2024-12-30 –, Saal 1
Language: English
The density of memory cells in modern DRAM is so high that disturbance errors, like the Rowhammer effect, have become quite frequent. An attacker can exploit Rowhammer to flip bits in inaccessible memory locations by reading the contents of nearby accessible memory rows. Since its discovery in 2014, we have seen a cat-and-mouse security game with a continuous stream of new attacks and new defenses. Now, in 2024, exactly 10 years after Rowhammer was discovered, it is time to look back and reflect on the progress we have made and give an outlook on the future. Additionally, we will present an open-source framework to check if your system is vulnerable to Rowhammer.
In 2014, Kim et al. reported a new disturbance effect in modern DRAM that they called Rowhammer.
The Rowhammer effect flips bits in inaccessible memory locations just by reading the content of nearby memory locations that are attacker-accessible.
They trigger the Rowhammer effect by accessing memory locations at a high frequency, using memory accesses and flushes.
The root problem behind Rowhammer is the continuous increase in cell density in modern DRAM.
In early 2015, Seaborn and Dullien were the first to demonstrate the security impact of this new disturbance effect.
In two different exploit variants, they demonstrated privilege escalation from the Google Chrome NaCl sandbox to native code execution and from unprivileged native code execution to kernel privileges.
Later, in 2015, Gruss et al. demonstrated that this effect can even be triggered from JavaScript, which they presented in their talk "Rowhammer.js: Root privileges for web apps?" at 32C3.
Now, in 2024, it is precisely 10 years after Rowhammer was discovered.
Thus, we believe it is time to look back and reflect on the progress we have made.
We have seen a seemingly endless cat-and-mouse security game with a constant stream of new attacks and new defenses.
We will discuss the milestone works throughout the last 10 years, including various mitigations (making certain instructions illegal, ECC, doubled-refresh rate, pTRR, TRR) and how they have been bypassed.
We show that new Rowhammer attacks pushed the boundaries further with each defense and challenge. While initial attacks required native code on Intel x86 with DDR3 memory, subsequent attacks have also been demonstrated on DDR4 and, more recently, DDR5. Attacks have also been demonstrated on mobile Arm processors and AMD x86 desktop processors. Furthermore, instead of native code, attacks from sandboxed JavaScript or even remote attacks via network have been demonstrated as well.
Furthermore, we will discuss how the Rowhammer effect can be used to leak memory directly, as well as related effects such as Rowpress. We will discuss these research results and show how they are connected.
We will then talk about the lessons learned and derive areas around the Rowhammer effect that have not received sufficient attention yet.
We will outline what the future of DRAM disturbance effects may look like, covering more recent effects and trends in computer systems and DRAM technology.
Finally, an important aspect of our talk is that we invite everyone to contribute to solving one of the biggest unanswered questions about Rowhammer:
What is the real-world prevalence of the Rowhammer effect? How many systems, in their current configurations, are vulnerable to Rowhammer?
As large-scale studies with hundreds to thousands of systems are not easy to perform, such a study has not yet been performed. Therefore, we developed a new framework to check if your system is vulnerable to Rowhammer, incorporating the state-of-the-art Rowhammer techniques and tools.
Thus, we invite everyone to participate in this unique opportunity at 38C3 to join forces and close this research gap together.
Daniel Gruss (@lavados) is a Professor at Graz University of Technology. He has been teaching undergraduate courses since 2010. Daniel's research focuses on side channels and transient execution attacks. He implemented the first remote fault attack running in a website, known as Rowhammer.js. His research team was one of the teams that found the Meltdown and Spectre bugs published in early 2018. In 2023, he received an ERC Starting Grant to research the sustainability of security. He frequently speaks at top international venues.
Martin Heckel is a research associate and PhD student at Hof University of Applied Sciences and Graz University of Technology.
He started to perform research related on Rowhammer during his Bachelor Thesis in 2021 and has continued his research in this field afterwards.
Florian Adamsky attended the first Chaos Communication Congress in 2000 (17C3). He co-founded Chaostreff Regensburg at some point, before becoming immersed in academia, from which he has not found his way out. As a result, he has been serving as a professor of IT security at Hof University of Applied Sciences since 2019. In 2020, he established his own small research group called System and Network Security (SNS), which focuses on phishing, anonymity networks, and hardware-based side-channel attacks, such as Rowhammer.