{"id":114581,"date":"2024-03-26T12:25:42","date_gmt":"2024-03-26T10:25:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen"},"modified":"2024-03-26T12:25:42","modified_gmt":"2024-03-26T10:25:43","slug":"zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","title":{"rendered":"ZenHammer \u2014 en attackmetod f\u00f6r att f\u00f6rvr\u00e4nga minnesinneh\u00e5ll p\u00e5 AMD Zen-plattformar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskare fr\u00e5n ETH Z\u00fcrich har utvecklat en ZenHammer-attackmetod, ett alternativ av RowHammer-attacker f\u00f6r att \u00e4ndra inneh\u00e5llet i enskilda bitar av dynamiskt RAM (DRAM), anpassad f\u00f6r anv\u00e4ndning p\u00e5 plattformar med AMD-processorer. Tidigare RowHammer-attackmetoder var begr\u00e4nsade till system baserade p\u00e5 Intel-processorer, men forskningen visade att minnescellernas f\u00f6rvr\u00e4ngningar ocks\u00e5 kan \u00e5stadkommas p\u00e5 plattformar med minneskontrollerare fr\u00e5n AMD. <\/p>\n

Metodens funktion har demonstrerats p\u00e5 AMD Zen 2- och Zen 3-system med DDR4-minne fr\u00e5n tre ledande tillverkare (Samsung, Micron och SK Hynix). Attacken lyckas s\u00e5v\u00e4l kringg\u00e5 TRR (Target Row Refresh) mekanismen i minneschippen, som syftar till att skydda mot f\u00f6rvr\u00e4ngning av minnesceller i angr\u00e4nsande rader. Enligt forskarna \u00e4r system baserade p\u00e5 CPU:er fr\u00e5n AMD Zen 3 mer s\u00e5rbara \u00e4n system med Intel Coffee Lake-processorer och \u00e4r enklare och effektivare att angripa. P\u00e5 AMD Zen 2-system lyckades f\u00f6rvr\u00e4ngningar av minnesceller \u00e5stadkommas f\u00f6r 7 av 10 testade DDR4-chip, medan det p\u00e5 Zen 3-system blev 6 av 10. Forskare har ocks\u00e5 analyserat m\u00f6jligheten till en attack p\u00e5 AMD Zen 4-system med DDR5-minne, men den metod som utvecklats f\u00f6r DDR4 kunde framg\u00e5ngsrikt \u00e5terges endast p\u00e5 1 av 10 testade DDR5-minneschip, vilket inneb\u00e4r att attacken som s\u00e5dan inte utesluts, men kr\u00e4ver utveckling av mer effektiva l\u00e4sm\u00f6nster som passar f\u00f6r DDR5-enheter. <\/p>\n

F\u00f6r att arbeta med AMD-chips har tidigare utvecklade exploateringar anpassats, som \u00e4ndrar inneh\u00e5llet i minnessideposterna (PTE, page table entry) f\u00f6r att f\u00e5 k\u00e4rnprivilegier och kringg\u00e5 l\u00f6senords-\/beh\u00f6righetskontroller genom att modifiera minnet av sudo-processen och skada den lagrade RSA-2048 offentliga nyckeln i OpenSSH f\u00f6r att \u00e5terskapa den privata nyckeln. Angreppet p\u00e5 minnessidorna kunde reproduceras p\u00e5 7 av 10 testade DDR4-chips, RSA-nyckelangreppet p\u00e5 6 chips, och sudo-angreppet p\u00e5 4 chips, med angreppstider p\u00e5 164, 267 och 209 sekunder, respektive.

\"ZenHammer<\/center> <\/p>\n

Metoden kan ocks\u00e5 till\u00e4mpas f\u00f6r att attackera system via webbl\u00e4sare f\u00f6r att g\u00f6ra \u00e4ndringar fr\u00e5n virtuella maskiner<\/a> eller f\u00f6r att organisera ett angrepp \u00f6ver n\u00e4tverket. P\u00e5 GitHub finns k\u00e4llkoden f\u00f6r DARE-verktyget f\u00f6r omv\u00e4nt ingenj\u00f6rskonst av minnesadressering f\u00f6r DRAM tillg\u00e4nglig under MIT-licens, samt tv\u00e5 upps\u00e4ttningar av verktyg f\u00f6r fuzzing-testning av bitf\u00f6rvanskning i minnet \u2014 ddr4_zen2_zen3_pub f\u00f6r DDR4-chips (Zen 2 och Zen 3) och ddr5_zen4_pub f\u00f6r DDR5-chips (Zen 4), som kan anv\u00e4ndas f\u00f6r att kontrollera sina system f\u00f6r s\u00e5rbarhet mot angrepp.

