Nethammer allows rowhammer bug to be exploited over the network

Following a first network-based Rowhammer attack, some of the attackers involved in the Meltdown / Specter discovery have shown a second network-based remote Rowhammer technique, which can be used to attack systems using unsaved memory in cache, or flush instructions at the same time that it processes network requests.

The Nethammer technique allows you to exploit the Rowhammer vulnerability without the need to enter code

With a gigabit connection to the victim, researchers believe they can induce security-critical bit jumps by using quality of service packets. Meltdown and Specter veterans Daniel Gruss, Moritz Lipp and Michael Schwarz of Graz University of Technology and their team have published an article describing Nethammer.

Nethammer works without any code on the attacker-controlled target, attacking systems that use uncached memory or flush instructions when handling network requests. A quick summary of Rowhammer helps understand how it works: quickly writing and rewriting memory, induces DRAM capacitor errors, and the resulting data corruption can be manipulated to gain control over the victim's machine.

We recommend reading our post on Best routers on the market 2018

In its original form, Rowhammer allowed an attacker to increase their kernel-level privilege, but needed access to the victim machine. Nethammer mounts remote attacks by exploiting the memory used for packet processing, if it can send enough. Nethammer sends an elaborate sequence of network packets to the target device to mount a single-sided or single-sided Rowhammer attack exploiting the quality of service technologies implemented in the device.

For each packet received on the destination device, a set of addresses is accessed, either in the kernel driver or in a user-space application that processes the contents. Under normal circumstances, caching would make an attack more difficult, so the Graz team figured out how to bypass the cache and send their attacks directly to DRAM to cause the required conflicts.

The best mitigation is to have systems that defend network connections against traffic spikes, because an attacker must fire many packets at the target.

Thehackernews font