Projekte pro Jahr
Abstract
Modern DRAM is susceptible to fault attacks that undermine the entire system’s security. The most well-studied disturbance effect is Rowhammer, where an attacker repeatedly opens and closes (i.e., hammers) different rows, which can lead to bitflips in adjacent rows. Different hammering strategies include double-sided, hammering two rows sandwiching a victim row, and one-location, hammering a single row. One-location Rowhammer requires no physical address information, as any location in memory is mapped to a DRAM row, and no relation between rows is required for hammering. The recently discovered Rowpress differs from Rowhammer by not hammering rows but keeping them open longer, evident by a disjoint set of affected memory locations. In this paper, we examine the differences between four attack variants: one-location Rowhammer, a one-location Rowpress variant we developed, double-sided Rowhammer, and double-sided Rowpress on a set of 12 DDR4 modules. Our methodology is to hammer and press the exact same set of physical memory locations in all attack variants. Surprisingly, our results show that on 4 out of 12 DDR4 modules, we were only able to reproduce double-sided Rowhammer but none of the other attack variants. On 2 DDR4 modules, we were able to reproduce all attack variants. We find that the number of unique bitflip locations ranges from 161 to 15 612, when hammering the exact same set of physical memory locations. Our one-location Rowhammer attack induces roughly the same amount of bitflips as double-sided Rowhammer, however, only 61.8 % of bitflip locations overlap. We explain this by one-location Rowhammer inducing bitflips due to the Rowhammer as well as the Rowpress effect, making the differentiation of both methods difficult, therefore, calling it Presshammer. Based on our observed bitflips, we develop the first end-to-end one-location Rowpress attack. One-location Rowpress requires only minimal physical address information that an attacker can acquire through a same-row same-bank side-channel attack. Our end-to-end attack escalates to kernel privileges within less than 10 min.
Originalsprache | englisch |
---|---|
Titel | Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings |
Redakteure/-innen | Federico Maggi, Manuel Egele, Mathias Payer, Michele Carminati |
Herausgeber (Verlag) | Springer, Cham |
Seiten | 460–479 |
Seitenumfang | 20 |
ISBN (elektronisch) | 978-3-031-64171-8 |
ISBN (Print) | 978-3-031-64170-1 |
DOIs | |
Publikationsstatus | Veröffentlicht - 2024 |
Veranstaltung | 21st Conference on Detection of Intrusions and Malware & Vulnerability Assessment: DIMVA 2024 - EPFL, Lausanne, Schweiz Dauer: 17 Juli 2024 → 19 Juli 2024 https://www.dimva.org/dimva2024/ |
Publikationsreihe
Name | Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) |
---|---|
Band | 14828 LNCS |
ISSN (Print) | 0302-9743 |
ISSN (elektronisch) | 1611-3349 |
Konferenz
Konferenz | 21st Conference on Detection of Intrusions and Malware & Vulnerability Assessment |
---|---|
Kurztitel | DIMVA 2024 |
Land/Gebiet | Schweiz |
Ort | Lausanne |
Zeitraum | 17/07/24 → 19/07/24 |
Internetadresse |
ASJC Scopus subject areas
- Theoretische Informatik
- Allgemeine Computerwissenschaft
Fields of Expertise
- Information, Communication & Computing
Fingerprint
Untersuchen Sie die Forschungsthemen von „Presshammer: Rowhammer and Rowpress without Physical Address Information“. Zusammen bilden sie einen einzigartigen Fingerprint.Projekte
- 2 Laufend
-
EU - FSSec - Grundlagen für nachhaltige Sicherheit
Gruss, D. (Teilnehmer (Co-Investigator))
1/03/23 → 29/02/28
Projekt: Forschungsprojekt
-
Spezialforschungsbereich (SFB) F85 Semantische und kryptographische Grundlagen von Sicherheit und Datenschutz durch Compositional Design
Mangard, S. (Teilnehmer (Co-Investigator))
1/01/23 → 31/12/26
Projekt: Forschungsprojekt
-
Exploiting RowPress and RowHammer and How To Defend Against It
Juffinger, J. (Redner/in)
16 Juli 2024Aktivität: Vortrag oder Präsentation › Vortrag bei Workshop, Seminar oder Kurs › Science to science
-
Presshammer: Rowhammer and Rowpress without Physical Address Information
Juffinger, J. (Redner/in)
19 Juli 2024Aktivität: Vortrag oder Präsentation › Vortrag bei Konferenz oder Fachtagung › Science to science