Researchers from Worcester Polytechnic Institute (USA) have introduced a new type of Mayhem attack that uses the Rowhammer dynamic random access memory bit distortion technique to change the values ββof stack variables used as flags in the program to decide whether authentication and security checks have passed. Practical examples of the attack are demonstrated to bypass authentication in SUDO, OpenSSH and MySQL, as well as to change the result of security-related checks in the OpenSSL library.
The attack can be applied to applications that use checks to compare values ββthat differ from zero. Example of vulnerable code: int auth = 0; ... // verification code that changes the auth value in case of successful authentication if(auth != 0) return AUTH_SUCCESS; else return AUTH_FAILURE;
In the context of this example, for a successful attack it is enough to corrupt any bit in the memory associated with the 32-bit auth variable on the stack. If any bit in the variable is corrupted, the value will no longer be zero and the conditional operator will determine the successful completion of authentication. Such validation patterns are quite common in applications and are found, for example, in SUDO, OpenSSH, MySQL and OpenSSL.
The attack can also be applied to comparisons of the form βif(auth == 1)β, but in this case its implementation becomes more complicated, since it is necessary to distort not any bit of 32, but the last bit. The method can also be used to influence the values ββof variables in processor registers, since the contents of the registers can be temporarily flushed onto the stack when a context switch, function call, or signal handler fires. During the period of time while register values ββare in memory, distortions can be introduced into this memory and the changed value will be restored to the register.
To distort the bits, one of the modifications of the RowHammer class attack is used. Since DRAM memory is a two-dimensional array of cells, each consisting of a capacitor and a transistor, performing continuous reads of the same memory region results in voltage fluctuations and anomalies that cause a small loss of charge in neighboring cells. If the reading intensity is high, then the neighboring cell may lose a sufficiently large amount of charge and the next regeneration cycle will not have time to restore its original state, which will lead to a change in the value of the data stored in the cell. To protect against RowHammer, chip manufacturers have added a TRR (Target Row Refresh) mechanism, which blocks cell corruption in special cases, but does not protect against all possible attack variations.
To protect against the Mayhem attack, it is recommended to use in comparisons not an evaluation of differences from zero or a coincidence with one, but a match check using a random seed value with non-zero octets. In this case, to set the desired value of the variable, it is necessary to accurately distort a significant number of bits, which is unrealistic, in contrast to the distortion of one bit. Example of non-attackable code: int auth = 0xbe406d1a; ... // verification code that sets the auth value to 0x23ab8701 in case of successful authentication if(auth == 0x23ab8701) return AUTH_SUCCESS; else return AUTH_FAILURE;
The specified protection method has already been used by the sudo developers and was included in release 1.9.15 as a fix for the CVE-2023-42465 vulnerability. They plan to publish a prototype of the code for carrying out the attack after fixes have been made to the main vulnerable projects.
Source: opennet.ru