Rambleed: A New Rowhammer Style Memory Attack

On 11 June 2019, a group of academic researchers published a website dubbed Rambleed. Rambleed is a side-channel attack technique that enables attackers to read physical memory of other processes. The attack is related to Rowhammer, which was first published in 2014, which takes advantage of flipping bits in DRAM of other processes. Unlike Rowhammer, which wrote bits to memory of processes that the current process did not own, Rambleed reads bits flipped by Rowhammer to deduce values of adjacent memory cells, thus violating process isolation boundaries.

Recommendations

• Enable the Cyber Attack Chatter rule to monitor for any Rambleed (CVE-2019-0174) related traffic on social and dark web channels
• Upgrade RAM to DDR4 with targeted row refresh (TRR) enabled

Details

This vulnerability is an expansion on the memory integrity issue of RAM as shown by the initial Rowhammer attack. By manipulating bits written into RAM, cells that hold one type of charge (bit flip off, for example) will have a higher probability of bits having an opposite charge in cells above and below it. The researchers developed "novel memory massaging" techniques that carefully place victim's secret data (such as an SSH key) in rows above and below the attacker controlled memory space, thus recovering secrets while bypassing operating system level process boundaries. According to the researchers, it took about four hours to read out enough of 2048-bit RSA encryption key, which they then recovered the rest using the Heninger-Shacham algorithm.