Remote Rowhammer DRAM Attacks

Several variants of the Rowhammer dynamic random access memory (DRAM) attack have been identified by a two independent groups of researchers.

Threat ID:: CC-2384
Category:: Exploit
Threat Severity:: Medium
Threat Vector:
Published:: 15 May 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Several variants of the Rowhammer dynamic random access memory (DRAM) attack have been identified by a two independent groups of researchers.

Threat details

Both variants, known as Throwhammer and Nethammer respectively, can be performed by an attacker targeting RDMA high-speed network interface cards (NICs).

Random direct memory access (RDMA) is a technology that allows one device to directly access another device's memory; without involving the second device's CPU, cache or other resources. This allows for high bandwidth, low latency data transfer and manipulation between hosts, with RDMA-enabled NICs commonly deployed in high performance computing (HPC), cloud computing and big data installations. Applications that wish to access another device's memory will designate a buffer on that device's NIC.

Both attacks register an overly large buffer on the target device NIC before rapidly submitting an excessive number of data requests to designated buffer locations. This results in specific DRAM cells flipping in a similar way to previous Rowhammer or Flip Feng Shui attacks.

Due to the nature of Rowhammer DRAM attacks, with millions of memory calls required per second, remote variants can only feasibly be performed on high-speed (10Gbps and up) networks.

For further information:

Remediation steps

Type	Step
	At the time of publication most major operating system vendors have produced updates to mitigate the effects of Rowhammer-type attacks; users are encouraged to apply these updates immediately. The researchers have also produced a custom RDMA memory allocator known as ALIS that they claim will prevent Throwhammer. Users are advised that they use this solution at their own risk.

Last edited: 17 February 2020 12:53 pm