Flip Feng Shui: Hammering a Needle in the Software Stack
summary
A new exploitation vector uses Rowhammer plus kernel same-page merging (KSM) to induce single-bit flips at arbitrary physical addresses by forcing the victim to share a known page; an attacker VM can reliably flip one bit in a co‑hosted VM if the page contents are known. The authors implement end‑to‑end attacks that forge OpenSSH private keys and GPG signatures to compromise apt updates, with ~84% success on first runs, median completion ~6–12 minutes, and >95% after retries. Practical mitigation is to disable memory deduplication on hosts with untrusted tenants.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:40Teaser
- 1:32Contribution
- 2:40Outline
- 3:20Flip Feng Shui Flip one bit per page in a co-hosted victim VM
- 5:02Flip Feng Shui Mechanics
- 7:38Rowhammer Causes charge to leak in DRAM DRAM row activations cause flips
- 10:26RSA
- 13:08authorized keys file
- 14:05OpenSSH FFS attack
- 14:53OpenSSH Attack
- 15:30GPG/APT Updates
- 21:09Notification Notified: Red Hat, Oracle, Xen, VMware, Debian, Ubuntu, OpenSSH, GnuPG, some hosting companies Thank you NCSC
- 22:21Conclusion
related talks
34mLeapFrog: The Rowhammer Instruction Skip Attack
51mExploiting Hardware Glitches And Side Channels In Perfect Software
40mRowhammer Attacks: A Walkthrough Guide
15mPosthammer: Pervasive Browser-based Rowhammer Attacks with Postponed...
40mWinter is Coming Back
29mCAn’t Touch This...
28mComplexity Killed Security
38mCSI:Rowhammer: Closing the Case of Half-Double and Beyond