermediul browserelor, pentru a efectua modific\u0103ri din ma\u0219ini virtuale<\/a> sau pentru organizarea unui atac \u00een re\u021bea. Pe GitHub, sub licen\u021ba MIT, a fost publicat codul surs\u0103 al instrumentului DARE pentru inginerie invers\u0103 a distribu\u021biei adreselor \u00een memoria DRAM, precum \u0219i dou\u0103 seturi de utilitare pentru testarea fuzzing a distorsion\u0103rii bi\u021bilor \u00een memorie - ddr4_zen2_zen3_pub pentru cipurile DDR4 (Zen 2 \u0219i Zen 3) \u0219i ddr5_zen4_pub pentru cipurile DDR5 (Zen 4), care pot fi utilizate pentru a verifica dac\u0103 sistemele sunt expuse atacului.

\"ZenHammer<\/center> <\/p>\n

Pentru distorsionarea bitilor se utilizeaz\u0103 metoda RowHammer, care se bazeaz\u0103 pe faptul c\u0103 \u00een memoria DRAM, care reprezint\u0103 un array bidimensional de celule compus dintr-un condensator \u0219i un tranzistor, citirea continu\u0103 a acelea\u0219i zone de memorie duce la fluctua\u021bii de voltaj \u0219i anomalii, cauz\u00e2nd o pierdere mic\u0103 de sarcin\u0103 \u00een celulele vecine. Dac\u0103 intensitatea citirii este mare, celula vecin\u0103 poate pierde un volum suficient de mare de sarcin\u0103, iar urm\u0103torul ciclu de regenerare nu reu\u0219e\u0219te s\u0103-i restabileasc\u0103 starea ini\u021bial\u0103, ceea ce duce la modificarea valorii datelor stocate \u00een celul\u0103. Cercet\u0103torul a identificat particularit\u0103\u021bile mecanismelor de mapare a memoriei fizice \u0219i sincronizarea actualiz\u0103rii memoriei utilizate \u00een procesoarele AMD, ceea ce a permis recrearea adres\u0103rii de nivel inferior DRAM, identificarea adreselor celulelor vecine, dezvoltarea metodelor de ocolire a memoriei cache, calcularea \u0219abloanelor \u0219i frecven\u021bei opera\u021biunilor care duc la pierderea sarcinii. <\/p>\n

Pentru a proteja \u00eempotriva RowHammer, produc\u0103torii de cipuri aplic\u0103 mecanismul TRR (Target Row Refresh), care blocheaz\u0103 distorsionarea celulelor \u00een cazuri specifice, dar nu protejeaz\u0103 \u00eempotriva tuturor variantelor posibile de atac. Cea mai eficient\u0103 metod\u0103 de protec\u021bie r\u0103m\u00e2ne utilizarea memoriei cu coduri de corec\u021bie a erorilor (ECC), care complic\u0103 semnificativ atacurile, dar nu le exclud complet. De asemenea, cre\u0219terea frecven\u021bei de regenerare a memoriei poate reduce probabilitatea unui atac de succes. <\/p>\n

Compania AMD a publicat un raport despre problem\u0103, \u00een care se men\u021bioneaz\u0103 c\u0103 \u00een procesoarele AMD sunt utilizate controllere de memorie care respect\u0103 specifica\u021biile DDR, \u0219i deoarece succesul atacului depinde \u00een principal de configura\u021biile sistemului \u0219i de memoriile DRAM, \u00eentreb\u0103rile legate de rezolvarea problemei ar trebui adresate produc\u0103torilor de memorie \u0219i sistemelor. Dintre solu\u021biile existente pentru dificultarea realiz\u0103rii atacurilor de tip Rowhammer se men\u021bioneaz\u0103 utilizarea memoriei ECC, cre\u0219terea frecven\u021bei de regenerare a memoriei, dezactivarea modului de regenerare \u00eent\u00e2rziat\u0103 \u0219i utilizarea procesoarelor cu controllere care suport\u0103 modul MAC (Maximum Activate Count) pentru DDR4 (1, 2 \u0219i 3 genera\u021bie AMD EPYC \u201eNaples\u201d, \u201eRome\u201d \u0219i \u201eMilan\u201d) \u0219i RFM (Refresh Management) pentru DDR5 (4 genera\u021bie AMD EPYC).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM), \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD. \u041f\u0440\u043e\u0448\u043b\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114582,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ZenHammer \u2014 metoda de atac pentru modificarea con\u021binutului memoriei pe platformele AMD Zen | ProHoster","description":"Cercet\u0103torii de la Institutul Federal de Tehnologie din Zurich au dezvoltat metoda de atac ZenHammer, care reprezint\u0103 o variant\u0103 a atacurilor de tip RowHammer pentru modificarea con\u021binutului bitilor individuali din memoria RAM dinamic\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ZenHammer \u2014 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 AMD Zen | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-26T10:25:43+00:00","article:modified_time":"2024-03-26T10:25:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114581","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:05","updated":"2026-02-09 17:11:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114581"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114581\/revisions"}],"predecessor-version":[{"id":159263,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114581\/revisions\/159263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/114582"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}