{"id":167488,"date":"2026-04-04T17:11:55","date_gmt":"2026-04-04T15:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataki-gddrhammer-i-geforge-iskazhayushhie-pamyat-gpu-dlya-dostupa-ko-vsej-pamyati-cpu"},"modified":"2026-04-04T17:11:55","modified_gmt":"2026-04-04T15:11:56","slug":"ataki-gddrhammer-i-geforge-iskazhayushhie-pamyat-gpu-dlya-dostupa-ko-vsej-pamyati-cpu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataki-gddrhammer-i-geforge-iskazhayushhie-pamyat-gpu-dlya-dostupa-ko-vsej-pamyati-cpu","title":{"rendered":"Sulmet GDDRHammer dhe GeForge, q\u00eb distortojn\u00eb memorien GPU p\u00ebr akses n\u00eb t\u00eb gjitha memorien CPU","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtuesit nga disa universitete n\u00eb SHBA dhe Australi kan\u00eb zhvilluar dy sulme t\u00eb klas\u00ebs Rowhammer \u2013 GDDRHammer dhe GeForge, t\u00eb cilat lejojn\u00eb, kur ekzekutohet nj\u00eb b\u00ebrtham\u00eb CUDA pa privilegje n\u00eb GPU-n\u00eb NVIDIA, t\u00eb deformohen bits t\u00eb ve\u00e7ant\u00eb n\u00eb \u00e7ipet e memorjes GDDR. Ndryshe nga metoda GPUHammer e prezantuar vitin e kaluar, sulmet e reja nuk kufizohen n\u00eb ndikimin e t\u00eb dh\u00ebnave q\u00eb p\u00ebrpunohen n\u00eb memorjen e GPU-s\u00eb, por lejojn\u00eb qasje t\u00eb plot\u00eb n\u00eb t\u00eb gjitha memorjet kryesore q\u00eb i takojn\u00eb hap\u00ebsir\u00ebs adres\u00eb t\u00eb CPU-s\u00eb. Hulumtuesit kan\u00eb demonstruar eksploit, t\u00eb cilat ofrojn\u00eb qasje root n\u00eb sistemin kryesor gjat\u00eb ekzekutimit t\u00eb nj\u00eb b\u00ebrtham\u00eb CUDA pa privilegje n\u00eb GPU. <\/p>\n

T\u00eb dy sulmet arrijn\u00eb humbjen premature t\u00eb ngarkes\u00ebs n\u00eb disa qeliza t\u00eb memorjes video, p\u00ebr t\u00eb cilat sulmuesit nuk kan\u00eb akses t\u00eb drejtp\u00ebrdrejt\u00eb, \u00e7ka \u00e7on n\u00eb ndryshimin e bit\u00ebve t\u00eb ruajtur n\u00eb k\u00ebto qeliza. Aft\u00ebsia p\u00ebr t\u00eb lexuar dhe shkruar n\u00eb memorien q\u00eb lidhet me hap\u00ebsir\u00ebn adresore t\u00eb CPU-s\u00eb realizohet n\u00ebp\u00ebrmjet nd\u00ebrhyrjes n\u00eb funksionimin e alokatorit t\u00eb memorjes GPU (cudaMalloc) p\u00ebr t\u00eb shkelur izolimin e memorjes GPU dhe p\u00ebr t\u00eb mapuar adresat virtuale t\u00eb GPU-s\u00eb n\u00eb adresat fizike t\u00eb memorjes s\u00eb GPU-s\u00eb ose CPU-s\u00eb. <\/p>\n

Nd\u00ebrhyrja realizohet p\u00ebrmes deformimit t\u00eb vlerave t\u00eb bitsave n\u00eb memorjen grafike, n\u00eb t\u00eb cil\u00ebn ruhen tabelat e faqeve t\u00eb memorjes GPU, q\u00eb jan\u00eb p\u00ebrgjegj\u00ebse p\u00ebr p\u00ebrkthimin e adresave virtuale n\u00eb fizike. Dallimet midis sulmeve GDDRHammer dhe GeForge p\u00ebrfshijn\u00eb at\u00eb se metoda GDDRHammer modifikon tabel\u00ebn e fundit t\u00eb faqeve (PT \u2013 Last Level Page Table), nd\u00ebrsa metoda GeForge modifikon katalogun e faqeve t\u00eb nivelit t\u00eb fundit (PD0 \u2013 Last Level Page Directory). <\/p>\n

P\u00ebrve\u00e7 t\u00eb tjerave, k\u00ebto tabela t\u00eb translacionit t\u00eb adresave p\u00ebrdoren p\u00ebr t\u00eb organizuar aksesin direkt t\u00eb GPU-s\u00eb n\u00eb memorien e CPU-s\u00eb, prandaj ndryshimi i adres\u00ebs n\u00eb tabel\u00ebn e faqeve t\u00eb GPU-s\u00eb n\u00eb nj\u00eb adres\u00eb fizike n\u00eb memorjen kryesore dhe vendosja e flagut APERTURE, i cili aktivizon modalitetin e mapimit t\u00eb memorjes s\u00eb CPU-s\u00eb, mund\u00ebson leximin dhe shkruarjen e t\u00eb dh\u00ebnave duke aksesuar memorjen kryesore p\u00ebrmes autobusit PCIe kur IOMMU \u00ebsht\u00eb i \u00e7aktivizuar (n\u00eb parazgjedhje \u00ebsht\u00eb i \u00e7aktivizuar).

\"Sulmet<\/center>
\"Sulmet<\/center> <\/p>\n

Sulmet e suksesshme jan\u00eb demonstruar p\u00ebr kartat grafike profesionale t\u00eb larta NVIDIA RTX A6000, bazuar n\u00eb mikroarkitektur\u00ebn Ampere (\u00e7mimi i kartave t\u00eb reja fillon nga $6850, nd\u00ebrsa ai i atyre p\u00ebrdorura fillon nga $4000) dhe modelet p\u00ebr p\u00ebrdorim t\u00eb zakonsh\u00ebm NVIDIA RTX 3060 ($250-300). Teknikat e zhvilluara p\u00ebr t\u00eb anashkaluar mbrojtjen nga Rowhammer, n\u00eb p\u00ebrputhje me p\u00ebrdorimin e mjeteve t\u00eb paraleleizimit t\u00eb ofruara nga GPU, lejuan q\u00eb frekuenca e ndodhi deformimesh t\u00eb rritet 64 her\u00eb n\u00eb krahasim me sulmet e kaluara. Si mas\u00eb p\u00ebrkohore p\u00ebr t\u00eb bllokuar sulmet, ekipi mund t\u00eb aktivizoj\u00eb modin e korrigjimit t\u00eb gabimeve ECC (Error Correcting Codes) me komand\u00ebn 'nvidia-smi -e 1', por kjo sjell kosto shtes\u00eb dhe potencialisht mund t\u00eb anashkalohet duke p\u00ebrdorur metoda sulmesh si ECCploit dhe ECC.fail.