RAMBleed, a new side-channel attack enables attackers to read memory not belonging to them
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).
A new side-channel attack that enables an attacker to read out physical memory belonging to other processes, named RAMBleed, is published.
RAMBleed, based on a previous side channel called Rowhammer, violates arbitrary privilege boundaries. The implications of this is numerous, and vary in severity based on the other software running on the target machine. The researchers demonstrated an attack against OpenSSH in which they used RAMBleed to leak a 2048 bit RSA key, but the exploit can read other data as well.
“It is widely assumed however, that bit flips within the adversary’s own private memory have no security implications, as the attacker can already modify its private memory via regular write operations. We demonstrate that this assumption is incorrect, by employing Rowhammer as a read side channel.” reads the research paper. “More specifically, we show how an unprivileged attacker can exploit the data dependence between Rowhammer induced bit flips and the bits in nearby rows to deduce these bits, including values belonging to other processes and the kernel.”
Top 5 Security News
Malformed Certs make DoS on any Windows servers possible
GoldBrute bot-net brute forcing 1.5 million RDP servers
Arbitrary OS command execution vulnerability found in VIM and Neovim
