When good protections go bad: Exploiting anti-DoS measures to accelerate rowhammer attacks
When good protections go bad: Exploiting anti-DoS measures to accelerate rowhammer attacks
复制标题
当良好的保护措施变坏时：利用反 DoS 措施加速 rowhammer 攻击
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
T. Austin
中科院分区：
文献类型：
--
作者：
Misiker Tadesse Aga;Zelalem Birhanu Aweke;T. Austin
Rowhammer漏洞，即重复访问DRAM行可以加快邻近比特的释放速度，已成为计算机行业的一个重大安全问题。为了解决这个问题，计算机和软件供应商：i)将DRAM刷新率提高了一倍，ii)限制了对虚拟到物理页面映射的访问，以及iii)禁用了对沙箱环境中的高速缓存刷新操作的访问。虽然最近的努力已经展示了如何单独克服这些保护措施，但如果今天的机器同时使用这三种保护措施，它们就可以免受强盗的攻击。在这篇文章中，我们演示了第一个Rowhmer攻击，当串联使用时，它克服了所有这三个保护。我们的攻击是一种基于虚拟内存的无缓存刷新攻击，其速度足够快，可以使用双倍刷新速率进行攻击。我们的攻击最令人惊讶的方面是，它是由最近推出的缓存分配技术实现的，该机制在一定程度上旨在保护虚拟机免受VM间拒绝服务攻击。这篇论文的潜台词提出了这样一个问题：“当对一种攻击的保护启用另一种攻击时，系统安全还有希望吗？”我们声称，这个难题的解决方案在于采取保护系统的方法。与附加措施相比，采用减法来保护系统，可能会在建立可证明安全的系统方面大有裨益。
The rowhammer vulnerability, where repeated accesses to a DRAM row can speed the discharge of neighboring bits, has emerged as a significant security concern in the computing industry. To address the problem, computer and software vendors have: i) doubled DRAM refresh rates, ii) restricted access to virtual-to-physical page mappings, and iii) disabled access to cache-flush operations in sandboxed environments. While recent efforts have shown how to overcome each of these protections individually, machines today are protected from rowhammer attacks if they employ all three of these protections simultaneously. In this paper, we demonstrate the first rowhammer attack that overcomes all three of these protections when used in tandem. Our attack is a virtual-memory based cache-flush free attack that is sufficiently fast to rowhammer with double rate refresh. The most astonishing aspect of our attack is that it is enabled by the recently introduced Cache Allocation Technology, a mechanism designed in part to protect virtual machines from inter-VM denial-of-service attacks. The subtext of this paper asks the question: “Is there any hope for system security, when the protections for one attack enable yet another?” We claim that the solution to this conundrum lies in the approach taken to protecting systems. Adopting a subtractive approach to secure systems, in contrast to additive measures, could go a long way toward building provably secure systems.