{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"DDR4 pam\u00e4\u0165ov\u00e9 \u010dipy zost\u00e1vaj\u00fa zranite\u013en\u00e9 vo\u010di \u00fatokom RowHammer, napriek pridanej ochrane","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdskumn\u00edkov z Amsterdamskej slobodnej univerzity, \u0160vaj\u010diarskej feder\u00e1lnej technickej \u0161koly v Z\u00fcrichu a spolo\u010dnosti Qualcomm uskuto\u010dnila<\/a><\/noindex> \u0161t\u00fadiu \u00fa\u010dinnosti ochrany implementovanej v s\u00fa\u010dasn\u00fdch DDR4 pam\u00e4\u0165ov\u00fdch \u010dipoch vo\u010di \u00fatokom RowHammer<\/a><\/noindex>, ktor\u00e9 umo\u017e\u0148uj\u00fa zmeni\u0165 obsah jednotliv\u00fdch bitov dynamickej pam\u00e4te (DRAM). V\u00fdsledky boli sklaman\u00edm a DDR4 \u010dipy hlavn\u00fdch v\u00fdrobcov zost\u00e1vaj\u00fa zranite\u013en\u00e9 (<\/a><\/noindex> CVE-2020-10255Zranite\u013enos\u0165 RowHammer umo\u017e\u0148uje skresli\u0165 obsah jednotliv\u00fdch bitov pam\u00e4te prostredn\u00edctvom cyklick\u00e9ho \u010d\u00edtania \u00fadajov z susedn\u00fdch pam\u00e4\u0165ov\u00fdch buniek. Ke\u010f\u017ee pam\u00e4\u0165 DRAM je dvojrozmern\u00fdm po\u013eom buniek, pri\u010dom ka\u017ed\u00e1 bunka pozost\u00e1va z kondenz\u00e1tora a tranzistora, neust\u00e1le \u010d\u00edtanie tej istej oblasti pam\u00e4te vedie k fluktua\u010dn\u00fdm nap\u00e4tiam a anom\u00e1li\u00e1m, ktor\u00e9 sp\u00f4sobuj\u00fa drobn\u00e9 straty n\u00e1boja v susedn\u00fdch bunk\u00e1ch. Ak je intenzita \u010d\u00edtania dostato\u010dne vysok\u00e1, bunka m\u00f4\u017ee strati\u0165 dostato\u010dne ve\u013ek\u00fd objem n\u00e1boja a nasleduj\u00faci regenera\u010dn\u00fd cyklus nebude schopn\u00fd obnovi\u0165 jej p\u00f4vodn\u00fd stav, \u010do povedie k zmene hodnoty ulo\u017een\u00fdch \u00fadajov v bunke.<\/a><\/noindex>). <\/p>\n

Na blokovanie tak\u00e9hoto efektu sa v s\u00fa\u010dasn\u00fdch DDR4 \u010dipoch pou\u017e\u00edva technol\u00f3gia TRR (Target Row Refresh), ur\u010den\u00e1 na zabr\u00e1nenie skresleniu buniek po\u010das \u00fatoku RowHammer. Probl\u00e9m je v tom, \u017ee neexistuje jednotn\u00fd pr\u00edstup k implement\u00e1cii TRR a ka\u017ed\u00fd v\u00fdrobca CPU a pam\u00e4te ho interpretuje po svojom, pou\u017e\u00edva vlastn\u00e9 varianty ochrany a nezverej\u0148uje detaily implement\u00e1cie. <\/p>\n

Studovanie met\u00f3d blokovania RowHammer pou\u017e\u00edvan\u00fdch v\u00fdrobcami umo\u017enilo \u013eahko n\u00e1js\u0165 sp\u00f4soby obch\u00e1dzania ochrany. Pri kontrole sa uk\u00e1zalo, \u017ee princ\u00edp \u201e
\n\u0160t\u00fadium met\u00f3d, ktor\u00e9 v\u00fdrobcovia pou\u017e\u00edvaj\u00fa na blokovanie RowHammer, umo\u017enilo \u013eahko n\u00e1js\u0165 cesty obch\u00e1dzania ochrany. Pri kontrole sa uk\u00e1zalo, \u017ee principi \"(security by obscurity) pri implement\u00e1cii TRR pom\u00e1ha iba na ochranu v \u0161pecifick\u00fdch pr\u00edpadoch, pokr\u00fdvaj\u00facich typick\u00e9 \u00fatoky, ktor\u00e9 manipuluj\u00fa s n\u00e1bojom buniek v jednej alebo dvoch susedn\u00fdch riadkoch.<\/a><\/noindex> (security by obscurity) pri implement\u00e1cii TRR pom\u00e1ha iba pri ochrane v \u0161pecifick\u00fdch pr\u00edpadoch, pokr\u00fdvaj\u00facich \u0161tandardn\u00e9 \u00fatoky, ktor\u00e9 manipuluj\u00fa so zmenou n\u00e1boja buniek v jednej alebo dvoch susedn\u00fdch riadkoch. <\/p>\n

N\u00e1stroj vyvinut\u00fd v\u00fdskumn\u00edkmi umo\u017e\u0148uje skontrolova\u0165 n\u00e1chylnos\u0165 \u010dipov vo\u010di viacn\u00e1sobn\u00fdm variantom \u00fatoku RowHammer, kde sa pokus o ovplyvnenie n\u00e1boja vykon\u00e1va s\u00fa\u010dasne na viacer\u00fdch radoch pam\u00e4\u0165ov\u00fdch buniek. Tak\u00e9to \u00fatoky umo\u017e\u0148uj\u00fa ob\u00eds\u0165 ochranu TRR implementovan\u00fa niektor\u00fdmi v\u00fdrobcami a ved\u00fa k skresleniu bitov pam\u00e4te, aj na nov\u00fdch zariadeniach s pam\u00e4\u0165ou DDR4.
\nZ 42 sk\u00faman\u00fdch DIMM modulov sa 13 modulov uk\u00e1zalo by\u0165 zranite\u013en\u00fdch vo\u010di netradi\u010dn\u00fdm variantom \u00fatoku RowHammer, napriek deklarovanej ochrane. Problematick\u00e9 moduly vyrobili spolo\u010dnosti SK Hynix, Micron a Samsung, ktor\u00fdch produkty pokr\u00fdvaj\u00fa<\/a><\/noindex> 95 % trhu DRAM.<\/p>\n

