TeleHammer：隐式Rowhammer的形式化模型
TeleHammer: A Formal Model of Implicit Rowhammer
摘要：
Rowhammer漏洞允许攻击者获得权限提升或窃取私人数据。所有现有的rowhammer攻击的一个关键要求是，攻击者必须能够访问可利用的hammer row的至少一部分。我们将这种Rowhammer攻击称为PeriHammer。针对PeriHammer攻击的最先进的纯软件防御是使可利用的锤子行超出攻击者的访问权限。在本文中，我们质疑上述要求的必要性，并提出了一类新的rowhammer攻击，称为TeleHammer。这是Rowhammer攻击中的一个范式转变，因为它跨越了特权边界，通过隐式DRAM访问悄悄地Rowhammer不可访问的行。这种访问是通过滥用现代硬件和/或软件的固有特征来实现的。我们提出了一个通用的模型，严格形式化的必要条件，启动TeleHammer和PeriHammer，分别。与PeriHammer相比，TeleHammer可以击败先进的纯软件防御，隐身隐藏本身，难以缓解。为了证明TeleHammer的实用性及其优势，我们创建了一个TeleHammer的实例，称为PThammer，它利用了现代处理器的地址转换功能。我们观察到，从用户空间的内存访问可以导致从内存加载一级页表条目（L1 PTE），从而锤击L1 PTE一次，尽管L1 PTE对我们来说是不可访问的。为了达到足够高的锤击频率，我们有效和高效地刷新相关的TLB和缓存。为此，我们在三个不同的测试机器上演示了PThammer，并表明它可以跨越用户内核边界，并在双侧PThammer的15分钟内诱导L1 PTE中的第一位翻转。我们已经利用PThammer在默认系统设置中击败了高级的纯软件Rowhammer防御。
英文摘要：
The rowhammer bug allows an attacker to gain privilege escalation or steal private data. A key requirement of all existing rowhammer attacks is that an attacker must have access to at least part of an exploitable hammer row. We refer to such rowhammer attacks as PeriHammer. The state-of-the-art software-only defenses against PeriHammer attacks is to make the exploitable hammer rows beyond the attacker's access permission. In this paper, we question the necessity of the above requirement and propose a new class of rowhammer attacks, termed as TeleHammer. It is a paradigm shift in rowhammer attacks since it crosses privilege boundary to stealthily rowhammer an inaccessible row by implicit DRAM accesses. Such accesses are achieved by abusing inherent features of modern hardware and or software. We propose a generic model to rigorously formalize the necessary conditions to initiate TeleHammer and PeriHammer, respectively. Compared to PeriHammer, TeleHammer can defeat the advanced software-only defenses, stealthy in hiding itself and hard to be mitigated. To demonstrate the practicality of TeleHammer and its advantages, we have created a TeleHammer's instance, called PThammer, which leverages the address-translation feature of modern processors. We observe that a memory access from user space can induce a load of a Level-1 page-table entry (L1PTE) from memory and thus hammer the L1PTE once, although L1PTE is not accessible to us. To achieve a high enough hammering frequency, we flush relevant TLB and cache effectively and efficiently. To this end, we demonstrate PThammer on three different test machines and show that it can cross user-kernel boundary and induce the first bit flips in L1PTEs within 15 minutes of double-sided PThammering. We have exploited PThammer to defeat advanced software-only rowhammer defenses in default system setting.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
