New ZenHammer Attack Bypasses Rowhammer Defenses on AMD CPUs

Cybersecurity scientists from ETH Zurich have designed a new variant of the RowHammer DRAM (dynamic random-entry memory) attack that, for the very first time, properly operates versus AMD Zen 2 and Zen 3 systems despite mitigations these types of as Target Row Refresh (TRR).

“This outcome proves that AMD systems are equally susceptible to Rowhammer as Intel programs, which considerably improves the attack surface area, contemplating present day AMD marketplace share of all-around 36% on x86 desktop CPUs,” the scientists explained.

The technique has been codenamed ZenHammer, which can also set off RowHammer little bit flips on DDR5 units for the to start with time.

RowHammer, to start with publicly disclosed in 2014, is a well-identified attack that exploits DRAM’s memory cell architecture to change information by frequently accessing a certain row (aka hammering) to bring about the electrical cost of a mobile to leak to adjacent cells.

This can induce random little bit flips in neighboring memory rows (from to 1, or vice versa), which can change the memory contents and likely facilitate privilege escalation, compromising method qualifications, integrity, and availability of a program.

The attacks consider edge of the actual physical proximity of these cells inside of the memory array, a dilemma that is possible to worsen as the DRAM technology scaling continues and the storage density will increase.

“As DRAM proceeds to scale, RowHammer little bit flips can take place at smaller activation counts and thus a benign workload’s DRAM row activation fees can strategy or even exceed the RowHammer threshold,” ETH Zurich scientists observed in a paper printed in November 2022.

“Thus, a procedure might knowledge little bit flips or routinely bring about RowHammer defense mechanisms even without having a destructive bash carrying out a RowHammer attack in the system, major to details corruption or considerable effectiveness degradation.”

Just one of the crucial mitigations carried out by DRAM brands versus RowHammer is TRR, which is an umbrella term employed for mechanisms that refresh target rows that are determined to be accessed commonly.

In doing so, the thought is to generate extra memory refresh operations so that target rows will both be refreshed prior to bits are flipped or be corrected soon after bits are flipped because of to RowHammer attacks.

ZenHammer, like TRRespass and SMASH, bypasses TRR guardrails by reverse engineering the mystery DRAM handle features in AMD methods and adopting enhanced refresh synchronization and scheduling of flushing and fencing guidance to induce little bit flips on 7 out of 10 sample Zen 2 units and 6 out of 10 Zen 3 gadgets.

The review also arrived at an optimal hammering instruction sequence to make improvements to row activation premiums in get to aid a lot more efficient hammering.

“Our results showed that standard masses (MOV) with CLFLUSHOPT for flushing aggressors from the cache, issued instantly after accessing an aggressor (‘scatter’ type), is ideal,” the scientists stated.

ZenHammer has the distinction of getting the really to start with process that can induce little bit flips on devices outfitted with DDR5 chips on AMD’s Zen 4 microarchitectural platform. That said, it only works on a person of the 10 tested equipment (Ryzen 7 7700X).

It’s really worth noting that DDR5 DRAM modules had been beforehand regarded immune to RowHammer attacks owing to them changing TRR with a new sort of security named refresh management.

“The changes in DDR5 this sort of as enhanced RowHammer mitigations, on-die mistake correction code (ECC), and a larger refresh level (32 ms) make it more durable to set off little bit flip,” the scientists claimed.

“Given the lack of bit flips on nine of 10 DDR5 gadgets, far more get the job done is needed to improved realize the perhaps new RowHammer mitigations and their security ensures.”

AMD, in a security bulletin, stated it’s examining RowHammer little bit flips on DDR5 gadgets, and that it will provide an update next its completion.

“AMD microprocessor products contain memory controllers built to meet up with business-regular DDR requirements,” it added. “Susceptibility to RowHammer assaults differs centered on the DRAM system, vendor, technology, and procedure configurations.”

Located this article fascinating? Abide by us on Twitter  and LinkedIn to study a lot more special information we post.

Some parts of this article are sourced from:
thehackernews.com