\"ZenHammer<\/center> <\/p>\n

F\u00f6r att \u00e5stadkomma bitf\u00f6rvr\u00e4ngning anv\u00e4nds metoden RowHammer, som bygger p\u00e5 att DRAM-minne, som \u00e4r en tv\u00e5dimensionell matris av celler best\u00e5ende av en kondensator och en transistor, upprepade l\u00e4sningar av samma minnesomr\u00e5de leder till sp\u00e4nningsfluktuationer och anomalier som orsakar en liten laddningsf\u00f6rlust i angr\u00e4nsande celler. Om l\u00e4shastigheten \u00e4r h\u00f6g kan en angr\u00e4nsande cell f\u00f6rlora tillr\u00e4ckligt med laddning och den efterf\u00f6ljande regenereringscykeln kanske inte hinner \u00e5terst\u00e4lla dess ursprungliga tillst\u00e5nd, vilket resulterar i en \u00e4ndring av de lagrade datav\u00e4rdena i cellen. Forskare har identifierat specifika egenskaper hos de minneshanterings- och synkroniseringsmekanismer som anv\u00e4nds i AMD-processorer, vilket har m\u00f6jliggjort \u00e5terskapande av l\u00e5gniv\u00e5adressmappning f\u00f6r DRAM, identifiering av angr\u00e4nsande celladresser, utveckling av metoder f\u00f6r att kringg\u00e5 cachning samt ber\u00e4kning av m\u00f6nster och frekvenser f\u00f6r operationer som leder till laddningsf\u00f6rlust. <\/p>\n

F\u00f6r att skydda mot RowHammer till\u00e4mpar chipstillverkare mekanismen TRR (Target Row Refresh), som blockerar cellf\u00f6rvr\u00e4ngning i vissa fall, men skyddar inte mot alla m\u00f6jliga angrepp. Den mest effektiva metoden f\u00f6r skydd \u00e4r fortfarande att anv\u00e4nda minne med felkorrigering (ECC), vilket v\u00e4sentligt f\u00f6rsv\u00e5rar, men inte helt utesluter, genomf\u00f6randet av RowHammer-attacker. \u00d6kad frekvens av minnesregenerering kan ocks\u00e5 minska risken f\u00f6r en lyckad attack. <\/p>\n

F\u00f6retaget AMD har publicerat en rapport om problemet, d\u00e4r det anges att AMD-processorer anv\u00e4nder minneskontroller som f\u00f6ljer DDR-specifikationerna, och eftersom framg\u00e5ngen av angrepp huvudsakligen beror p\u00e5 systeminst\u00e4llningar och DRAM-minnet, b\u00f6r fr\u00e5gor ang\u00e5ende probleml\u00f6sning riktas till minnestillverkarna och systemleverant\u00f6rerna. Bland de befintliga metoderna f\u00f6r att komplicera genomf\u00f6randet av Rowhammer-klassens angrepp n\u00e4mns anv\u00e4ndningen av ECC-minne, \u00f6kning av minnesregenereringsfrekvensen, avst\u00e4ngning av f\u00f6rdr\u00f6jd regenereringsl\u00e4ge och anv\u00e4ndning av processorer med kontrollerare som st\u00f6djer MAC (Maximum Activate Count) f\u00f6r DDR4 (1, 2 och 3 generationen AMD EPYC \"Naple\", \"Rome\" och \"Milan\") och RFM (Refresh Management) f\u00f6r DDR5 (4 generationen AMD EPYC).
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM), \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 \u0441 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 AMD. \u041f\u0440\u043e\u0448\u043b\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114582,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ZenHammer \u2014 en attackmetod f\u00f6r att f\u00f6rvr\u00e4nga minnesinneh\u00e5llet p\u00e5 AMD Zen-plattformar | ProHoster","description":"Forskare fr\u00e5n ETH Z\u00fcrich har utvecklat ZenHammer-attackmetoden, som \u00e4r en variant av RowHammer-attacker f\u00f6r att \u00e4ndra inneh\u00e5llet i individuella bitar av dynamiskt RAM.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ZenHammer \u2014 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 AMD Zen | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 ZenHammer, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u043e\u0431\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/zenhammer-metod-ataki-dlya-iskazheniya-soderzhimogo-pamyati-na-platformah-amd-zen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-26T10:25:43+00:00","article:modified_time":"2024-03-26T10:25:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114581","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 17:11:05","updated":"2026-02-09 17:11:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=114581"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114581\/revisions"}],"predecessor-version":[{"id":159263,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114581\/revisions\/159263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/114582"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=114581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=114581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=114581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}