DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
复制标题
DRAMA：利用 DRAM 寻址进行跨 CPU 攻击
DOI：
--
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
S. Mangard
中科院分区：
文献类型：
--
作者：
P. Pessl;D. Gruss;Clémentine Maurice;Michael Schwarz;S. Mangard
在云计算环境中，多个租户通常位于同一个多处理器系统上。因此，防止租户之间的信息泄漏至关重要。虽然管理程序强制执行软件隔离，但共享硬件（如CPU缓存或内存总线）可能会泄露敏感信息。出于安全原因，通常禁用租户之间的共享内存。此外，租户通常不共享物理CPU。在此设置中，缓存攻击不起作用，并且只知道内存总线上的缓慢跨cpu隐蔽通道。相比之下，我们展示了一个高速隐蔽信道以及跨处理器且没有任何共享内存的第一个侧信道攻击。为了构建这些攻击，我们使用未记录的DRAM地址映射。
In cloud computing environments, multiple tenants are often co-located on the same multi-processor system. Thus, preventing information leakage between tenants is crucial. While the hypervisor enforces software isolation, shared hardware, such as the CPU cache or memory bus, can leak sensitive information. For security reasons, shared memory between tenants is typically disabled. Furthermore, tenants often do not share a physical CPU. In this setting, cache attacks do not work and only a slow cross-CPU covert channel over the memory bus is known. In contrast, we demonstrate a high-speed covert channel as well as the first side-channel attack working across processors and without any shared memory. To build these attacks, we use the undocumented DRAM address mappings.
We present two methods to reverse engineer the mapping of memory addresses to DRAM channels, ranks, and banks. One uses physical probing of the memory bus, the other runs entirely in software and is fully automated. Using this mapping, we introduce DRAMA attacks, a novel class of attacks that exploit the DRAM row buffer that is shared, even in multi-processor systems. Thus, our attacks work in the most restrictive environments. First, we build a covert channel with a capacity of up to 2 Mbps, which is three to four orders of magnitude faster than memory-bus-based channels. Second, we build a side-channel template attack that can automatically locate and monitor memory accesses. Third, we show how using the DRAM mappings improves existing attacks and in particular enables practical Rowhammer attacks on DDR4.
DOI：
--
发表时间：
2016
期刊：
--
影响因子：
--
作者：
Yuan Xiao;Xiaokuan Zhang;Yinqian Zhang;R. Teodorescu
通讯作者：
Yuan Xiao;Xiaokuan Zhang;Yinqian Zhang;R. Teodorescu