New ZenHammer Attack Bypasses RowHammer Defenses on AMD CPUs

The world of computer security has seen a new development with the emergence of ZenHammer. This attack targets a vulnerability known as RowHammer and specifically exploits weaknesses in AMD’s Zen microarchitecture. Let’s delve deeper into this discovery and understand its implications.

What is RowHammer and Why Does it Matter?

RowHammer is a type of DRAM (Dynamic Random-Access Memory) attack that exploits the way memory cells store data. These cells hold information as electrical charges, and RowHammer disrupts neighboring cells by repeatedly accessing a specific row in memory. This disruption can cause the electrical state of nearby cells to flip, leading to changes in data bits (0s turning into 1s and vice versa).

The significance of RowHammer lies in its potential to corrupt critical data. An attacker could exploit this vulnerability to:

• Bypass memory protection: Malicious code could leverage RowHammer to gain unauthorized access to sensitive information.
• Escalate privileges: By corrupting system files, an attacker might elevate their permissions and gain control over the system.
• Steal data: RowHammer attacks could be used to tamper with or steal sensitive data stored in memory.

ZenHammer: A New Twist on an Old Threat

Researchers from ETH Zurich developed ZenHammer, specifically targeting AMD Zen 2, Zen 3, and even the newer Zen 4 processors. What makes ZenHammer concerning is its ability to bypass existing RowHammer mitigation techniques like Target Row Refresh (TRR). TRR is a hardware-based solution that refreshes vulnerable rows before bit flips can occur.

Here’s a breakdown of ZenHammer’s effectiveness:

• Zen 2 & Zen 3: The attack successfully triggered bit flips in DDR4 memory on a significant portion of tested systems (70% for Zen 2 and 60% for Zen 3).
• Zen 4 & DDR5: While ZenHammer achieved bit flips on DDR5 for the first time, its success rate was lower (10%) compared to DDR4. This suggests that DDR5’s improved RowHammer defenses, including refresh management and higher refresh rates, offer some protection.

The Security Landscape and Potential Impact

The discovery of ZenHammer highlights the ongoing battle between attackers and security researchers. It emphasizes the need for continuous vigilance and improvement of memory protection mechanisms. While AMD has acknowledged the research, it downplays the novelty of the attack itself, considering RowHammer an industry-wide issue.

However, the impact of ZenHammer can’t be ignored. Here’s what it means for users:

• Increased Attack Surface: With AMD processors now demonstrably vulnerable, the potential target pool for attackers widens.
• Evolving Threats: ZenHammer showcases the ability of attackers to bypass existing defenses, necessitating ongoing development of security solutions.

Mitigating the Risks of ZenHammer

While there’s no foolproof way to prevent RowHammer attacks entirely, several steps can be taken to mitigate the risks:

• Keep Software Updated: Installing security patches released by AMD and operating system vendors is crucial.
• Enable Hardware Mitigations (if available): Some AMD processors might offer hardware-based RowHammer protection features. Users should ensure these are enabled in the BIOS settings (if applicable).
• Consider Error-Correcting Code (ECC) Memory: While typically more expensive, ECC memory can detect and correct some RowHammer-induced errors. This option might be beneficial for high-security systems.

By staying informed and implementing these measures, users can reduce their vulnerability to ZenHammer and similar RowHammer attacks.pen_sparktunesharemore_vert

---

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it.