{"id":143523,"date":"2025-09-16T17:11:57","date_gmt":"2025-09-16T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati"},"modified":"2025-09-16T17:11:57","modified_gmt":"2025-09-16T15:11:59","slug":"phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","title":{"rendered":"Phoenix \u2014 un atac asupra chip-urilor DDR5, care provoac\u0103 distorsiuni \u00een con\u021binutul memoriei","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la ETH Zurich, \u00eempreun\u0103 cu inginerii de la Google, au dezvoltat o nou\u0103 tehnic\u0103 de atac de tip Rowhammer \u2014 Phoenix (CVE-2025-6202), care permite ocolirea mecanismelor de protec\u021bie TRR (Target Row Refresh) utilizate \u00een cipurile DDR5, ce previn distorci\u021bia celulelor de memorie din cauza pierderii de \u00eenc\u0103rcare. A fost publicat un prototip de exploit care permite modificarea con\u021binutului unui anumit bit \u00een memoria RAM \u0219i ob\u021binerea unor privilegii crescute \u00een sistem. Demonstrarea atacului a fost realizat\u0103 pe un PC cu procesor AMD bazat pe microarhitectura Zen 4 \u0219i memorie DDR5 SK Hynix, unde au fost executate sarcini tipice pentru desktop. <\/p>\n

Atacul RowHammer permite distorsionarea con\u021binutului anumitor bi\u021bi din memoria DRAM prin citirea ciclic\u0103 a datelor din celulele de memorie adiacente. Deoarece memoria DRAM reprezint\u0103 un aranjament bidimensional de celule, fiecare av\u00e2nd un condensator \u0219i un tranzistor, citirea constant\u0103 a acelea\u0219i zone de memorie duce la fluctua\u021bii de tensiune \u0219i anomalii, provoc\u00e2nd o pierdere mic\u0103 de sarcin\u0103 \u00een celulele adiacente. Dac\u0103 intensitatea citirii este mare, atunci celula adiacenta poate pierde o cantitate suficient de mare de sarcin\u0103, iar ciclul de regenerare nu va reu\u0219i s\u0103 restabileasc\u0103 starea ini\u021bial\u0103, ceea ce va duce la o modificare a valorii datelor stocate \u00een celul\u0103. <\/p>\n

Metoda de atac Rowhammer a fost propus\u0103 \u00een 2014, dup\u0103 care a \u00eenceput o \u201ev\u00e2n\u0103toare\u201d \u00eentre cercet\u0103torii de securitate \u0219i produc\u0103torii de echipamente \u2014 produc\u0103torii de cipuri de memorie au \u00eencercat s\u0103 blocheze vulnerabilitatea, iar cercet\u0103torii au g\u0103sit noi moduri de ocolire a acesteia. De exemplu, pentru a se proteja \u00eempotriva RowHammer, produc\u0103torii de cipuri au ad\u0103ugat mecanismul TRR (Target Row Refresh), dar s-a dovedit c\u0103 acesta blocheaz\u0103 distorci\u021bia celulelor doar \u00een cazuri particulare, f\u0103r\u0103 a proteja \u00eempotriva tuturor variantelor posibile de atac. Metodele de atac au fost dezvoltate pentru cipuri DDR3, DDR4 \u0219i DDR5 pe sisteme cu procesoare Intel, AMD \u0219i ARM, precum \u0219i pentru memoria video utilizat\u0103 \u00een pl\u0103cile grafice NVIDIA. Mai mult, au fost g\u0103site modalit\u0103\u021bi de ocolire a corec\u021biei de erori ECC \u0219i au fost propuse variante de ata\u0219are prin re\u021bea \u0219i prin execu\u021bia codului JavaScript \u00een browser. <\/p>\n

Un factor cheie pentru ocolirea protec\u021biei \u00eempotriva distorci\u021biei celulelor de memorie \u00een DRAM este \u00een\u021belegerea logicii de func\u021bionare a mecanismului TRR, care se bazeaz\u0103 \u00een principal pe ascunderea detaliilor de implementare \u0219i pe principiul \u201esecuritate prin obscuritate\u201d (security by obscurity). Pentru a determina logica de func\u021bionare \u0219i a efectua inginerie invers\u0103, cercet\u0103torii au creat pl\u0103ci speciale bazate pe FGPA Arty-A7 \u0219i ZCU104, care permit testarea modulelor de memorie DDR5 SO-DIMM \u0219i RDIMM, identificarea modelilor de acces la celulele de memorie, determinarea comenzilor DDR de nivel sc\u0103zut care sunt transmise dup\u0103 opera\u021biunile software cu memoria \u0219i analizarea reac\u021biilor la acestea.

