Rowhammer – DDR3 Exploit – What You Need To Know


So the big news this week was the release of details of a very clever hardware attack posted by Google’s Project Zero security initiative called Rowhammer. The impressive part is this is a hardware/manufacturing bug that has elevated to a software based attack.

Rowhammer - DDR3 Exploit - What You Need To Know

In simple terms Rowhammer is an attack that exploits physical weaknesses in certain types of DDR memory chips (DDR3) to elevate the system rights of untrusted users of Intel-compatible PCs running Linux. It writes and rewrites memory to force capacitor errors in DRAM, which can be exploited to gain control of the system.

This corruption can lead to the wrong instructions being executed, or control structures that govern how memory is assigned to programs being altered – the latter case can be used by a normal program to gain kernel-level privileges (privilege escalation).

You can read the Google post here: Exploiting the DRAM rowhammer bug to gain kernel privileges

“Rowhammer” is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. We tested a selection of laptops and found that a subset of them exhibited the problem. We built two working privilege escalation exploits that use this effect. One exploit uses rowhammer-induced bit flips to gain kernel privileges on x86-64 Linux when run as an unprivileged userland process. When run on a machine vulnerable to the rowhammer problem, the process was able to induce bit flips in page table entries (PTEs). It was able to use this to gain write access to its own page table, and hence gain read-write access to all of physical memory.

Definitely one of the more interesting attacks vectors that have popped up in recent history, the last one as interesting/impressive as this was probably the researchers cracking 4096-bit RSA Encryption with a microphone.

The attack is based on work by scientists from 2014 that proved “bit flipping” could take place, you can find the related academic paper here: Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors [PDF]

Memory isolation is a key property of a reliable and secure computing system — an access to one memory address should not have unintended side effects on data stored in other addresses. However, as DRAM process technology scales down to smaller dimensions, it becomes more difficult to prevent DRAM cells from electrically interacting with each other. In this paper, we expose the vulnerability of commodity DRAM chips to disturbance errors. By reading from the same address in DRAM, we show that it is possible to corrupt data in nearby addresses. More specifically, activating the same row in DRAM corrupts data in nearby rows. We demonstrate this phenomenon on Intel and AMD systems using a malicious program that generates many DRAM accesses.


The research unveiled this week shows how the technique can be turned into an actual attack.

If you’re using ECC memory it will protect you to a certain degree (as you should be if you’re running servers), but won’t make you immune as it won’t protect you against multiple bit flips at once, given enough tries a malicious attacker could pull this off.

If you’re using DDR4 however, you should be immune to this.

The problem with this flaw from a security perspective, is we can’t patch it..it’s a hardware issue. And well, as anyone who has worked in datacenters or server grade computing knows – those DIMMs are not going to get replaced any time soon.

You can find the Rowhammer test on Github here: https://github.com/google/rowhammer-test

“Rowhammer” is a problem with recent DRAM modules in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. This repo contains a program for testing for the rowhammer problem which runs as a normal userland process.

Does this affect the average man on the street? No. Do we as security professionally and people who write code have to consider this, yes we do.

It’s quite an academic/theoretical attack – but also yields quite consistent results.

The team tested the exploit on 29 x86 laptops built between 2010 and 2014 and using DDR3 DRAM. In 15 cases the team could successfully subvert the systems in minutes, and found DRAM made by a variety of memory manufacturers is susceptible to the attack.

While this was a high cracking rate, the team reported almost no success on desktop machines. This is possibly because those computers use newer RAM with error-correcting memory (ECC), which makes rowhammer attacks on the kernel much harder to accomplish, or that laptops have denser and lower-power RAM that’s easier to corrupt.

From: Ouch! Google crocks capacitors and deviates DRAM to root Linux

Posted in: Exploits/Vulnerabilities, Hardware Hacking

,


Latest Posts:


truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.


2 Responses to Rowhammer – DDR3 Exploit – What You Need To Know

  1. dyngnosis March 12, 2015 at 1:36 am #

    This is a pretty good summary but your opening paragraph suggests only linux is vulnerable. While the researchers used linux as a test bed it should be noted that windows apis are available to generate the same (or similar) DRAM thrashing that would result in bit flipping.

    • Darknet March 12, 2015 at 3:52 pm #

      Theoretically yah as Windows also has a page file (Assuming you have it turned on), but that hasn’t been proved. Only Linux is confirmed, so not to say only Linux is vulnerable – but the current PoC is for Linux.