4 ms·

Can anyone ELI5 how a bad guy would use rowhammer to escalate privileges? As I understand it, it's just flipping random bits, wouldn't that have a very low cha

• detaro 5y ago
  Two things: a) you can test and map out the memory layout, so its not entirely random b) Often the system state can be manipulated in "safe" ways to increase the attack surface. E.g. you can cause the OS to fill lots of memory with a vulnerable data structure, like a page mapping, and at the same time reserve a lot of the memory (outside the area you want to target) yourself. This gives you a good chance something vulnerable will end up where you want it. Afaik the Project Zero blogpost or presentation about it had some detailed examples.
  • brokenmachine 5y ago
    Just read the Project Zero https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html https://googleprojectzero.blogspot.com/2015/03/exploiting-dr... It's really amazing to me that people can understand how a computer works to the level to be able to make that a viable attack. Very impressive.