Rowhammer is a specific kind of attack that involves an exploit of the physical hardware in dynamic random-access memory (DRAM). It changes the contents of the memory stored at a given location, which can contribute to unauthorized user escalation and other undesirable consequences.

DRAMs have grown denser over time, leading to interactions between adjacent rows of memory. Google researchers first noted this attack in March 2015. Recently, it was improved with the added capability to root Android phones.

Slamming Rowhammer

So far, the best mitigation technique is a physical redesign of DRAM to eliminate the bit flipping that occurs in adjacent memory rows after repeated read/writes to a specific location. But this kind of solution ignores the vulnerable devices that have been produced and are currently in use.

In response, researchers from the Technische Universität Darmstadt and the University of Duisburg-Essen in Germany devised two methods that use software to mitigate these kinds of attacks.

The first method, called B-CATT, requires no changes to the OS and is compatible with all x86 systems, according to SecurityWeek. It is a bootloader extension designed to locate and disable any exploitable physical memory. It also identifies memory locations vulnerable to Rowhammer and marks them as unavailable to the system for storage.

The second method, G-CATT, aims to protect the memory locations that correspond to high-privileged security domains. It stops bit flips in those strategic locations by making sure that the user memory from which an attack could be launched is physically at least one row away from those critical areas.

Experts Not Impressed

Other researchers were only moderately impressed by the mitigation. Based on their first impressions, some thought it was an important contribution, but most emphasized that there were several issues that still needed to be addressed.

One researcher told SecurityWeek that the proposed method “does not break Rowhammer completely, it only prevents the strong double-sided Rowhammer. Furthermore, an attack from one application to another is also not prevented, only from user applications to the kernel.”

Rowhammer-style attacks are still possible, but researchers will likely find a working mitigation eventually.