At the 38C3 conference, the FlippyRAM framework was presented, designed to check for vulnerabilities that allow Rowhammer-class attacks to alter the contents of RAM. The toolkit's code is written in C++ and is distributed under the MIT license. To simplify testing, a ready-to-use live distribution (1 GB) has been created, allowing testing by booting from a USB flash drive, along with a Docker container image.
The project's goal is to engage users in a study aimed at gathering statistics on how Rowhammer-class vulnerabilities manifest in commonly used systems. Test results can be submitted either from the loaded distribution or manually added to the research website.
The Rowhammer attack method was proposed 10 years ago, after which a cat-and-mouse game began between security researchers and hardware manufacturers — memory chip manufacturers attempted to block the vulnerability, while researchers found new ways to bypass it. In addition to DDR3 chips on Intel x86 systems, methods for attacking DDR4 and DDR5 chips, systems with AMD and ARM processors, workarounds for ECC error correction, network attack methods, and ways to execute attacks via JavaScript code in browsers have been identified.
The RowHammer attack allows for distortion of individual bits in DRAM memory by cyclically reading data from neighboring memory cells. Since DRAM memory consists of a two-dimensional array of cells, each comprising a capacitor and a transistor, continuous reading from the same area of memory leads to voltage fluctuations and anomalies that cause a slight loss of charge in adjacent cells. If the read intensity is high, a neighboring cell can lose a significant amount of charge, and the next regeneration cycle may not restore its original state, resulting in a change in the data stored in the cell. To protect against RowHammer, chip manufacturers have added a TRR (Target Row Refresh) mechanism that blocks cell distortion in specific cases but does not protect against all possible attack scenarios.
Source: opennet.ru