\"Phoenix<\/center> <\/p>\n

S-a constatat c\u0103 protec\u021bia \u00een cipurile DDR5 analizate este implementat\u0103 f\u0103r\u0103 comenzi suplimentare de control al frecven\u021bei de actualizare a memoriei \u0219i se bazeaz\u0103 pe scheme cu frecven\u021b\u0103 de re\u00eenc\u0103rcare variabil\u0103 a celulelor. Pentru a reu\u0219i o atac Rowhammer \u00een aceste condi\u021bii, este necesar un urm\u0103rire precis\u0103 a mii de opera\u021biuni de actualizare a celulelor. \u00cen aceste condi\u021bii, metodele de atac Rowhammer existente anterior s-au dovedit a fi ineficiente, iar cercet\u0103torii au dezvoltat o nou\u0103 metod\u0103, care realizeaz\u0103 autocorectarea modelului de acces pe m\u0103sur\u0103 ce sunt identificate opera\u021biile de actualizare a memoriei pierdute \u00een timpul atacului. <\/p>\n

Metoda s-a dovedit eficient\u0103 \u0219i, \u00een timpul testelor, a permis ob\u021binerea unei distorsiuni controlate a bitului de memorie pe toate cele 15 cipuri DDR5 de la compania SK Hynix (care de\u021bine 36% din pia\u021ba DRAM), fabricate \u00eentre sf\u00e2r\u0219itul anului 2021 \u0219i sf\u00e2r\u0219itul anului 2024. O distorsiune a unui bit s-a dovedit suficient\u0103 pentru a crea un exploit care permite ob\u021binerea accesului root \u00een sistem \u00een timpul unui atac pe un sistem cu CPU AMD Ryzen 7 7700X \u0219i memorie SK Hynix DDR5 \u00een decurs de 109 secunde. Pentru a bloca metoda de atac propus\u0103, se recomand\u0103 triplarea frecven\u021bei de actualizare a memoriei. <\/p>\n

Ca metode de exploatare care permit ob\u021binerea drepturilor root prin distorsionarea unui bit, au fost analizate urm\u0103toarele tehnici: modificarea con\u021binutului \u00eenregistr\u0103rilor din tabela de pagini de memorie (PTE, page table entry) pentru a ob\u021bine privilegiul de kernel; coruperea cheii publice RSA-2048 stocate \u00een memorie \u00een OpenSSH (poate fi adus\u0103 o cheie public\u0103 corespondent\u0103 cu cheia privat\u0103 a atacatorului pentru a se conecta la VM-ul victimei); ocolirea verific\u0103rii drepturilor prin modificarea memoriei procesului sudo. ma\u0219ina virtual\u0103<\/a> la conformarea cu cheia secret\u0103 a atacatorului pentru a se conecta la VM-ul victimei); ocolirea verific\u0103rii autoriza\u021biei prin modificarea memoriei procesului sudo. Metoda cu PTE s-a dovedit a fi eficient\u0103 pentru toate cele 15 cipuri testate, atacul prin RSA a fost realizat pentru 11 cipuri, iar prin sudo \u2014 pentru 5.

