一句话：提出 DRAM 单元类型感知的内存分配，通过为页表指针建立单调性，抵御基于页表的 RowHammer 提权攻击。
RowHammer 可通过位翻转绕过内存保护并提权，页表是其主要目标。本文利用物理 DRAM 单元的不对称性：true-cell 漏电导致 1→0 错误，anti-cell 则 0→1。作者仅修改 18 行 OS 内存分配器代码，实现单元类型感知分配，使同一对象只使用一种单元，获得单调性并限制错误方向。将该属性用于页表指针后，页表被放在低水位线以上的 true-cell 中。基于既有 RowHammer 位翻转统计，作者证明方案可靠且完备：仅约 2.04×10^5 个系统中 1 个仍脆弱，脆弱系统预期攻击时间为 231 天；Linux 内核原型表明该跨层方案避免了能耗、硬件改动、性能开销和软件复杂度。
We identify an important asymmetry in physical DRAM cells that can be utilized to prevent RowHammer attacks by adding 18 lines of code to modify the OS memory allocator. Our small modification has a powerful impact on RowHammer's ability to bypass memory protection mechanisms and achieve a successful attack. Specifically, we identify two types of DRAM cells: true-cells and anti-cells. In a true-cell, a leaking capacitor will induce a '1'->'0' error, while in anti-cells, errors flow from '0'->'1'. We then create DRAM cell-type-aware memory allocation which enables a "monotonicity property" for a given data object. The monotonicity property is able to counter RowHammer attacks (and, to a broader extent, other memory attacks) by allocating only one type of cells for an object, thereby restricting error direction. We apply the monotonicity property to pointers in page tables by placing all page tables in true-cells that are above a "low water mark". We show that this approach successfully defends against page-table-based privilege escalation RowHammer attacks. Using established RowHammer-induced bit-flip error statistics, we provide proofs of the soundness and completeness of our technique and show that with our technique only one out of 2.04x10 5 systems is vulnerable to the attack, and the expected attack time on the vulnerable system is 231 days. We also provide application performance results from prototypes implemented through modifications to Linux kernels. Our cross-layer approach avoids undesirable energy cost, hardware changes, performance overhead, and high software complexity associated with prior countermeasures.
DOI 原文 ·
@inproceedings{paperbot4842,
title = {Protecting Page Tables from RowHammer Attacks using Monotonic Pointers in DRAM True-Cells},
author = {Xin-Chuan Wu and Timothy Sherwood and Frederic T. Chong and Yanjing Li},
booktitle = {ASPLOS},
year = {2019},
doi = {10.1145/3297858.3304039}
}