Okrem DDR4 boli sk\u00faman\u00e9 aj v mobiln\u00fdch zariadeniach pou\u017e\u00edvan\u00e9 \u010dipy LPDDR4, ktor\u00e9 sa taktie\u017e uk\u00e1zali by\u0165 citliv\u00e9 na roz\u0161\u00edren\u00e9 varianty \u00fatoku RowHammer. Konkr\u00e9tne, probl\u00e9mov\u00e9mu \u00fatoku podliehala pam\u00e4\u0165 pou\u017e\u00edvan\u00e1 v smartf\u00f3noch Google Pixel, Google Pixel 3, LG G7, OnePlus 7 a Samsung Galaxy S10.<\/p>\n

V\u00fdskumn\u00edci dok\u00e1zali reprodukova\u0165 na problematick\u00fdch \u010dipoch DDR4 nieko\u013eko techn\u00edk zneu\u017eitia. Napr\u00edklad, pou\u017eitie RowHammer-exploit<\/a><\/noindex> pre PTE (Page Table Entries) si vy\u017eiadalo na z\u00edskanie privil\u00e9gia jadra realiz\u00e1ciu \u00fatoku v \u010dase od 2,3 sekundy do troch hod\u00edn a p\u00e4tn\u00e1stich sek\u00fand, v z\u00e1vislosti od testovan\u00fdch \u010dipov. \u00datok<\/a><\/noindex> na po\u0161kodenie pam\u00e4te ulo\u017een\u00e9ho verejn\u00e9ho k\u013e\u00fa\u010da RSA-2048 trval od 74,6 sekundy do 39 min\u00fat a 28 sek\u00fand. \u00datok<\/a><\/noindex> na ob\u00eddenie overovania opr\u00e1vnen\u00ed cez modifik\u00e1ciu pam\u00e4te procesu sudo trval 54 min\u00fat a 16 sek\u00fand.<\/p>\n

Na overenie \u010dipov pam\u00e4te DDR4 pou\u017eit\u00fdch pou\u017e\u00edvate\u013emi bola zverejnen\u00e1 utilita TRRespass<\/a><\/noindex>. Na \u00faspe\u0161n\u00e9 vykonanie \u00fatoku s\u00fa potrebn\u00e9 inform\u00e1cie o usporiadan\u00ed fyzick\u00fdch adries v pam\u00e4\u0165ovom ovl\u00e1da\u010di, viazan\u00e9 na banky a riadky pam\u00e4\u0165ov\u00fdch buniek. Na ur\u010denie usporiadania bola navy\u0161e vyvinut\u00e1 utilita drama<\/a><\/noindex>, ktor\u00e1 vy\u017eaduje spustenie s pr\u00e1vami root. V najbli\u017e\u0161ej dobe sa tie\u017e pl\u00e1nuje<\/a><\/noindex> uvedenie aplik\u00e1cie na testovanie pam\u00e4te smartf\u00f3nov.<\/p>\n

Spolo\u010dnosti Intel<\/a><\/noindex> a AMD<\/a><\/noindex> Odpor\u00fa\u010daj\u00fa vyu\u017e\u00edva\u0165 pam\u00e4\u0165 s korekciou ch\u00fdb (ECC), pam\u00e4\u0165ov\u00e9 kontrol\u00e9ry s podporou Maximum Activate Count (MAC) a aplikova\u0165 zv\u00fd\u0161en\u00fa frekvenciu regener\u00e1cie. V\u00fdskumn\u00edci v\u0161ak tvrdia, \u017ee pre u\u017e vydan\u00e9 \u010dipy neexistuje rie\u0161enie pre zaru\u010den\u00fa ochranu proti Rowhammeru, a aplik\u00e1cia ECC a zv\u00fd\u0161enie frekvencie regener\u00e1cie pam\u00e4te sa uk\u00e1zali ako ne\u00fa\u010dinn\u00e9. Napr\u00edklad, u\u017e bol navrhnut\u00fd sp\u00f4sob<\/a><\/noindex> \u00fatokov na DRAM pam\u00e4\u0165 obch\u00e1dzaj\u00facich ochranu ECC, a taktie\u017e bola uk\u00e1zan\u00e1 mo\u017enos\u0165 uskuto\u010dnenia \u00fatoku na DRAM cez lok\u00e1lnu sie\u0165<\/a><\/noindex>, z hostite\u013esk\u00e9ho syst\u00e9mu<\/a><\/noindex> a s pomocou<\/a><\/noindex> sp\u00fa\u0161\u0165ania JavaScriptu v prehliada\u010di.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u010cipy pam\u00e4te DDR4 zost\u00e1vaj\u00fa zranite\u013en\u00e9 vo\u010di \u00fatokom RowHammer, napriek pridanej ochrane | ProHoster","description":"Skupina v\u00fdskumn\u00edkov z Amsterdamskej slobodnej univerzity, \u0160vaj\u010diarskej feder\u00e1lnej technickej \u0161koly v Z\u00fcrichu a spolo\u010dnosti Qualcomm","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}