Source-linked AI summary
DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
Peter Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz, Stefan Mangard
TL;DR
Cloud tenants remain exposed to shared-hardware leakage when they use different processors and shared memory is disabled, a setting where prior channels were limited. The paper reverse-engineers undocumented DRAM mappings and uses shared row buffers to build DRAMA attacks, including a 2 Mbps covert channel and a no-shared-memory side channel. It also applies the mappings to improve existing attacks, including practical Rowhammer on DDR4.
Problem
Cloud deployments need attacks to work across processors without shared memory, but prior work provided only a low-capacity covert channel and no side channel meeting both requirements.
Method
The paper reverse-engineers physical-address mappings to DRAM channels, ranks, and banks using physical probing and a fully automated software method based on timing differences.
Results
2 Mbps is the reported covert-channel capacity, while DRAMA also provides a cross-processor template side channel without shared memory and enables practical Rowhammer attacks on DDR4.
Takeaways & Limitations
DRAM row buffers are shared resources that support attacks in restrictive multi-processor environments and can improve existing cache and Rowhammer attacks.
Takeaways & Limitations
DRAMA side-channel attacks require significantly larger memory buffers than cache attacks, despite their low false-positive row-hit detection probability.
Abstract
from arXiv · showhide
In cloud computing environments, multiple tenants are often co-located on the same multi-processor system. Thus, preventing information leakage between tenants is crucial. While the hypervisor enforces software isolation, shared hardware, such as the CPU cache or memory bus, can leak sensitive information. For security reasons, shared memory between tenants is typically disabled. Furthermore, tenants often do not share a physical CPU. In this setting, cache attacks do not work and only a slow cross-CPU covert channel over the memory bus is known. In contrast, we demonstrate a high-speed covert channel as well as the first side-channel attack working across processors and without any shared memory. To build these attacks, we use the undocumented DRAM address mappings. We present two methods to reverse engineer the mapping of memory addresses to DRAM channels, ranks, and banks. One uses physical probing of the memory bus, the other runs entirely in software and is fully automated. Using this mapping, we introduce DRAMA attacks, a novel class of attacks that exploit the DRAM row buffer that is shared, even in multi-processor systems. Thus, our attacks work in the most restrictive environments. First, we build a covert channel with a capacity of up to 2 Mbps, which is three to four orders of magnitude faster than memory-bus-based channels. Second, we build a side-channel template attack that can automatically locate and monitor memory accesses. Third, we show how using the DRAM mappings improves existing attacks and in particular enables practical Rowhammer attacks on DDR4.
1 Introduction
Cloud co-location leaves shared hardware as an information-leakage risk even when software and shared-memory isolation are enforced. The paper addresses the remaining cross-processor, no-shared-memory setting with DRAMA attacks based on reverse-engineered DRAM addressing.
- Security requirements: Successful attacks in cloud settings must work across processors and without shared memory.Processor-local caches and disabled memory deduplication otherwise block attacks in these configurations.
- Research gap: Only a low-capacity covert channel, but no side channel, previously satisfied both requirements.The paper contrasts this gap with a high-speed covert channel and the first side-channel attack meeting both constraints.
- Contributions: Two reverse-engineering methods recover undocumented mappings from physical addresses to DRAM channels, ranks, and banks.One uses physical memory-bus probing; the other is software-based, fully automatic, and timing-based, enabling remote use in cloud VMs.
- DRAMA attacks: DRAMA attacks exploit shared DRAM row buffers without accessing the same memory cells.They require at least one memory module shared between attacker and victim, not shared memory locations, and make no cache or core-placement assumptions.
- Contributions: 2 Mbps is the covert-channel capacity, three to four orders of magnitude faster than previous memory-bus-based channels.The paper also reports a template side channel that automatically locates and monitors accesses and uses DRAM mappings to improve Flush+Reload and enable practical DDR4 Rowhammer attacks.
2 Background and related work
The paper reviews shared-hardware channels and the DRAM mechanisms that motivate DRAMA. Cache attacks are constrained by processor locality or shared-memory requirements, while DRAM row conflicts provide a cross-processor timing signal.
- Shared-hardware attacks: Side channels extract information from victims, whereas covert channels let cooperating parties communicate across isolation boundaries.Both exploit hardware sharing as a source of observable timing behavior.
- Cache attacks: Cache attacks can operate across cores but require the sender and receiver to share a physical CPU, while fine-grained Flush+Reload also requires shared memory.Reported cross-core capacities include 536 Kbps for Prime+Probe, 2.3 Mbps for Flush+Reload, and 3.8 Mbps for Flush+Flush.
- DRAM organization: DRAM is organized into channels, DIMMs, ranks, banks, rows, and columns, with same-bank addresses physically adjacent within the hierarchy.The memory controller translates physical addresses into these components, but Intel’s mappings are undocumented and have changed across microarchitectures.
- The row buffer: A bank’s row buffer stores one DRAM row; accesses to the active row are fast, while switching rows causes a slower row conflict.This timing difference underlies the paper’s attacks and software-based reverse engineering.
