Another Flip in the Wall of Rowhammer Defenses

By Daniel Gruss, Moritz Lipp, Michael Schwarz, Daniel Genkin, Jonas Juffinger, Sioli O'Connell, Wolfgang Schoechl, Yuval Yarom. IEEE Symposium on Security and Privacy, 2017

299 citations recorded by the source corpus.

The Rowhammer bug allows unauthorized modification of bits in DRAM cells from unprivileged software, enabling powerful privilege-escalation attacks. Sophisticated Rowhammer countermeasures have been presented, aiming at mitigating the Rowhammer bug or its exploitation. However, the state of the art provides insufficient insight on the completeness of these defenses. In this paper, we present novel Rowhammer attack and exploitation primitives, showing that even a combination of all defenses is ineffective. Our new attack technique, one-location hammering, breaks previous assumptions on requirements for triggering the Rowhammer bug, i.e., we do not hammer multiple DRAM rows but only keep one DRAM row constantly open. Our new exploitation technique, opcode flipping, bypasses recent isolation mechanisms by flipping bits in a predictable and targeted way in userspace binaries. We replace conspicuous and memory-exhausting spraying and grooming techniques with a novel reliable technique called memory waylaying. Memory waylaying exploits system-level optimizations and a side channel to coax the operating system into placing target pages at attacker-chosen physical locations. Finally, we abuse Intel SGX to hide the attack entirely from the user and the operating system, making any inspection or detection of the attack infeasible. Our Rowhammer enclave can be used for coordinated denial-of-service attacks in the cloud and for privilege escalation on personal computers. We demonstrate that our attacks evade all previously proposed countermeasures for commodity systems.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

View Paper: https://www.semanticscholar.org/paper/32657d005f4501fecefbab7276f6aad32afb766c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

RowHammer: A Retrospective (2019, background): “[31]–[33], [37], [54], [66], [73], [76], [89], [90], [107], [156],”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, background): “Since physical addresses are not provided to unprivileged applications, these attacks either require additional side channels [26, 67] or have to blindly attack targets until the correct target is found [71].”
Bit-Flip Attack: Crushing Neural Network With Progressive Bit Search (2019, background): “According to the state-of-the-art investigations, common error detection and correction techniques, such as Error-Correcting Code (ECC) [23] and Intel SGX [24], are broken defense mechanism to RHA.”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, background): “Another line of attacks attempts to induce faults in order to cause misclasiﬁcations [52], [53] and relies on a microarchitectural or device-level attacks, such as RowHammer [54].”
Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, methodology): “In particular, the documentation of the according SENTER instruction mentions that [36, 6-21]:”
TRRespass: Exploiting the Many Sides of Target Row Refresh (2020, methodology): “However, while it is widely cited in the literature [7], [27], [28], [56], [66], [81], [89], [91], very little is actually known about the pTRR mechanism.”