Back to threat feeds_510678f361%2FUntitled-design-(3)_Untitled_design_(3)_510678f361.png&w=3840&q=75)
Rowhammer
New Rowhammer attack variant dubbed as Half-Double by Google Security Researchers
Rowhammer attacks dubbed as “Half-Double,” which enables the bypassing of all current laid out defenses
Continue reading
Rowhammer attacks dubbed as “Half-Double,” which enables the bypassing of all current laid out defenses
Continue reading
A new variant of Rowhammer attacks dubbed as “Half-Double, ” which enables the bypassing of all current laid out defenses, was recently discovered by a group of security researchers at Google.
In 2015, Linux running Intel-compatible PCs vulnerable to hijack were exploited via physical flaws in certain varieties of DDR DRAM (double data rate dynamic random-access memory) chips demonstrated by security researchers at Google’s Project Zero team.
This physical technique was referred to as “rowhammer” exploited by the threat actors to gain higher kernel privileges on the targeted system.
Rowhammer flaw allowing to remember that a DDR memory is arranged in an array of rows and columns is also classified as a danger involving few of the recent DRAM devices spotted repeatedly accessing a row of memory can result in bit flips in adjacent rows, translating that theoretically, a threat actor can alter any value of the bit in the memory. <br> Here the memory blocks are assigned to various services and applications in order to prevent an application from accessing the memory space reserved by another application, and it carries out a “sandbox” protection mechanism. At the same time, bit flipping technique affected by the Rowhammer problems could be exploited to evade the sandbox. Target Row Refresh (TRR) arranged by vendors are a set of mitigations familiar to deter the row hammer effect without any negative impact on the performance or power consumption. <br> Security researchers in this newly discovered Half-Double attack demonstrated the possibility to conduct a Rowhammer attack that triggers bit flips at a distance of two rows from the hammered row rather than the pastoral one used in the last variants of the attack.
>“Traditionally, Rowhammer was understood to operate at a distance of one row: when a DRAM row is accessed repeatedly (the “aggressor”), bit flips were found only in the two adjacent rows (the “victims”).” reads the post published by Google. “However, with Half-Double, we have observed Rowhammer effects propagating to rows beyond adjacent neighbors, albeit at reduced strength. Given three consecutive rows A, B, and C, we were able to attack C by directing a huge number of accesses to A, along with just a handful (~dozens) to B.”
According to the experts, Half-Double is an intrinsic property of the underlying silicon substrate, and this implies the fact that the electrical coupling responsible for Rowhammer is a property of distance. <br> The RAM card's latest iteration is evolving, even more minor, which means that the distance between memory rows also reduces, leading it more accessible to trigger bit flipping from a more considerable distance. <br> Half-Double attacks aren't preventive by any security protections like TRR limiting only to prevent interferences between adjacent memory cells.
>"Unlike TRRespass, which exploits the blind spots of manufacturer-dependent defenses, Half-Double is an intrinsic property of the underlying silicon substrate.” concludes Google. “This is likely an indication that the electrical coupling responsible for Rowhammer is a property of distance, effectively becoming stronger and longer-ranged as cell geometries shrink down. Distances greater than two are conceivable.”
Google mentioned in a blog post that its security team is currently invested with several semiconductor industry players to search “possible solutions for the Rowhammer phenomenon, ” and encouraged fellow experts to join hands in their efforts, as “the challenge is substantial and the ramifications are industry-wide."
Hugging Face did not know at the time of its own disclosure who or what was behind the intrusion
