A group of researchers from the Swiss Federal Institute of Technology Zurich, Amsterdam Free University, and Qualcomm has published a new RowHammer-class attack method that allows for the alteration of individual bits in dynamic random-access memory (DRAM). The attack has been codenamed Blacksmith and assigned the identifier CVE-2021-42114. Many DDR4 chips equipped with protections against previously known RowHammer methods are vulnerable. A toolkit to test systems for this vulnerability has been released on GitHub. <\/p>\n
Recall that RowHammer attacks allow for the distortion of individual bits in memory by cyclically reading data from adjacent memory cells. Since DRAM memory is a two-dimensional array of cells, each consisting of a capacitor and a transistor, continuous reading from the same memory area leads to voltage fluctuations and anomalies that cause a slight loss of charge in neighboring cells. If the reading intensity is high, the adjacent cell can lose a significant amount of charge, and the next refresh cycle may not restore its original state, resulting in a change in the stored data value. <\/p>\n
To protect against RowHammer, chip manufacturers proposed the TRR (Target Row Refresh) mechanism, which safeguards against cell distortion in adjacent rows. However, since this protection was based on the principle of 'security through obscurity,' it did not fundamentally resolve the issue and only protected against known specific cases, making it easy to find ways to bypass the protection. For instance, in May, Google proposed the Half-Double method, which was not affected by TRR protection because the attack targeted cells not directly adjacent to the target. <\/p>\n
The new Blacksmith method offers an alternative way to circumvent the TRR protection, based on uneven access with different frequencies to two or more aggressor rows to induce charge leakage. A specialized fuzzer has been developed to identify the memory access pattern that leads to charge leakage, automatically adjusting attack parameters for specific chips by varying the order, intensity, and systematic approach to accessing the cells. <\/p>\n
A similar approach, which is not related to targeting the same cells, undermines the current TRR protection methods, which in one form or another, rely on counting the number of repeated accesses to cells and, upon reaching certain thresholds, initiating a recharge of neighboring cells. In Blacksmith, the access pattern is spread across several cells from different sides of the target, allowing for charge leakage without reaching the threshold values. <\/p>\n
The method turned out to be significantly more effective than previously proposed ways to bypass TRR \u2014 researchers managed to cause bit distortion in all 40 recently purchased DDR4 memory chips from Samsung, Micron, SK Hynix, and an unknown manufacturer (the manufacturer was not specified for 4 chips). In comparison, the method previously proposed by the same researchers, TRRespass, was only effective for 13 out of the 42 chips tested at that time. <\/p>\n
In general terms, it is assumed that the Blacksmith method is applicable to 94% of all DRAM chips available on the market, but according to the researchers, some chips are more vulnerable and easier to attack than others. The implementation of error-correcting codes (ECC) in chips and doubling the memory refresh rate does not provide full protection but complicates exploitation. Importantly, the issue cannot be blocked in already released chips and requires the implementation of new hardware-level protections, so the attack will remain relevant for many years to come. <\/p>\n
Practical examples include methods of using Blacksmith to modify the content of page table entries (PTE) to obtain kernel privileges, corrupting the RSA-2048 public key stored in memory in OpenSSH (the public key can be matched with the attacker's private key to connect to the victim's VM) and bypassing authority checks by modifying the memory of the sudo process to gain root privileges. Depending on the chip, changing one target bit may require from 3 seconds to several hours of attack. virtual machine<\/a> to match the attacker's private key for connecting to the victim's VM) and to bypass authentication checks by modifying the memory of the sudo process to gain root privileges. Depending on the chip, changing a single target bit can take anywhere from 3 seconds to several hours of carrying out the attack. \r\n ![\"Play](\"https:\/\/img.youtube.com\/vi\/7IQi2mJ9mek\/hqdefault.jpg\")
\r\n