Posthammer: Pervasive Browser-based Rowhammer Attacks with Postponed...
summary
Posthammer implements a JavaScript Rowhammer that forces the memory controller to postpone refresh commands, uses lane eviction-set primitives to create fast non‑uniform hammer patterns, and combines allocator exhaustion plus eviction-set rotation to hammer DRAM from the browser. The prototype triggers exploitable bit flips that are turned into a type‑flip read/write primitive; evaluation reports it is 2.8× more effective than prior work and flips bits on 86% of 28 DDR4 DIMMs, with typical runs taking about 15 minutes and ~40% overall success.
AI-written summary · about
chapters (10)
- 0:00Posthammer research introduction
- 1:16Refresh command postponement
- 2:21Uniform vs non-uniform patterns
- 3:04Eviction sets and cache misses
- 5:54Minimal eviction sets
- 7:19Non-uniform patterns with lanes
- 8:41Generic patterns bypassing mitigations
- 10:32Exploit overview and type flipping
- 12:39Soft hammering and placement
- 14:27Conclusion and impact
related talks
40mRowhammer Attacks: A Walkthrough Guide
38mCSI:Rowhammer: Closing the Case of Half-Double and Beyond
29mCAn’t Touch This...
34mLeapFrog: The Rowhammer Instruction Skip Attack
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
28mFlip Feng Shui: Hammering a Needle in the Software Stack
51mExploiting Hardware Glitches And Side Channels In Perfect Software
25mDRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks