RAMBleed: Reading Bits in Memory Without Accessing Them

Abstract

The Rowhammer bug is a reliability issue in DRAM cells that can enable an unprivileged adversary to flip the values of bits in neighboring rows on the memory module. Previous work has exploited this for various types of fault attacks across security boundaries, where the attacker flips inaccessible bits, often resulting in privilege escalation. It is widely assumed however, that bit flips within the adversary's own private memory have no security implications, as the attacker can already modify its private memory via regular write operations.We demonstrate that this assumption is incorrect, by employing Rowhammer as a read side channel. More specifically, we show how an unprivileged attacker can exploit the data dependence between Rowhammer induced bit flips and the bits in nearby rows to deduce these bits, including values belonging to other processes and the kernel. Thus, the primary contribution of this work is to show that Rowhammer is a threat to not only integrity, but to confidentiality as well.Furthermore, in contrast to Rowhammer write side channels, which require persistent bit flips, our read channel succeeds even when ECC memory detects and corrects every bit flip. Thus, we demonstrate the first security implication of successfullycorrected bit flips, which were previously considered benign.To demonstrate the implications of this read side channel, we present an end-to-end attack on OpenSSH 7.9 that extracts an RSA-2048 key from the root level SSH daemon. To accomplish this, we develop novel techniques for massaging memory from user space into an exploitable state, and use the DRAM rowbuffer timing side channel to locate physically contiguous memory necessary for double-sided Rowhammering. Unlike previous Rowhammer attacks, our attack does not require the use of huge pages, and it works on Ubuntu Linux under its default configuration settings.

TRRespass: Exploiting the Many Sides of Target Row Refresh

“…Within only five years since its discovery, exploits based on the RowHammer vulnerability [51] have spread to almost every type of computing system [71], [72]. Personal computers [14], [27], [28], [81], [88], cloud servers [23], [33], [54], [77], [79], [89], [96], and mobile phones [25], [91], [92] have all fallen victim to attacks with RowHammer bit flips triggered from native code [12], [23], [27], [33], [77]- [79], [81], [96], JavaScript in the browser [14], [25], [28], [81] and even remote clients across the network [66], [89]. From an academic demonstration, the RowHammer vulnerability has evolved into a major security vulnerability for the entire industry.…”

RASSLE: Return Address Stack based Side-channel LEakage

“…This exploit requires that the victim and the adversary to operate on the same logical core. This can be achieved using taskset, which is a common assumption in similar attack settings [KGGY20].…”

A Review and Case Study on Android Malware: Threat Model, Attacks, Techniques and Tools

“…There are many kinds of attacks that come under this category like the return to libc attack, jump-oriented programming attack, return-oriented programming attack, etc. [19,20].…”