I find it very amusing that they use the name "Feng Shui" for placing the victim page. For those who don't understand: https://en.wikipedia.org/wiki/Feng_shui
It's also an idiom Alex Sotirov coined 10 years ago:
RAMBleed Attack – Reading Bits in Memory Without Accessing Them
11–20 of 141 posts
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#12Anyone else love how vulnerabilities these days have full on marketing-esque campaigns backing them? In any case, if it increases awareness, I'm mostly supportive. Allow me to save some time, from TFA: > Is there a CVE number? > Yes, see CVE-2019-0174 [1]. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0174 --- > What is RAMBleed? > Previous attacks exploited the Rowhammer effect to write (or flip) bits…
Relevant @patio11 article
https://www.kalzumeus.com/2014/04/09/what-heartbleed-can-tea...
I think the marketing campaigns are awesome. Makes it much easier to get resources to fix.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#13Does this affect public cloud providers? Can it be used to obtain data from other VMs running on the same host?
It sure sounds like it—have there been any responses from the major cloud providers? This doesn’t exactly seem like something that can be patched easily....
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#14Why does every new attack have a homepage these days?
Came here to ask the same. Then thought about it and was expecting to see a comment saying “it’s so that normal people understand the vulnerabilities.” And then I realized it’s probably also because of a desire to be seen. (It seems all participants are from academia?)
If you discovered a way to read privileged memory from any process, wouldn't you want people to know about it, and that you played a part in discovering it? Why not have somebody slap a logo on it too?
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#15If I understood correctly, this is orders of magnitude worst that RowHammer, as it is kind of passive: you set some program to do the RowHammer side, within its own memory space, and then use RAMBleed to see changes from memory cells, not exactly the ones that were RowHammered. Is that it ?
Seems RowHammer can flip bits and RAMBleed uses RowHammer to also read memory stored nearby.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#16Anyone else love how vulnerabilities these days have full on marketing-esque campaigns backing them? In any case, if it increases awareness, I'm mostly supportive. Allow me to save some time, from TFA: > Is there a CVE number? > Yes, see CVE-2019-0174 [1]. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0174 --- > What is RAMBleed? > Previous attacks exploited the Rowhammer effect to write (or flip) bits…
Unless your CEO loves talking about CVEs all day long, I think we should all be grateful for these good-looking marketing campaigns for serious security issues.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#17[deleted]
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#18If I understood correctly, this is orders of magnitude worst that RowHammer, as it is kind of passive: you set some program to do the RowHammer side, within its own memory space, and then use RAMBleed to see changes from memory cells, not exactly the ones that were RowHammered. Is that it ?
> a bit is more likely to flip when the bits above and below it have the opposite charge. ... To exploit this effect, we developed novel memory massaging techniques to carefully place the victim's secret data in the rows above and below the attacker's memory row.
The secret data has to be duplicated, column aligned, and have a single unallocated row between it. Controlling the alignment of the secret data seems like a major complication for realistic exploitation.
Edit: The strategy in the paper requires allocating a bunch of physical memory from all the small blocks so that memory allocation requests from a new process are allocated deterministically to a desired physical row.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#19These recent CPU and Memory vulnerabilities are calling into question the economics of the public cloud. A lot of these bugs only really matter if you have multiple programs from different entities running on the same computer system. A company that has its own private cloud, doesn't have to care about these attacks so much.
The cost of mitigating these attacks both in terms of CPU performance and increased hardware costs may offset some of the economies of scale.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#20Perhaps I'm missing something really obvious, but doesn't hardware-provided memory encryption solve this quite handily? You might be able to read single bits of raw physical memory from another process, but this won't tell you anything substantial about what that process is up to.