- Multi-CPU DRAM: Multi-CPU systems expose one DRAM address space through dedicated memory controllers, with remote accesses sent over the CPU interconnect.NUMA makes access time depend on memory location, and memory can be interleaved or kept in per-CPU contiguous blocks.
- The Rowhammer bug: Rowhammer faults adjacent rows through frequent activation patterns, reflecting reduced charge and noise margins in denser DRAM cells.Prior exploits used single-bit flips for Linux kernel privilege escalation and Native Client sandbox escape.
3 Definitions
The paper defines row hits and row conflicts as timing states in a DRAM bank. Alternating-address behavior distinguishes different banks, the same row, and different rows within one bank.
- Row hit and row conflict: A row hit occurs when the accessed row is already open in the bank’s row buffer.Row hits produce low access times.
- Row hit and row conflict: A row conflict occurs when a different row is open in the same bank.The access closes the currently open row and activates the requested row, producing higher access times.
- Alternating accesses: Alternating addresses in different banks access independently, so their row indices do not affect timing.Access times are likely to remain low because row hits are likely.
- Alternating accesses: Alternating addresses in the same row and bank usually keeps that row open, producing low access times.This is the second timing case used to distinguish DRAM address relationships.
- Alternating accesses: Alternating addresses in different rows of the same bank repeatedly causes row conflicts and high access times.Each access closes the other address’s row before activating its own.
4 Reverse engineering DRAM addressing
The paper reverse engineers undocumented DRAM address mappings using physical probing and a fully automated software method. It finds linear mappings across tested platforms, while showing that detailed functions vary with architectures and memory configurations.
- Reverse-engineering approaches: The paper reconstructs DRAM address mappings through physical probing and an entirely software-based, fully automated timing method.The probing method reads control signals directly, while the software method searches for linear addressing functions from timing differences.
- Reverse engineering using physical probing: Physical probing solves addressing functions from measured logic values for selected DRAM control signals.It uses a passive probe and oscilloscope, then applies linear algebra to derive the corresponding functions.
- Reverse engineering using physical probing: The probing approach provides exact individual bus-pin functions but requires expensive equipment and physical access to the machine.Each platform only needs to be measured once to learn its addressing functions.
- Fully automated reverse engineering: The software method brute-forces linear functions over address sets, prioritizes minimal functions, and verifies candidates using timing or probing results.It ignores address bits used within cache lines and can complete the brute-force search within seconds.
- Fully automated reverse engineering: The software method can run remotely, including inside virtual machines, and can group addresses for attacks even with only 4 KB pages.It also enabled reverse engineering on current ARM processors and mobile devices where physical probing is difficult.
5 A high-speed cross-CPU covert channel
The DRAMA covert channel uses timing differences from row conflicts between sender and receiver accesses to different rows in the same DRAM bank. It operates across CPUs without shared memory, with performance depending on bank parallelism, synchronization, and bitrate-error trade-offs.
- 5.1 Basic concept: The channel exploits the DRAM row buffer: sender and receiver use different rows in the same bank, and row conflicts raise receiver access times.Bits are encoded by switching sender activity on and off; low and high mean access times represent 0 and 1.
- 5.1 Basic concept: Each (CPU, channel, DIMM, rank, bank) tuple can serve as a separate unidirectional transmission channel.Parallel channels increase noise and bank parallelism is strictly limited, so optimal performance uses only a subset of tuples.
- 5.1 Basic concept: The channel can operate without reconstructing exact DRAM functions by using timing analysis to identify and synchronize same-bank address sets.The software-only setup can also use physical-address information from large pages to select compatible bank, rank, and channel addresses, including in virtualized settings.
- 5.1 Basic concept: Shorter fixed transmission periods increase raw bitrate but also increase error rate.Native and cross-VM synchronization use different mechanisms: a wall clock natively, and a transmitted clock signal across VMs.
- 5.2 Evaluation: 2.1 Mbps capacity is reached natively, while cross-CPU communication achieves 1.2 Mbps at 1% error and cross-CPU cross-VM communication reaches 596 kbps at 0.4% error.The maximum native capacity is 2.1 Mbps; the maximum server cross-CPU cross-VM capacity is not separately reported in the cited evaluation passage.
- 5.2 Evaluation: With capacity up to 2 Mbps, the channel is within the same order of magnitude as cache covert channels while requiring neither shared memory nor a common physical CPU.It is three to four orders of magnitude faster than the cited memory-based covert channels.
6 A low-noise cross-CPU side channel
DRAMA uses DRAM row-buffer behavior to monitor private memory accesses across CPUs without shared memory. Its side channel achieves timing accuracy comparable to Flush+Reload and higher spatial accuracy than Prime+Probe, while requiring larger buffers.
- Basic concept: DRAMA monitors a victim’s private memory accesses across separate CPUs without shared memory by exploiting shared DRAM rows.The spy and victim access different pages mapped to the same bank and row; row hits and conflicts reveal victim activity.
