.png){kind=icon}
返回
Implicit Hammer: Cross-Privilege-Boundary Rowhammer Through Implicit Accesses
.png){kind=icon}
PRE
AI
DOI：10.1109/TDSC.2022.3214666.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Rowhammer is a hardware vulnerability in DRAM memory, where repeated access to hammer rows can induce bit flips in neighboring victim rows. Rowhammer attacks have enabled privilege escalation, sandbox escape, cryptographic key disclosures, etc. A key requirement of all existing rowhammer attacks is that an attacker must have access to at least part of an exploitable hammer row. We term such rowhammer attacks as Explicit Hammer. Recently, several proposals leverage the spatial proximity between the accessed hammer rows and the location of the victim rows for a defense against rowhammer. These all aim to deny the attacker's permission to access hammer rows near sensitive data, thus defeating explicit hammer-based attacks. In this paper, we question the core assumption underlying these defenses. We present Implicit Hammer, a confused-deputy attack that causes accesses to hammer rows that the attacker is not allowed to access. It is a paradigm shift in rowhammer attacks since it crosses privilege boundary to stealthily rowhammer an inaccessible row by implicit DRAM accesses. Such accesses are achieved by abusing inherent features of modern hardware and/or software. We propose a generic model to rigorously formalize the necessary conditions to initiate implicit hammer and explicit hammer, respectively. Compared to explicit hammer, implicit hammer can defeat the advanced software-only defenses, stealthy in hiding itself and hard to be mitigated. To demonstrate the practicality of implicit hammer, we have created two implicit hammer's instances, called PThammer and SyscallHammer.
Keyword:
Random access memory
Kernel
Hardware
Program processors
Software
Microarchitecture
Memory management
Rowhammer
DRAM
cross-privilege-boundary
page table walk
system call handler
期刊
IF:
7.5
论文数:
2.5K
被引数:
9.6K
机构
引用论文
A novel exon generates ubiquitously expressed alternatively spliced new transcript of mouse Abcc4 gene.png)
Gene
GeneIF0
PREAI
分享收藏Protocatechuate 3,4-dioxygenase: comparative study of inhibition and active-site interactions of pyridine N-oxidesBiochemistry
BiochemistryIF0
PREAI
分享收藏
ENZYME ACTIVITY IN EMS-INDUCED NULL MUTATIONS OF DUPLICATED GENES ENCODING PHOSPHOGLUCOSE ISOMERASES IN CLARKIAGenetics
OAAI
GeneticsIF0
OAAI分享收藏Comparative study between pulsed and continuous wave lasers for Photofrin® photodynamic therapy
PREAI
分享收藏
查看更多内容