Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript

By Daniel Gruss, Clémentine Maurice, Stefan Mangard. International Conference on Detection of intrusions and malware, and vulnerability assessment, 2015

463 citations recorded by the source corpus.

A fundamental assumption in software security is that a memory location can only be modified by processes that may write to this memory location. However, a recent study has shown that parasitic effects in DRAM can change the content of a memory cell without accessing it, but by accessing other memory locations in a high frequency. This so-called Rowhammer bug occurs in most of today's memory modules and has fatal consequences for the security of all affected systems, e.g., privilege escalation attacks. All studies and attacks related to Rowhammer so far rely on the availability of a cache flush instruction in order to cause accesses to DRAM modules at a sufficiently high frequency. We overcome this limitation by defeating complex cache replacement policies. We show that caches can be forced into fast cache eviction to trigger the Rowhammer bug with only regular memory accesses. This allows to trigger the Rowhammer bug in highly restricted and even scripting environments. We demonstrate a fully automated attack that requires nothing but a website with JavaScript to trigger faults on remote hardware. Thereby we can gain unrestricted access to systems of website visitors. We show that the attack works on off-the-shelf systems. Existing countermeasures fail to protect against this new Rowhammer attack.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/5f49e769c8eca94873dbb7f30387e33e9d36558e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, methodology): “[22] has the overhead of finding an eviction strategy and eviction set without any assumptions.”
Spectre Attacks: Exploiting Speculative Execution (2018, methodology): “Since the clflush instruction is not accessible from JavaScript, we use cache eviction instead [27, 51], i.”
ARMageddon: Cache Attacks on Mobile Devices (2015, methodology): “For instance, the last generations of Intel CPUs employ an undocumented variant of least-recently used (LRU) replacement policy [18].”
Error Characterization, Mitigation, and Recovery in Flash-Memory-Based Solid-State Drives (2017, methodology): “PARA is shown to be very effective in fixing the RowHammer problem at no storage cost and at very low performance overhead [94].”
Flip Feng Shui: Hammering a Needle in the Software Stack (2016, background): “Recent work analyzes some of the security implications of both trends, but so far the attacks that abuse these hardware/software features have been fairly limited— probabilistic privilege escalation [51], in-browser exploitation [12, 30], and selective information disclosure [8, 12, 31].”
CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management (2017, background): “Since then, many works use the Rowhammer issue to demonstrate the dangers of such softwareinduced hardware-based transient bit-flips in practical scenarios ranging from browsers [30], virtualized environments [50], privilege escalation on Linux kernel [52] and from Android apps [57].”
Intel SGX Explained (2016, background): “The rowhammer DRAM bit-flipping attack [72, 119, 166] is an example of a different class of software attacks that exploit design defects in the computer’s hardware.”
RowHammer: A Retrospective (2019, background): “[31]–[33], [37], [54], [66], [73], [76], [89], [90], [107], [156],”
DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks (2015, background): “As observed in previous work [3, 4], system libraries and the operating system assign 2 MB pages for arrays which are signifi-”
RIDL: Rogue In-Flight Data Load (2019, background): “This discloses the physical addresses of pages in our own process, which is important information to mount other attacks (such as Rowhammer attacks [51], [52], [53], [54], [55], [56], [57], [58], [59]).”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, methodology): “The information on the executing CPU core can be used to enhance cache attacks and other attacks such as the Rowhammer attack [9, 20].”
TRRespass: Exploiting the Many Sides of Target Row Refresh (2020, methodology): “However, while it is widely cited in the literature [7], [27], [28], [56], [66], [81], [89], [91], very little is actually known about the pTRR mechanism.”
SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, background): “, clflushopt) is a possible mitigation; however, the Rowhammer attack is still possible without relying on such instructions [14].”
Another Flip in the Wall of Rowhammer Defenses (2017, methodology): “While the memory consumption of the attacker can already raise suspicion, both spraying [24, 65] and grooming [68] easily exhaust the entire memory in a way that gets the attacker process killed by the OS.”
CacheZoom: How SGX Amplifies The Power of Cache Attacks (2017, background): “To maintain a stable frequency in spite of the available battery saving and frequency features, we set the CPU scaling governor to performance and limit the maximum and minimum frequency range.”
Artificial General Intelligence (2016, unknown): “Programs written in memory-safe languages usually call some libraries which aren’t, and even replacing all the libraries is not a total defense; for example, an AGI could perform a computation which causes a hardware glitch, such as RowHammer, which has been successfully used to cause memory corrupt”
Retrospective: Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors (2023, unknown): “…by which an unprivileged attacker can exploit RowHammer bitflips to circumvent memory protection and gain complete control of a system (e.g., [16, 20–28]), gain access to confidential data (e.g., [18, 19, 29]), or maliciously destroy the safety and accuracy of a system, e.g., an otherwise…”