{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"DDR4-minnen f\u00f6rblir s\u00e5rbara f\u00f6r RowHammer-attacker trots tillagd skydd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En grupp forskare fr\u00e5n Vrije Universiteit Amsterdam, ETH Z\u00fcrich och Qualcomm ett<\/a><\/noindex> har unders\u00f6kt effektiviteten av skyddet mot attacker av typen RowHammer<\/a><\/noindex>, som m\u00f6jligg\u00f6r f\u00f6r\u00e4ndringar i inneh\u00e5llet av enskilda bitar av dynamiskt RAM (DRAM). Resultaten var dyster och DDR4-chips fr\u00e5n de st\u00f6rsta tillverkarna \u00e4r fortfarande f\u00f6rblir<\/a><\/noindex> s\u00e5rbara (CVE-2020-10255<\/a><\/noindex>). <\/p>\n

S\u00e5rbarheten RowHammer g\u00f6r det m\u00f6jligt att f\u00f6rvr\u00e4nga inneh\u00e5llet av enskilda minnesbitar genom cyklisk l\u00e4sning av data fr\u00e5n angr\u00e4nsande minnesceller. Eftersom DRAM-minnet utg\u00f6rs av en tv\u00e5dimensionell matris av celler, som var och en best\u00e5r av en kondensator och en transistor, leder kontinuerlig l\u00e4sning av samma minnesomr\u00e5de till sp\u00e4nningsfluktuationer och anomalier som orsakar en liten f\u00f6rlust av laddning i angr\u00e4nsande celler. Om l\u00e4sintensiteten \u00e4r tillr\u00e4ckligt h\u00f6g kan en cell f\u00f6rlora en betydande m\u00e4ngd laddning och n\u00e4sta regenereringscykel hinner inte \u00e5terst\u00e4lla dess ursprungliga tillst\u00e5nd, vilket leder till att v\u00e4rdet av de lagrade data i cellen \u00e4ndras. <\/p>\n

F\u00f6r att blockera denna effekt anv\u00e4nds en teknik kallad TRR (Target Row Refresh) i moderna DDR4-chips, som syftar till att f\u00f6rhindra f\u00f6rvr\u00e4ngning av celler vid RowHammer-attacker. Problemet \u00e4r att det inte finns n\u00e5gon enhetlig metod f\u00f6r att implementera TRR, och varje tillverkare av CPU och minne tolkar TRR p\u00e5 sitt eget s\u00e4tt, till\u00e4mpar sina egna skyddsmekanismer och avsl\u00f6jar inte detaljerna i implementationen.
\n\u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u043b\u0435\u0433\u043a\u043e \u043d\u0430\u0439\u0442\u0438 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443\u0435\u043c\u044b\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u0440\u0438\u043d\u0446\u0438\u043f «s\u00e4kerhet genom oklarhet<\/a><\/noindex> (security by obscurity) vid implementeringen av TRR bara hj\u00e4lper f\u00f6r skydd i specifika fall som omfattar typiska attacker som manipulerar f\u00f6r\u00e4ndringar av laddning i en eller tv\u00e5 angr\u00e4nsande rader. <\/p>\n

Det forskarutvecklade verktyget m\u00f6jligg\u00f6r kontroll av utsatthet f\u00f6r chip mot m\u00e5ngfacetterade varianter av RowHammer-attacker, d\u00e4r f\u00f6rs\u00f6k att p\u00e5verka laddningen g\u00f6rs f\u00f6r flera rader av minnesceller samtidigt. S\u00e5dana attacker kan kringg\u00e5 det skydd som implementerats av vissa tillverkare, s\u00e5som TRR, och leder till bitfel i minnet \u00e4ven p\u00e5 ny utrustning med DDR4-minne.
\nAv 42 studerade DIMM-moduler visade sig 13 moduler vara s\u00e5rbara f\u00f6r icke-standardiserade varianter av RowHammer-attacken, trots angivet skydd. De problematiska modulerna tillverkas av f\u00f6retagen SK Hynix, Micron och Samsung, vars produkter t\u00e4cker<\/a><\/noindex> 95 % av DRAM-marknaden.<\/p>\n

F\u00f6rutom DDR4 har \u00e4ven chip av typen LPDDR4, som anv\u00e4nds i mobila enheter, studerats och visat sig vara k\u00e4nsliga f\u00f6r utvidgade varianter av RowHammer-attacken. Specifikt drabbades minnet som anv\u00e4nds i Google Pixel-smartphones, Google Pixel 3, LG G7, OnePlus 7 och Samsung Galaxy S10.<\/p>\n

Forskarna lyckades \u00e5terskapa flera utnyttjande tekniker p\u00e5 de problematiska DDR4-chipen. Till exempel kr\u00e4vdes det f\u00f6r RowHammer-of the exploit<\/a><\/noindex> attacker f\u00f6r PTE (Page Table Entries) att genomf\u00f6ra attacken i mellan 2,3 sekunder och tre timmar och femton sekunder, beroende p\u00e5 de testade chipen. Attack<\/a><\/noindex> Den attack som syftade till att skada det lagrade RSA-2048-nyckeln tog mellan 74,6 sekunder och 39 minuter och 28 sekunder. Attack<\/a><\/noindex> Den attack som syftade till att kringg\u00e5 auktorisering genom minnesmodifiering av sudo-processen tog 54 minuter och 16 sekunder.<\/p>\n

F\u00f6r att kontrollera anv\u00e4ndarnas DDR4-minneschip publicerades verktyget TRRespass<\/a><\/noindex>. F\u00f6r att genomf\u00f6ra attacken kr\u00e4vs information om den fysiska adresslayouten kopplad till minnesbussar och rader av minnesceller i minneskontrollern. F\u00f6r att best\u00e4mma layouten utvecklades dessutom verktyget drama<\/a><\/noindex>, som kr\u00e4ver att det k\u00f6rs med root-r\u00e4ttigheter. Snart kommer \u00e4ven planeras<\/a><\/noindex> ett program f\u00f6r att testa minnet i smartphones att publiceras.<\/p>\n

F\u00f6retaget Intel<\/a><\/noindex> och AMD<\/a><\/noindex> Forskarna rekommenderade att anv\u00e4nda minne med felkorrektion (ECC), minneskontroller som st\u00f6djer Maximum Activate Count (MAC) samt att till\u00e4mpa en \u00f6kad regenereringsfrekvens. Forskarna anser dock att det saknas en garanterad l\u00f6sning f\u00f6r skydd mot Rowhammer f\u00f6r chip som redan har sl\u00e4ppts, och att anv\u00e4ndningen av ECC och \u00f6kad regenereringsfrekvens visat sig vara ineffektivt. Tidigare har exempelvis redan f\u00f6reslagits metod<\/a><\/noindex> angrepp p\u00e5 DRAM-minne f\u00f6rbi ECC-skydd, samt m\u00f6jligheten att utf\u00f6ra ett angrepp p\u00e5 DRAM via lokalt n\u00e4tverk<\/a><\/noindex>, fr\u00e5n v\u00e4rdsystemet<\/a><\/noindex> och med hj\u00e4lp av<\/a><\/noindex> k\u00f6rning av JavaScript i webbl\u00e4saren.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DDR4-minneschip \u00e4r fortfarande s\u00e5rbara f\u00f6r RowHammer-attacker, trots inf\u00f6rda skydd | ProHoster","description":"En grupp forskare fr\u00e5n Vrije Universiteit Amsterdam, ETH Z\u00fcrich och Qualcomm","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}