{"id":112431,"date":"2023-12-22T21:10:32","date_gmt":"2023-12-22T19:10:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/mayhem-ataka-iskazhayushhaya-bity-v-pamyati-dlya-obhoda-autentifikaczii-v-sudo-i-openssh"},"modified":"2023-12-22T21:10:32","modified_gmt":"2023-12-22T19:10:33","slug":"mayhem-ataka-iskazhayushhaya-bity-v-pamyati-dlya-obhoda-autentifikaczii-v-sudo-i-openssh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/mayhem-ataka-iskazhayushhaya-bity-v-pamyati-dlya-obhoda-autentifikaczii-v-sudo-i-openssh","title":{"rendered":"Mayhem \u2014 an attack that corrupts bits in memory to bypass authentication in sudo and OpenSSH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from Worcester Polytechnic Institute (USA) have presented a new type of Mayhem attack, using a bit distortion method in dynamic RAM called Rowhammer to change the values of variables in the stack, which are used in a program as flags to determine the success of authentication and security checks. Practical examples of the attack have been demonstrated for bypassing authentication in SUDO, OpenSSH, and MySQL, as well as altering the outcome of security checks in the OpenSSL library. <\/p>\n
An attack can be applied to applications where checks involve comparing values against zero. Example of vulnerable code: int auth = 0; \u2026 \/\/ verification code that changes the auth value in case of successful authentication if(auth != 0) return AUTH_SUCCESS; else return AUTH_FAILURE; <\/p>\n
In the context of this example, a successful attack only requires corrupting any bit in memory that corresponds to the 32-bit variable auth in the stack. Once any bit of the variable is corrupted, its value will no longer be zero, and the conditional operator will determine that authentication has been successfully passed. Such verification patterns are quite common in applications and can be found in SUDO, OpenSSH, MySQL, and OpenSSL.
<\/center> <\/p>\n
The attack can also be applied to comparisons like \u2018if(auth == 1)\u2019, but in this case, executing it becomes more complicated as it requires altering not just any bit out of 32, but the last bit. This method can also be used to influence variable values in processor registers, as the contents of registers may be temporarily dumped into the stack during context switching, function calls, or signal handlers. During the time the register values are in memory, one can inject distortions into this memory, and the altered value will be restored in the register.
<\/center> <\/p>\n
The bit distortion uses a modification of the RowHammer attack class. Since DRAM memory consists of a two-dimensional array of cells, each made up of a capacitor and a transistor, continuously reading the same area of memory causes voltage fluctuations and anomalies that lead to a slight loss of charge in neighboring cells. If the read intensity is high, a neighboring cell may lose a significant amount of charge, and the next refresh cycle may not restore its original state, resulting in a change to the data stored in that cell. To protect against RowHammer, chip manufacturers have added a Target Row Refresh (TRR) mechanism, which blocks cell distortion in specific cases but does not safeguard against all potential attack variants. <\/p>\n
To protect against the Mayhem attack, it is recommended to use checks for matches rather than assessing differences from zero or matches with one, utilizing a random seed with non-zero octets. In this case, to set the desired variable value, it is necessary to distort a significant number of bits precisely, which is unrealistic, unlike distorting a single bit. Example of non-vulnerable code: int auth = 0xbe406d1a; \u2026 \/\/ verification code that sets the auth value to 0x23ab8701 upon successful authentication if(auth == 0x23ab8701) return AUTH_SUCCESS; else return AUTH_FAILURE; <\/p>\n
![\"Mayhem](\"\/wp-content\/uploads\/2023\/12\/ef5dd9463837514f055f9f2610652fb9.png\")
<\/center> <\/p>\n![\"Mayhem](\"\/wp-content\/uploads\/2023\/12\/089c4ea98448b638ba630e55821fc32f.png\")
<\/center> <\/p>\n