DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks

By P. Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz, Stefan Mangard. USENIX Security Symposium, 2015

517 citations recorded by the source corpus.

In cloud computing environments, multiple tenants are often co-located on the same multi-processor system. Thus, preventing information leakage between tenants is crucial. While the hypervisor enforces software isolation, shared hardware, such as the CPU cache or memory bus, can leak sensitive information. For security reasons, shared memory between tenants is typically disabled. Furthermore, tenants often do not share a physical CPU. In this setting, cache attacks do not work and only a slow cross-CPU covert channel over the memory bus is known. In contrast, we demonstrate a high-speed covert channel as well as the first side-channel attack working across processors and without any shared memory. To build these attacks, we use the undocumented DRAM address mappings. We present two methods to reverse engineer the mapping of memory addresses to DRAM channels, ranks, and banks. One uses physical probing of the memory bus, the other runs entirely in software and is fully automated. Using this mapping, we introduce DRAMA attacks, a novel class of attacks that exploit the DRAM row buffer that is shared, even in multi-processor systems. Thus, our attacks work in the most restrictive environments. First, we build a covert channel with a capacity of up to 2 Mbps, which is three to four orders of magnitude faster than memory-bus-based channels. Second, we build a side-channel template attack that can automatically locate and monitor memory accesses. Third, we show how using the DRAM mappings improves existing attacks and in particular enables practical Rowhammer attacks on DDR4.

Subfields: Artificial Intelligence, Materials Chemistry, Signal Processing

View Paper: https://www.semanticscholar.org/paper/f64be08ad745701791f99bba6b28b3e5dc2d7362

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Materials Chemistry

In Signal Processing

Citations in the corpus

A Systematic Evaluation of Transient Execution Attacks and Defenses (2018, background): “, DRAM buffers [73], or execution unit congestion [59, 1], remain open.”
SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, methodology): “Instead, we develop an exploit based on the timing information as a side channel for finding virtual addresses that map to the same bank in the DRAM within an enclave, as suggested in DRAMA [26] and the Google article [31].”
TRRespass: Exploiting the Many Sides of Target Row Refresh (2020, background): “In other words, we simply map a big chunk of memory and find a pool of addresses that belong to the same bank [76].”
Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB Attacks (2018, methodology): “Finally, DRAMA exploits the DRAM row buffer to mount (coarse-grained) cross-CPU side-channel attacks [46].”
Another Flip in the Wall of Rowhammer Defenses (2017, methodology): “Cloud servers are typically less susceptible to Rowhammer bit flips due to the presence of ECC, double refresh rates, and slower DRAM modules [57].”
Drammer: Deterministic Rowhammer Attacks on Mobile Platforms (2016, background): “Pessl et al. [30] demonstrated that reverse engineering the bank DRAM addressing can reduce the search time for Rowhammer bit ﬂips.”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, methodology): “With the assumption of row bits being the most significant bits in a physical address [32], [38], any bit beyond bit 19 is a row bit that determines the corresponding DRAM row of”
ZombieLoad: Cross-Privilege-Boundary Data Sampling (2019, methodology): “So far, all cross-VM covert channels either relied on Prime+Probe [46, 50, 51, 59, 77], DRAMA [58], or bus locking [76].”
RowHammer: A Retrospective (2019, background): “, DDR4 [12], [17], [140], [196], ECC DRAM [66], LPDDR3, and LPDDR2 DRAM [239]).”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, methodology): “According to experiments conducted on both x86 and ARM platforms, a row miss leads to a higher memory latency than a row hit, which can be easily identiﬁed [130].”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, background): “So far, most microarchitectural side-channel attacks on the kernel require at least some knowledge of physical addresses [65, 67].”
Spectre Attacks: Exploiting Speculative Execution (2018, background): “Attacks of the latter type include microarchitectural attacks exploiting cache timing [8, 30, 48, 52, 55, 69, 74], branch prediction history [1, 2], branch target buffers [14, 44] or open DRAM rows [56].”
Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, methodology): “[30] found another attack vector that can yield an accuracy close to a Flush+Reload attack without requiring”