Anders Fogh, principal malware analyst at G DATA Advanced Analytics, and Michael Schwarz, a Ph.D. student at the Graz University of Technology in Austria, detailed the security implications of current DRAM design and demonstrated some practical cross-CPU attacks. The first part of this research was presented in August at the 25th USENIX Security Symposium.
Using virtual addresses enables running multiple processes securely on the same CPU. However, when “talking” to the DRAM, the CPU requires a physical address, which is why virtual addresses need to be mapped to physical addresses.
The mapping function used by the processor’s memory controller is undocumented, but Fogh and Schwarz’s team managed to reverse engineer it by measuring the time it takes for the CPU to read data from memory banks. A tool that can be used to reverse engineer undocumented DRAM addressing functions has been released by the researchers as open source.
Unlike cache attacks, which have been known for some time and for which experts created efficient countermeasures, the DRAMA (DRAM addressing) attacks have the advantage of working across the CPU. However, there are some similarities.
“We found that the buffers used in DRAM show a very similar behavior as CPU caches. We exploit the timing differences of the DRAM buffers to mount attacks. Using timing differences is already known from cache-based attacks,” researchers explained in their paper. “The big advantage of DRAM attacks is that they do not require any shared memory. Moreover, in most setups, the main memory is shared between CPUs as well, meaning we can mount these attacks even in a cross-CPU scenario.”
Fogh and Schwarz showed that without running any binaries on the host system and without leveraging any software vulnerabilities, they can open a covert channel between the VM and the host. The sender, which runs inside the VM, and the receiver running in the browser on the host agree on a memory bank, which can be hardcoded. Memory access times are measured and a “0” bit is transmitted if access is fast and a “1” bit is transmitted if the access is slow.
The experts said there is a chance that the memory used to exfiltrate data is used by another application, which would corrupt the data, but the chances are fairly small and the attack they implemented includes error detection code to prevent this. To make exfiltration even more efficient, the transmission of data is made using packets, which include a sequence bit that specifies if the packet is new or if it’s retransmitted.
While the research has focused on Intel x86-64, they pointed out that the underlying problem is in the RAM, and they have confirmed that other architectures are affected, including the ARM processors used in smartphones.
Since these attacks are possible due to the way DRAM is designed and works, the researchers believe there are no easy mitigations. However, they noted that while the vulnerability is serious, it’s unlikely that we will see any attacks in the wild in the next few years. The goal of this research is to raise awareness and demonstrate that hardware needs to be secure as well — software is not the only problem.
*Updated to correct the transfer rate from 11 Kb/s to 11 b/s.