A new approach for rowhammer attacks
A new approach for rowhammer attacks
复制标题
行锤攻击的新方法
DOI：
10.1109/hst.2016.7495576
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Mark Seaborn
中科院分区：
文献类型：
--
作者：
Rui Qiao;Mark Seaborn
Rowhammer 是最近商用 DRAM 中发现的一个硬件错误：重复的行激活可能会导致相邻行中的位翻转。 Rowhammer 已被认为是一个可靠性和安全性问题。这是一个可以从硬件级别打破分层抽象和信任（在本例中为虚拟内存）的经典示例。以前的 rowhammer 攻击要么依赖于很少使用的特殊指令，要么依赖于复杂的内存访问模式。在本文中，我们提出了一种基于 x86 非临时指令的 rowhammer 新方法。这种方法绕过了现有的 rowhammer 防御，并且对于更具挑战性的任务的限制要少得多：远程 rowhammer 攻击，即使用现有的良性代码触发 rowhammer。此外，我们扩展了我们的方法，并将 libc memset 和 memcpy 函数识别为新的 rowhammer 原语。我们对行锤保护的讨论表明，了解这种新威胁对于能够进行深度防御至关重要。
Rowhammer is a hardware bug identified in recent commodity DRAMs: repeated row activations can cause bit flips in adjacent rows. Rowhammer has been recognized as both a reliability and security issue. And it is a classic example that layered abstractions and trust (in this case, virtual memory) can be broken from hardware level. Previous rowhammer attacks either rely on rarely used special instructions or complicated memory access patterns. In this paper, we propose a new approach for rowhammer that is based on x86 non-temporal instructions. This approach bypasses existing rowhammer defense and is much less constrained for a more challenging task: remote rowhammer attacks, i.e., triggering rowhammer with existing, benign code. Moreover, we extend our approach and identify libc memset and memcpy functions as a new rowhammer primitive. Our discussions on rowhammer protection suggest that it is critical to understand this new threat to be able to defend in depth.