{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"Chip-urile de memorie DDR4 r\u0103m\u00e2n vulnerabile la atacurile RowHammer, \u00een ciuda protec\u021biei ad\u0103ugate.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea Liber\u0103 din Amsterdam, de la \u0218coala Politehnic\u0103 Federal\u0103 din Z\u00fcrich \u0219i de la Qualcomm au efectuat<\/a><\/noindex> a studiat eficien\u021ba protec\u021biei \u00eempotriva atacurilor de tipul celor aplicate pe cipurile de memorie DDR4 RowHammer<\/a><\/noindex>, care permit modificarea con\u021binutului unor bi\u021bi individuali din memoria RAM dinamic\u0103 (DRAM). Rezultatele au fost dezam\u0103gitoare, iar cipurile DDR4 ale principalilor produc\u0103tori sunt \u00eenc\u0103 r\u0103m\u00e2n<\/a><\/noindex> vulnerabile (CVE-2020-10255<\/a><\/noindex>). <\/p>\n

Vulnerabilitatea RowHammer permite distorsionarea con\u021binutului unor bi\u021bi de memorie prin citirea ciclic\u0103 a datelor din celelalte celule de memorie. Deoarece memoria DRAM este un aranjament bidimensional de celule, fiecare compus\u0103 dintr-un condensator \u0219i un transistor, efectuarea unei citiri continue a acelea\u0219i zone de memorie duce la fluctua\u021bii de tensiune \u0219i anomalii, provoc\u00e2nd o pierdere mic\u0103 de sarcin\u0103 \u00een celulele vecine. Dac\u0103 intensitatea citirii este suficient de mare, celula poate pierde o cantitate semnificativ\u0103 de sarcin\u0103, iar urm\u0103torul ciclu de regenerare poate s\u0103 nu reu\u0219easc\u0103 s\u0103-i restabileasc\u0103 starea ini\u021bial\u0103, ceea ce va duce la modificarea valorii datelor stocate \u00een celul\u0103. <\/p>\n

Pentru a bloca acest efect, cipurile moderne DDR4 utilizeaz\u0103 tehnologia TRR (Target Row Refresh), destinat\u0103 s\u0103 previn\u0103 distorsionarea celulelor \u00een timpul unui atac RowHammer. Problema este c\u0103 nu exist\u0103 o abordare unic\u0103 pentru implementarea TRR, iar fiecare produc\u0103tor de CPU \u0219i memorie interpreteaz\u0103 TRR \u00een mod diferit, aplic\u00e2nd propriile solu\u021bii de protec\u021bie \u0219i nespecific\u00e2nd detaliile implement\u0103rii.
\nStudiul metodelor de blocare RowHammer utilizate de produc\u0103tori a dezv\u0103luit rapid c\u0103i de ocolire a protec\u021biei. La verificare, s-a constatat c\u0103 principiul practicat de produc\u0103tori \u201esecuritate prin obscuritate<\/a><\/noindex> ajut\u0103 doar la protec\u021bia \u00een cazuri specifice, acoperind atacuri standard care manipuleaz\u0103 modificarea sarcinii celulelor \u00een una sau dou\u0103 linii vecine. <\/p>\n

Utilitatea dezvoltat\u0103 de cercet\u0103tori permite verificarea susceptibilit\u0103\u021bii cipurilor la variantele multi-direc\u021bionale ale atacului RowHammer, \u00een care \u00eencercarea de influen\u021bare a \u00eenc\u0103rc\u0103rii se face simultan pentru mai multe r\u00e2nduri de celule de memorie. Astfel de atacuri permit ocolirea protec\u021biei TRR implementate de unii produc\u0103tori \u0219i duc la coruperea bi\u021bilor de memorie chiar \u0219i pe echipamentele noi cu memorie DDR4.
\nDin cele 42 de module DIMM studiate, 13 module s-au dovedit vulnerabile la variantele neconven\u021bionale de atac RowHammer, \u00een ciuda protec\u021biei declarate. Modulele problematice au fost fabricate de produc\u0103torii SK Hynix, Micron \u0219i Samsung, produsele c\u0103rora acoper\u0103<\/a><\/noindex> 95% din pia\u021ba DRAM.<\/p>\n

