One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
summary
Paper shows a practical cross-VM exploit that uses double-sided row hammer after reverse-engineering DRAM physical-address mapping via a timing channel and a graph-based bit detector, identifies flippable bits in PMD entries, and then flips one bit to forge a last-level page table so a paravirtualized Xen guest gains arbitrary machine-page access. Demonstrated exploit edits OpenSSH code in-place to bypass authentication; locating code on the first 4KB takes ~0.3s and each extra page costs ~58 μs. Works on PV clouds; ECC/DDR4 and HVM raise cost but do not fully eliminate risk.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:09Row Hammer Vulnerabilities and Exploits
- 1:33DRAM Architecture
- 2:31Row Buffer and Row Activation
- 3:06Disturbance Errors (1)
- 5:14Outline
- 5:52Difficulties in Double-sided Row Hammer Physical Address
- 8:12Row Bit Detection
- 8:51Column Bit Detection
- 9:43Row/Column Bit Summary
- 10:15XOR Scheme Detection (3)
- 12:35Graph-based Bit Detection Algorithm
- 13:12Virtualization and Cloud Computing
- 13:31Xen Para-Virtualized instances in Real-world Public Clouds
- 13:44Xen Para-Virtualized Memory Management
- 14:30Page Table Management Virtual address PGD offset PUD offset PMD offset PTE offset Page offset
- 15:12Xen PV memory management
- 15:38Page Table Replacement Attack (3)
- 18:27OpenSSH Server Authentication Bypass
- 18:51OpenSSH Server: Attack Target
- 19:49OpenSSH Authentication Bypass (3)
- 22:32Conclusion
- 23:16Existing Countermeasures
related talks
51mExploiting Hardware Glitches And Side Channels In Perfect Software
40mRowhammer Attacks: A Walkthrough Guide
28mComplexity Killed Security
53mXenpwn: Breaking Paravirtualized Devices
34mLeapFrog: The Rowhammer Instruction Skip Attack
15mPosthammer: Pervasive Browser-based Rowhammer Attacks with Postponed...
29mCAn’t Touch This...
38mCSI:Rowhammer: Closing the Case of Half-Double and Beyond