- Basic concept: A single page can span 8 DRAM rows, while one Haswell-EP row stores content from 16 pages, enabling 512 B spatial accuracy.On systems using at least six low address bits, accuracy can reach 64 B, matching Flush+Reload.
- Basic concept: The attack primes a row conflict, waits for victim computation, and measures a same-row address to detect a row hit.Private pages prevent prefetching, and allocating all but one page mapping to a row maximizes spatial accuracy.
- Template attack: A fully automated template attack profiles row-hit ratios while triggering victim events, then monitors the selected address during exploitation.It does not require reconstructing the full addressing functions or determining the exact bank address.
- Evaluation: 1195 candidate addresses were found while scanning 7 GB, including 59 false positives independent of Firefox keystrokes.The attack ran in an unprivileged program without shared memory; a selected address recorded keystroke timing after automatic transition to exploitation.
- Comparison with state of the art: DRAMA offers timing accuracy comparable to Flush+Reload and higher spatial accuracy than Prime+Probe, but requires significantly larger buffers than Prime+Probe.Its lack of shared-memory requirements enables cross-CPU monitoring in restricted environments and attacks on private or dynamically allocated memory.
7 Improving attacks
DRAM address mappings improve the accuracy, efficiency, and success rate of existing attacks. The paper applies them to Flush+Reload thresholding and to more effective Rowhammer address selection.
- Overview: DRAM mappings improve existing attacks by exposing which addresses share relevant DRAM resources.The section specifically targets accuracy, efficiency, and success rate.
- Flush+Reload: Flush+Reload thresholds should account for row hits and row conflicts because row hits have slightly lower access times.Ignoring these DRAM effects can misclassify row hits as cache hits.
- Rowhammer: Rowhammer requires alternating accesses to addresses in the same bank but different rows; random address pairs satisfy this with probability 2^-B.For the cited dual-channel DDR4 configuration, the probability is 2^-6 = 1/64.
- Rowhammer: DRAM mappings identify same-bank addresses immediately and efficiently locate pairs suitable for double-sided hammering.Double-sided hammering alternates accesses to adjacent rows n−1 and n+1 around target row n.
- Rowhammer: Using the mappings, the authors reproducibly triggered DDR4 bit flips despite supported target row refresh, with one module producing a first flip after 16 seconds.That module subsequently averaged one bit flip every 12 seconds.
8 Countermeasures
The paper finds that row-buffer attacks are difficult to close through timing defenses and that restricting individual instructions is incomplete. Hardware partitioning can prevent cross-VM attacks but sacrifices multi-CPU benefits.
- General defenses: Constant-time DRAM operations would cause unacceptable performance degradation, while measurable timing differences leave the side channel open.The paper therefore characterizes defending against row-buffer attacks as difficult.
- Instruction restrictions: Restricting clflush may make the row-buffer covert channel impractical, but eviction can replace it and other DRAMA attacks remain possible.Restricting rdtsc also does not prevent attacks because alternative timing sources are available.
- Resource partitioning: Scheduling each VM on a dedicated physical CPU with CPU-local DRAM can prevent cross-VM attacks, but effectively splits the machine into independent single-CPU systems.This approach loses many advantages of multi-CPU systems.
- Existing countermeasures: A countermeasure for memory-bus covert channels is ineffective against DRAMA because DRAMA does not rely on atomic instructions.The countermeasure intercepts atomic instructions and restricts locking to attacker-VM cores.
- Detection: DRAMA may be detectable through many cache misses, but distinguishing it from benign applications remains unclear.
9 Conclusion
The paper reverse engineers DRAM address mappings with two methods and uses them to demonstrate DRAMA attacks across processors without shared memory. These attacks provide a high-speed covert channel, a cache-comparable side channel, practical Rowhammer on DDR4, and a broader security lesson about exposing hidden microarchitectural resources.
- Reverse engineering: Two methods reverse engineer mappings from physical memory addresses to DRAM channels, ranks, and banks across desktop, server, and mobile platforms.One method uses physical memory-bus probing; the other is fully software-based and automatic.
- DRAMA attacks: DRAMA attacks exploit the DRAM row buffer, a shared resource, to operate across processors without shared memory.The attacks use the reverse-engineered addressing functions to expose this shared resource in restrictive environments.
- DRAMA attacks: 2 Mbps is the demonstrated covert-channel capacity, three to four orders of magnitude faster than memory-bus-based channels in the same setting.The channel targets the restrictive cross-processor, no-shared-memory setting.
- DRAMA attacks: The side-channel template attack automatically locates and monitors memory accesses with accuracy comparable to recent cache attacks while requiring no shared memory.The paper gives user input and server requests as example targets.
- Attack improvements: Reverse-engineered DRAM addressing functions improve existing attacks, including Flush+Reload, and enable practical Rowhammer attacks on DDR4.The paper emphasizes that reverse engineering made the DRAM row buffer visible as a powerful side channel.