\"Phoenix<\/center> <\/p>\n

\u00cen exploat, pentru plasarea tabelelor de pagini de memorie \u00een celulele DRAM selectate, este utilizat\u0103 tehnica Rubicon, dezv\u0103luit\u0103 simultan cu atacul Phoenix discutat. Rubicon manipuleaz\u0103 caracteristicile optimiz\u0103rii sistemului de alocare a memoriei nucleului Linux \u0219i permite alocarea memoriei \u00een zone cu o alt\u0103 valoare a 'migratetype', rezervate pentru opera\u021biuni privilegiate. Problema a fost confirmat\u0103 \u00een nuclee Linux de la 5.4 p\u00e2n\u0103 la 6.8, dar teoretic vulnerabilitatea acoper\u0103 toate nucleele cu mecanismul de alocare a memoriei Zoned Buddy Allocator. <\/p>\n

Pe l\u00e2ng\u0103 simplificarea atacurilor din clasa Rowhammer, tehnica Rubicon este, de asemenea, aplicabil\u0103 pentru \u00eembun\u0103t\u0103\u021birea eficien\u021bei atacurilor microarhitecturale, cum ar fi Spectre, \u0219i pentru facilitarea determin\u0103rii loca\u021biei \u00een memorie a datelor secrete care trebuie extrase prin scurgeri \u00een timpul execu\u021biei speculative a instruc\u021biunilor. Rubicon permite evitarea unei etape \u00eendelungate de scanare a memoriei \u0219i identificare a fi\u0219ierelor, cum ar fi \\\/etc\\\/shadow. \u00cen schimb, se poate \u00eencepe imediat exploatarea vulnerabilit\u0103\u021bilor microarhitecturale, datorit\u0103 plas\u0103rii predefinite a fi\u0219ierului la o adres\u0103 fizic\u0103 cunoscut\u0103. De exemplu, aplicarea metodei Rubicon a permis accelerarea scurgerii de date pe un sistem cu CPU Intel i7-8700K de la 2698 la 9.5 secunde (de 284 de ori), iar pe CPU AMD EPYC 7252, de la 189 la 27.9 secunde (de 6.8 ori).

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

\u00centre timp, un alt grup de cercet\u0103tori de la Universitatea George Mason a demonstrat aplicabilitatea atacurilor din clasa Rowhammer pentru compromiterea sistemelor AI. Cercet\u0103torii au propus metoda OneFlip, care permite modificarea specific\u0103 a comportamentului modelelor AI prin distorsionarea unei bi\u021bi de informa\u021bie \u00een memorie. Este disponibil un exemplu de cod pentru inser\u021bia unei modific\u0103ri troiane \u00een re\u021beaua neural\u0103. S-a demonstrat cum modificarea unui singur bit poate fi utilizat\u0103 pentru a distorsiona func\u021bionarea modelului de autoturism pentru a schimba interpretarea semnului rutier 'Stop' \u00een semnul 'Limitare de vitez\u0103'. De asemenea, s-a analizat utilizarea metodei pentru ocolirea sistemelor de recunoa\u0219tere facial\u0103. Pentru modelele care stocheaz\u0103 coeficien\u021bii de greutate sub form\u0103 de numere \u00eentregi de 32 de bi\u021bi, succesul atacului este evaluat la 99.9% f\u0103r\u0103 a afecta caracteristicile originale ale modelului.

\"Phoenix<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 Rowhammer — Phoenix (CVE-2025-6202), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0447\u0438\u043f\u0430\u0445 DDR5 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b TRR (Target Row Refresh), \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044e\u0449\u0438\u0439 \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u0435 \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u0437-\u0437\u0430 \u043f\u043e\u0442\u0435\u0440\u0438 \u0437\u0430\u0440\u044f\u0434\u0430. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0431\u0438\u0442\u0430 \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":143524,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-143523","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Phoenix \u2013 un atac asupra cipurilor DDR5 care duce la coruperea con\u021binutului memoriei | ProHoster","description":"Cercet\u0103torii de la Institutul Federal Tehnologic din Zurich, \u00eempreun\u0103 cu inginerii de la Google, au dezvoltat o nou\u0103 tehnic\u0103 de atac de tip Rowhammer - Phoenix (CVE-2025-6202), care permite ocolirea m\u0103surilor aplicate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Phoenix \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0447\u0438\u043f\u044b DDR5, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 Rowhammer - Phoenix (CVE-2025-6202), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-09-16T15:11:59+00:00","article:modified_time":"2025-09-16T15:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"143523","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:49:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:49:19","updated":"2026-01-23 14:49:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/143523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=143523"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/143523\/revisions"}],"predecessor-version":[{"id":164232,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/143523\/revisions\/164232"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/143524"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=143523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=143523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=143523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}