Rowhammer, the attack that flips your bits
Oct 7th, 2021 by Jesper Kråkhede
Time for an unusually technical post. Let´s talk about Rowhammer.
Your computer´s memory, DRAM, stores bits as tiny electrical charges in cells arranged in rows. As the chips have become denser, the cells have moved closer together. So close that if you read the same row over and over again, very fast, the electrical disturbance can make bits flip in the neighbouring rows. That is Rowhammer.
Why is that a security problem? Because a flipped bit in the wrong place can change a permission, a pointer or a page table entry. Researchers showed years ago that it could be used to escape a sandbox and take full control of a machine, without any software vulnerability at all.
The memory manufacturers added protections inside the chips that try to detect rows being hammered and refresh their neighbours. For a while it looked like the problem was solved. Then in May this year Google published a technique called Half-Double, which hammers a row two steps away instead of right next to the victim. The protections only looked at the closest neighbours, so they missed it.
What can you do? Honestly, not much yourself. Use ECC memory in servers, keep firmware updated and follow what the hardware vendors recommend.
The main lesson is that security goes all the way down to the physics of the silicon.