Talk Title:

LeapFrog: The Rowhammer Instruction Skip Attack

Abstract:

Since its inception, Rowhammer exploits have rapidly evolved into increasingly sophisticated threats not only compromis-ing data integrity but also the control flow integrity of victim processes. Nevertheless, it remains a challenge for an attacker to identify vulnerable targets (i.e., Rowhammer gadgets), understand the outcome of the attempted fault, and formulate an attack that yields useful results.

In this paper, we present a new type of Rowhammer gad- get, called a LeapFrog gadget, which, when present in the victim code, allows an adversary to subvert code execution to bypass a critical piece of code (e.g., authentication check logic, encryption rounds, padding in security protocols). The LeapFrog gadget manifests when the victim code stores the Program Counter (PC) value in the user or kernel stack (e.g., a return address during a function call) which, when tampered with, re-positions the return address to a location that bypasses a security-critical code pattern. This research also presents a systematic process to identify LeapFrog gadgets. This methodology enables the automated detection of susceptible targets and the determination of optimal attack parameters. We first showcase this new attack vector through a practical demonstration on a TLS handshake client/server scenario, successfully inducing an instruction skip in a client application. We then demonstrate the attack on real-world code found in the wild, implementing an attack on OpenSSL.

Our findings extend the impact of Rowhammer attacks on control flow and contribute to the development of more robust defenses against these increasingly sophisticated threats.

Speaker Bio:

Andrew Adiletta is an embedded security engineer working at Mitre and is getting his PhD at WPI. As part of his PhD research, Andrew is studying Rowhammer, a software-enabled fault attack on DRAM. Andrew’s focus at WPI is how processes and the operating system interact to produce a vulnerable environment to fault, and side channel attacks.