Security Researchers Demo New Rowhammer Exploit That Cracks Modern System RAM And Steals Data
A group of researchers from ETH Zurich and Vrije University in Amsterdam indicate that the series of Target Row Refresh (TRR) mitigations that were put in place after Rowhammer was first discovered have been bypassed. With RowHammer, an attack is perpetrated by "hammering" away at a single "row" of memory cells in a module until a bit-flip occurs in an adjacent row. This can cause the value of the data in the bits to change from 1 to 0 (or 0 to 1), leading to memory corruption or even denial of service attacks on a target system.
Although we don't know all of the specifics of what mitigations procedures are implemented in TRR -- other than that it is actually a collection of different security solutions rather than a solitary fix -- the researchers say that have built a "scalable blackbox RowHammer fuzzier" that they call TRRespass to carry RowHammer-style attacks.
"TRRespass shows that even the latest generation DDR4 systems with in-DRAM TRR, immune to all known RowHammer attacks, are often still vulnerable to new TRR-aware variants of RowHammer that we develop," writes the research team. "In particular, TRRespass finds that, on present-day DDR4 modules, RowHammer is still possible when many aggressor rows are used (even 19 in some cases), in a configuration we generally refer to as Many-sided RowHammer."
The team says that it tested 43 contemporary DIMM modules to see if they were susceptible to TRRespass; 13 DIMMs could be compromised using the attack. Those vulnerable DIMMs were produced by Samsung, Hynix, and Micron, which produce the vast majority of memory chips used in DIMMs available for today's consumer and enterprise systems. Despite the fact that over two dozen modules were unfazed by the testing, the researchers caution "This does not mean that they are safe. [Finding] the right hammering pattern could be just a matter of time for our fuzzer or we may need additional parameters to improve the fuzzing strategy."
But the researchers didn't stop there; they also decided to use their TRRespass tool on LPDDR4X memory modules installed in 13 popular smartphones. Of the 13 phones tested, 5 -- including the Google Pixel 3, LG G7 ThinQ, and OnePlus 7 -- fell victim to the TRRespass tool.
The results of the new TRRespass testing were revealed to hardware makers in November 2019 (CVE2020-10255), however, these are security exploits that are present at the hardware level. That means that we won't likely see "fully patched" modules until vendor can implement design changes at the hardware-level in future production.
