"Exploiting the DRAM rowhammer bug to gain kernel privileges "

guest · Nov 21, 2018

"ECC cannot stop Rowhammer attacks"
3 is the magic number (of bits): Flip 'em at once and your ECC protection has been Rowhammer'd
November 21, 2018
https://www.theregister.co.uk/2018/11/21/rowhammer_ecc_server_protection/

Researchers in the Netherlands have discovered that error-correcting code (ECC) memory protection can be thwarted to perform Rowhammer memory manipulation attacks.

The Vrije Universiteit Amsterdam crew of Lucian Cojocar, Kaveh Razavi, Cristiano Giuffrida and Herbert Bos developed a method to precisely alter the bits on server memory chips without triggering ECC's correction mechanism, giving them the ability to inject commands and change access permissions.

The findings are significant because ECC has long been considered a tried and true method for preventing Rowhammer attacks. A baddie who can sidestep ECC could then exploit many of the high-value systems that utilise the protection.

"ECC cannot stop Rowhammer attacks for all hardware combinations. If the number of bit flips is sufficiently high, ECC will only slow down the attack."
The paper, Exploiting Correcting Codes: On the Effectiveness of ECC Memory Against Rowhammer Attacks, will be presented next year at the Symposium on Security and Privacy.
Click to expand...

guest · Nov 22, 2018

mood said: ↑

"ECC cannot stop Rowhammer attacks"
3 is the magic number (of bits): Flip 'em at once and your ECC protection has been Rowhammer'd
November 21, 2018
https://www.theregister.co.uk/2018/11/21/rowhammer_ecc_server_protection/
Click to expand...

An Ingenious Data Hack Is More Dangerous Than Anyone Feared
November 21, 2018
https://www.wired.com/story/rowhammer-ecc-memory-data-hack/

A Concerning Development
Undermining ECC memory's data integrity presents a real problem; it's that feature that makes it an attractive underpinning for massive cloud services, research systems, and critical infrastructure.
Worse, the researchers point out that ECC memory is also increasingly found in a diverse array of Internet of Things devices, albeit for a totally separate reason.

The combination of high-reliability systems and low-power systems means that vulnerable ECC memory is likely present in devices all around you. [...] attack could even be done remotely, without physical access to the target system.

Both in terms of the attack and possible defenses, there is still a lot that is unknown, because ECC chips, their implementation, and the devices they work in are all generally proprietary.
"It's possible that ECC has been deployed in ways we have no evidence of, which means it’s possible that the attack surface is even bigger than it seems. [...]"
Click to expand...

guest · Jan 2, 2020

FPGA cards can be abused for faster and more reliable Rowhammer attacks
January 2, 2020
https://www.zdnet.com/article/fpga-...r-faster-and-more-reliable-rowhammer-attacks/

In a new research paper published on the last day of 2019, a team of American and German academics has shown that field-programmable gate array (FPGA) cards can be abused to launch better and faster Rowhammer attacks.
NEW JACKHAMMER ATTACK
The latest addition to this list is a new Rowhammer attack variation called JackHammer, which allows a malicious party to abuse FPGA cards to launch better and faster Rowhammer attacks.
FPGAs are often used with systems designed to run very specific tasks, such as cryptocurrency mining, web servers, heavy computation systems, and so on.
TWICE AS FAST, FOUR TIMES MORE BIT FLIPS
"In a Rowhammer attack, a significant factor in the speed and efficacy of an attack is the rate at which memory can be repeatedly accessed," the research team explains.

"Our results indicate that a malicious FPGA can perform twice as fast as a typical Rowhammer attack from the CPU on the same system and causes around four times as many bit flips as the CPU attack," the research team said.
Through their work, the research team would like to see cloud vendors react and add appropriate protections against malicious code executed within FPGAs instead of CPUs.
Click to expand...

White paper: "JackHammer: Efficient Rowhammer on Heterogeneous FPGA-CPU Platforms"
(PDF - 509 KB): https://arxiv.org/pdf/1912.11523.pdf

guest · Mar 10, 2020

Poor Rowhammer Fixes On DDR4 DRAM Chips Re-Enable Bit Flipping Attacks
March 10, 2020
https://thehackernews.com/2020/03/rowhammer-vulnerability-ddr4-dram.html

Remember rowhammer vulnerability? A critical issue affecting modern DRAM (dynamic random access memory) chips that could allow attackers to obtain higher kernel privileges on a targeted system by repeatedly accessing memory cells and induce bit flips.

To mitigate Rowhammer vulnerability on the latest DDR4 DRAM, many memory chip manufacturers added some defenses under the umbrella term Target Row Refresh (TRR) that refreshes adjacent rows when a victim row is accessed more than a threshold.
But it turns out 'Target Row Refresh,' promoted as a silver bullet to mitigate rowhammer attacks, is also insufficient and could let attackers execute new hammering patterns and re-enable the bit-flip attacks on the latest hardware as well.
TRRespass: The Rowhammer Fuzzing Tool
Tracked as CVE-2020-10255, the newly reported vulnerability was discovered by researchers at VUSec Lab, who today also released 'TRRespass,' an open source black box many-sided RowHammer fuzzing tool that can identify sophisticated hammering patterns to mount real-world attacks.
Click to expand...

What's more? The latest flaw also affects LPDDR4 and LPDDR4X chips embedded on most of the modern smartphones, leaving millions of devices still vulnerable to the RowHammer vulnerability again.
"We also ported a simplified version of TRRespass to ARM and managed to trigger bit flips on a variety of smartphones such as Google Pixel 3 and Samsung Galaxy S10," the researchers said.
Click to expand...

Log in or Sign up

"Exploiting the DRAM rowhammer bug to gain kernel privileges "

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

"Exploiting the DRAM rowhammer bug to gain kernel privileges "

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches