Researchers from Worcester Polytechnic Institute (USA) have presented a new type of Mayhem attack, using a bit distortion method in dynamic RAM called Rowhammer to change the values of variables in the stack, which are used in a program as flags to determine the success of authentication and security checks. Practical examples of the attack have been demonstrated for bypassing authentication in SUDO, OpenSSH, and MySQL, as well as altering the outcome of security checks in the OpenSSL library.
The attack can be applied to applications where checks involve comparisons of values against zero. Example of vulnerable code: int auth = 0; … // verification code that changes the value of auth in case of successful authentication if(auth != 0) return AUTH_SUCCESS; else return AUTH_FAILURE;
In the context of this example, a successful attack only requires corrupting any bit in memory that corresponds to the 32-bit variable auth in the stack. Once any bit of the variable is corrupted, its value will no longer be zero, and the conditional operator will determine that authentication has been successfully passed. Such verification patterns are quite common in applications and can be found in SUDO, OpenSSH, MySQL, and OpenSSL.
The attack can also be applied to comparisons like 'if(auth == 1)', but in this case, its execution is complicated because it requires corrupting not just any bit from 32, but the last bit. The method can also be used to influence the values of variables in processor registers, as the contents of the registers may be temporarily pushed to the stack during context switching, function calls, or signal handlers. During the time the register values are in memory, distortions can be introduced into this memory, and the modified value will be restored in the register.
The bit distortion uses a modification of the RowHammer attack class. Since DRAM memory consists of a two-dimensional array of cells, each made up of a capacitor and a transistor, continuously reading the same area of memory causes voltage fluctuations and anomalies that lead to a slight loss of charge in neighboring cells. If the read intensity is high, a neighboring cell may lose a significant amount of charge, and the next refresh cycle may not restore its original state, resulting in a change to the data stored in that cell. To protect against RowHammer, chip manufacturers have added a Target Row Refresh (TRR) mechanism, which blocks cell distortion in specific cases but does not safeguard against all potential attack variants.
To protect against the Mayhem attack, it is recommended to use a check for matches with a random seed with non-zero octets, rather than assessing differences from zero or matches with one. In this case, to set the required variable value, it is necessary to distort a significant number of bits accurately, which is unrealistic compared to distorting a single bit. Example of attack-resistant code: int auth = 0xbe406d1a; … // verification code that sets auth to 0x23ab8701 upon successful authentication if(auth == 0x23ab8701) return AUTH_SUCCESS; else return AUTH_FAILURE;
The specified protection method has already been implemented by the developers of sudo and included in the release 1.9.15 as a patch for the CVE-2023-42465 vulnerability. A code prototype for executing the attack is planned to be published after fixes are made to major vulnerable projects.
Source: opennet.ru