Pe l\u00e2ng\u0103 DDR4, au fost studiate \u0219i cipurile LPDDR4 utilizate \u00een dispozitivele mobile, care s-au dovedit a fi \u0219i ele sensibile la variantele extinse ale atacului RowHammer. \u00cen special, memoria folosit\u0103 \u00een smartphone-urile Google Pixel, Google Pixel 3, LG G7, OnePlus 7 \u0219i Samsung Galaxy S10 a fost vulnerabil\u0103.<\/p>\n

Cercet\u0103torii au reu\u0219it s\u0103 reproduc\u0103 pe cipurile problematice DDR4 mai multe tehnici de exploatare. De exemplu, utilizarea RowHammer pentru PTE (Intr\u0103ri \u00een Tabelul de Pagini) a necesitat un atac care dureaz\u0103 \u00eentre 2,3 secunde \u0219i trei ore \u0219i cincisprezece secunde, \u00een func\u021bie de cipurile testate.exploatului<\/a><\/noindex> exploatarea deterior\u0103rii cheii publice RSA-2048 stocat\u0103 \u00een memorie a durat \u00eentre 74,6 secunde \u0219i 39 de minute \u0219i 28 de secunde. Atac<\/a><\/noindex> o ocolire a verific\u0103rii autoriza\u021biei prin modificarea memoriei procesului sudo a durat 54 de minute \u0219i 16 secunde. Atac<\/a><\/noindex> Pentru a verifica cipurile de memorie DDR4 utilizate de utilizatori, a fost publicat\u0103 o utilitate<\/p>\n

TRRespass. Pentru a efectua cu succes atacul, sunt necesare informa\u021bii despre harta adreselor fizice utilizate \u00een controlerul de memorie, corelate cu b\u0103ncile \u0219i r\u00e2ndurile celulelor de memorie. Pentru a determina harta, a fost dezvoltat\u0103 suplimentar o utilitate<\/a><\/noindex>drama , care necesit\u0103 rularea cu privilegii root. \u00cen cur\u00e2nd va fi<\/a><\/noindex>publicat\u0103 o aplica\u021bie pentru testarea memoriei smartphone-urilor. se preconizeaz\u0103<\/a><\/noindex> s-a recomandat utilizarea memoriei cu corec\u021bie de erori (ECC), a controlerelor de memorie care suport\u0103 Maximum Activate Count (MAC) \u0219i aplicarea unei frecven\u021be crescute de regenerare. Totu\u0219i, cercet\u0103torii consider\u0103 c\u0103 pentru cipurile deja lansate nu exist\u0103 o solu\u021bie garantat\u0103 \u00eempotriva Rowhammer, iar utilizarea ECC \u0219i cre\u0219terea frecven\u021bei de regenerare a memoriei s-au dovedit ineficiente. De exemplu, a fost deja propus anterior<\/p>\n

Companiei Intel<\/a><\/noindex> \u0219i AMD<\/a><\/noindex> s-a recomandat utilizarea memoriei cu corectare a erorilor (ECC), a controlerelor de memorie cu suport pentru Maximum Activate Count (MAC) \u0219i aplicarea unei frecven\u021be de regenerare crescute pentru protec\u021bie. Cu toate acestea, cercet\u0103torii consider\u0103 c\u0103 pentru cipurile deja lansate nu exist\u0103 o solu\u021bie garantat\u0103 pentru protec\u021bia \u00eempotriva Rowhammer, iar aplicarea ECC \u0219i cre\u0219terea frecven\u021bei de regenerare a memoriei s-au dovedit a fi ineficiente. De exemplu, anterior s-a mai propus metod\u0103<\/a><\/noindex> atacuri asupra memoriei DRAM prin ocolirea protec\u021biei ECC, precum \u0219i posibilitatea de a efectua un atac asupra DRAM prin re\u021bea local\u0103<\/a><\/noindex>, din sistemul gazd\u0103<\/a><\/noindex> \u0219i cu ajutorul<\/a><\/noindex> de execu\u021bie a JavaScript-ului \u00een browser.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Chipurile de memorie DDR4 r\u0103m\u00e2n vulnerabile la atacurile RowHammer, \u00een ciuda protec\u021biei ad\u0103ugate | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea Liber\u0103 din Amsterdam, de la \u0218coala Politehnic\u0103 Federal\u0103 din Z\u00fcrich \u0219i de la Qualcomm","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}