Ama-memory chips e-DDR4 ahlala esengozini yokuhlaselwa kwe-RowHammer naphezu kokuvikelwa okwengeziwe

Ithimba labacwaningi abavela e-Vrije Universiteit Amsterdam, ETH Zurich kanye ne-Qualcomm ebanjiwe ukufunda ngokusebenza ngempumelelo kokuvikela ekuhlaselweni kwekilasi okusetshenziswe kuma-memory chips esimanje e-DDR4 I-RowHammer, okukuvumela ukuthi uguqule okuqukethwe kwezingcezu ngazinye zememori yokufinyelela engahleliwe (i-DRAM). Imiphumela ibidumaza futhi ama-DDR4 chips avela kubakhiqizi abakhulu namanje hlala abasengozini (I-CVE-2020-10255).

Ukuba sengozini kwe-RowHammer kuvumela okuqukethwe kwezingcezu zememori ngayinye ukuthi konakaliswe ngokufunda idatha ngomjikelezo kusuka kumaseli enkumbulo aseduze. Njengoba inkumbulo ye-DRAM iwuxhaxha lwamaseli anezinhlangothi ezimbili, ngalinye liqukethe i-capacitor ne-transistor, ukufunda okuqhubekayo kwendawo yenkumbulo efanayo kubangela ukuguquguquka kwamandla kagesi kanye nokudidayo okubangela ukulahlekelwa okuncane kwenkokhiso kumaseli angomakhelwane. Uma umfutho wokufunda uphakeme ngokwanele, khona-ke iseli lingase lilahlekelwe inani elikhulu ngokwanele lenkokhelo futhi umjikelezo wokuvuselela olandelayo ngeke ube nesikhathi sokubuyisela isimo sawo sokuqala, okuzoholela ekushintsheni kwenani ledatha egcinwe kuseli. .

Ukuze uvimbele lo mphumela, ama-chips esimanje e-DDR4 asebenzisa ubuchwepheshe be-TRR (Target Row Refresh), obudizayinelwe ukuvimbela amaseli ukuthi onakaliswe ngesikhathi sokuhlasela kwe-RowHammer. Inkinga ukuthi ayikho indlela eyodwa yokusebenzisa i-TRR futhi i-CPU ngayinye nomkhiqizi wememori uhumusha i-TRR ngendlela yayo, isebenzisa izinketho zayo zokuvikela futhi ayivezi imininingwane yokuqaliswa.
Ukufunda izindlela zokuvimba i-RowHammer ezisetshenziswa abakhiqizi kwenze kwaba lula ukuthola izindlela zokudlula ukuvikela. Lapho kuhlolwa, kuvele ukuthi umgomo owenziwa abakhiqizi “ukuphepha ngokungaqondakali (ukuphepha ngokufihlakala) lapho kusetshenziswa i-TRR kusiza kuphela ukuvikela ezimeni ezikhethekile, okuhlanganisa ukuhlasela okuvamile okushintsha ukushajwa kwamaseli kumugqa owodwa noma emibili eseduze.

Insiza eyakhiwe abacwaningi yenza kube nokwenzeka ukuhlola ukuthambekela kwama-chips ezinhlobonhlobo ezihlukahlukene zokuhlasela kwe-RowHammer, lapho umzamo wokuthonya inkokhiso wenzelwa imigqa eminingana yamaseli enkumbulo ngesikhathi esisodwa. Ukuhlasela okunjalo kungadlula ukuvikela kwe-TRR okwenziwa abanye abakhiqizi futhi kuholele ekukhohlakaleni kwe-memory bit, ngisho naku-hardware entsha enenkumbulo ye-DDR4.
Kuma-DIMM angama-42 afundiwe, amamojula ayi-13 aphenduke aba sengozini yokuhlukahluka okungajwayelekile kokuhlasela kwe-RowHammer, naphezu kokuvikelwa okumenyezelwe. Amamojula ayinkinga akhiqizwa ngabakwa-SK Hynix, Micron kanye ne-Samsung, imikhiqizo yabo izembozo 95% wemakethe ye-DRAM.

Ngaphezu kwe-DDR4, ama-chips e-LPDDR4 asetshenziswa kumadivayisi eselula nawo afundwa, okubuye kwavela ukuthi azwela ezinhlobonhlobo ezithuthukile zokuhlasela kwe-RowHammer. Ikakhulukazi, inkumbulo esetshenziswe ku-Google Pixel, Google Pixel 3, LG G7, OnePlus 7 kanye nama-smartphones e-Samsung Galaxy S10 yathinteka kule nkinga.

Abacwaningi bakwazile ukukhiqiza kabusha izindlela ezimbalwa zokuxhaphaza kuma-chips e-DDR4 ayinkinga. Isibonelo, usebenzisa i-RowHammer-ukuxhaphaza ku-PTE (Okufakiwe Kwethebula Lekhasi) kuthathe kusukela kumasekhondi angu-2.3 kuya emahoreni amathathu nemizuzwana eyishumi nanhlanu ukuthola ilungelo le-kernel, kuye ngama-chips ahloliwe. Ukuhlasela ngokulimala kokhiye womphakathi ogcinwe kumemori, i-RSA-2048 ithathe ukusuka kumasekhondi angu-74.6 ukuya kumaminithi angu-39 namasekhondi angu-28. Ukuhlasela kuthathe imizuzu engama-54 nemizuzwana eyi-16 ukweqa isheke sokuqinisekisa ngokuguqulwa kwememori yenqubo ye-sudo.

Isisetshenziswa sishicilelwe ukuhlola ama-memory chips e-DDR4 asetshenziswa abasebenzisi I-TRRespass. Ukuze wenze ukuhlasela ngempumelelo, ulwazi olumayelana nokuhlelwa kwamakheli angokoqobo asetshenziswa kusilawuli sememori ngokuhlobene namabhange nemigqa yamaseli enkumbulo liyadingeka. Isisetshenziswa senziwe ngaphezu kwalokho ukuze kunqunywe isakhiwo Umdlalo, okudinga ukusebenza njengempande. Esikhathini esizayo esiseduze futhi kuhlelwe shicilela uhlelo lokusebenza lokuhlola inkumbulo ye-smartphone.

Izinkampani Intel и AMD Ukuze bathole ukuvikelwa, bacebise ukuthi kusetshenziswe inkumbulo yokulungisa amaphutha (ECC), izilawuli zememori ezinokwesekwa kwe-Maximum Activate Count (MAC), futhi basebenzise izinga lokuvuselela elikhuphukile. Abacwaningi bakholelwa ukuthi kuma-chips asevele akhululiwe asikho isixazululo sokuvikela okuqinisekisiwe ngokumelene ne-Rowhammer, futhi ukusetshenziswa kwe-ECC nokwandisa imvamisa yokuvuselelwa kwenkumbulo kubonakale kungasebenzi. Ngokwesibonelo, kwahlongozwa ngaphambili indlela ukuhlaselwa kwenkumbulo ye-DRAM ngokudlula ukuvikelwa kwe-ECC, futhi kukhombisa amathuba okuhlasela i-DRAM ngokusebenzisa inethiwekhi yendawo yendawokusuka uhlelo lwezivakashi и ngosizo usebenzisa i-JavaScript esipheqululini.

Source: opennet.ru