27 ms·
How is it a write-only attack vector?
by SnowflakeOnIce 1y ago
How is it a write-only attack vector?
- privatelypublic 1y agoRowhammer allows you to corrupt/alter memory physically adjacent to memory you have access to. It doesn't let you read the memory you're attacking. There's PoC's of corrupting memory _that the kernel uses to decide what that process can access_ but the process can't read that memory. It only knows that the kernel says yes where it used to say no. (Assuming it doesn't crash the whole machine first)
- SnowflakeOnIce 1y agoSuppose you have access to certain memory. If you repeatedly read from that memory, can't you still corrupt/alter the physically adjacent memory you don't have access to? Does it really need to be a write operation you repeatedly perform?
- privatelypublic 1y agoI probably should have called it "blind" instead.
- extraduder_ire 1y ago> Does it really need to be a write operation you repeatedly perform? Yes. The core of rowhammer attacks is in changing the values in RAM repeatedly, creating a magnetic field, which induces a change in the state of nearby cells of memory. Reading memory doesn't do that as far as I know.