One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation
One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation
复制标题
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Yuan Xiao;Xiaokuan Zhang;Yinqian Zhang;R. Teodorescu
中科院分区：
文献类型：
--
作者：
Yuan Xiao;Xiaokuan Zhang;Yinqian Zhang;R. Teodorescu
行锤攻击利用高密度动态随机存取存储器(DRAM)中相邻存储单元之间的电学相互作用来诱导存储错误。通过快速重复访问具有特定模式的DRAM，在目标机器上具有有限权限的攻击者可能会在他无权直接访问的内存区域中触发位翻转。在本文中，我们研究了跨虚拟机环境下的行锤攻击，其中恶意的虚拟机利用行锤攻击引起的位翻转来破解由虚拟化强制实施的内存隔离。为了实现高保真，我们开发了在运行时确定DRAM模块中的物理地址映射的新技术(以提高双面行锤攻击的有效性)、从来宾VM穷举大部分物理内存的方法(以收集可利用的易受攻击的位)，以及打破Xen半虚拟内存隔离的创新方法(以访问共享计算机的任意物理内存)。我们的研究还表明，演示的行锤攻击适用于采用Xen半虚拟化技术的现代公共云。由此可见，本文提出的跨VM排锤攻击具有重要的实用价值。
Row hammer attacks exploit electrical interactions between neighboring memory cells in high-density dynamic random-access memory (DRAM) to induce memory errors. By rapidly and repeatedly accessing DRAMs with specific patterns, an adversary with limited privilege on the target machine may trigger bit flips in memory regions that he has no permission to access directly. In this paper, we explore row hammer attacks in cross-VM settings, in which a malicious VM exploits bit flips induced by row hammer attacks to crack memory isolation enforced by virtualization. To do so with high fidelity, we develop novel techniques to determine the physical address mapping in DRAMmodules at runtime (to improve the effectiveness of double-sided row hammer attacks), methods to exhaustively hammer a large fraction of physical memory from a guest VM (to collect exploitable vulnerable bits), and innovative approaches to break Xen paravirtualized memory isolation (to access arbitrary physical memory of the shared machine). Our study also suggests that the demonstrated row hammer attacks are applicable in modern public clouds where Xen paravirtualization technology is adopted. This shows that the presented cross-VM row hammer attacks are of practical importance.