Rowhammer Attacks: A Walkthrough Guide
summary
Walks through reproducible Rowhammer primitives, concrete tools and results: native double‑sided hammering and Rowhammer.js exploit JavaScript; DRAM reverse‑engineering code and row mapping on GitHub; measured 129 DIMMs with all but three vulnerable and Google’s 29 laptops half vulnerable; Haswell cache‑eviction strategy achieves 99.97% eviction rate so flushless attacks work; DDR4 initially appears safe but reverse engineering produces a first flip after 12 seconds. Demonstrations show page‑table and dedup exploits work, ECC and simple refresh increases prove insufficient.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 1:23DRAM
- 13:56How to target accesses
- 14:14How to perform accesses
- 15:12How to reverse engineer
- 16:32Demo
- 18:52How to exploit random bit clips
- 20:01How to escape from the sandbox
- 20:58Page table entries
- 21:40How are they used
- 22:50In a sec
- 23:47Strategy
- 24:22Post Exploitation
- 25:30Page to Application
- 26:07The Strategy
- 26:19The Big Change
- 27:13Mitigation
- 27:56Quick fixes
- 28:08Stop CF instruction
- 28:31Commit
- 29:05ECC
- 29:23Event Reporting
- 30:27Detection
- 32:25Para for probability
- 33:27Target Row Refresh
- 34:01NoHemic Random
- 35:23Interline
- 36:21Performance Culture
- 36:50Catch Paper
- 37:49Conclusion
- 39:08Links
- 39:56Contact
related talks
15mPosthammer: Pervasive Browser-based Rowhammer Attacks with Postponed...
29mCAn’t Touch This...
14mGPUHammer: Rowhammer Attacks on GPU Memories are Practical
38mCSI:Rowhammer: Closing the Case of Half-Double and Beyond
10mMcSee: Evaluating Advanced Rowhammer Attacks and Defenses via Automated...
16mECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
34mLeapFrog: The Rowhammer Instruction Skip Attack