[Paper Review] CAn't Touch This: Practical and Generic Software-only Defenses Against Rowhammer Attacks

Franz Ferdinand Brasser, Lucas Davi+3 more|arXiv (Cornell University)|Nov 25, 2016

Security and Verification in Computing14 references16 citations

TL;DR

This paper presents B-CATT and G-CATT, two practical software-only defenses against rowhammer attacks that prevent bit flips in vulnerable DRAM by blacklisting faulty memory pages (B-CATT) or isolating memory domains (G-CATT). Both defenses stop all known rowhammer exploits with negligible performance overhead and no false positives, enabling immediate protection of legacy x86 and ARM systems.

ABSTRACT

Rowhammer is a hardware bug that can be exploited to implement privilege escalation and remote code execution attacks. Previous proposals on rowhammer mitigation either require hardware changes or follow heuristic-based approaches (based on CPU performance counters). To date, there exists no instant protection against rowhammer attacks on legacy systems. In this paper, we present the design and implementation of two practical and efficient software-only defenses against rowhammer attacks. Our defenses prevent the attacker from leveraging rowhammer to corrupt physically co-located data in memory that is owned by a different system entity. Our first defense, B-CATT, extends the system bootloader to disable vulnerable physical memory. B-CATT is highly practical, does not require changes to the operating system, and can be deployed on virtually all x86-based systems. While B-CATT is able to stop all known rowhammer attacks, it does not yet tackle the fundamental problem of missing memory isolation in physical memory. To address this problem, we introduce our second defense G-CATT, a generic solution that extends the physical memory allocator of the OS to physically isolate the memory of different system entities (e.g., kernel and user space). As proof of concept, we implemented B-CATT on x86, and our generic defense, G-CATT, on x86 and ARM to mitigate rowhammer-based kernel exploits. Our extensive evaluation shows that both mitigation schemes (i) can stop available real- world rowhammer attacks, (ii) impose virtually no run-time overhead for common user and kernel benchmarks as well as commonly used applications, and (iii) do not affect the stability of the overall system.

Motivation & Objective

• To address the lack of practical, software-only rowhammer defenses for legacy systems.
• To eliminate false positives and high runtime overhead found in prior heuristic-based approaches.
• To provide a deterministic, deployable solution that stops all known rowhammer attacks without requiring OS or hardware modifications.
• To enable memory isolation between system entities (e.g., kernel and user space) via OS-level memory allocation extensions.
• To demonstrate that rowhammer mitigation is feasible through software alone, even on systems without performance counters or ECC memory.

Proposed method

• B-CATT extends the system bootloader to scan physical memory at boot and blacklist vulnerable memory pages, preventing their use.
• G-CATT modifies the OS physical memory allocator to assign memory pages to isolated security domains, confining rowhammer-induced bit flips to attacker-controlled memory.
• The defenses are implemented on x86 and ARM platforms, with B-CATT targeting legacy systems and G-CATT providing a generic, extensible solution.
• B-CATT uses memory scanning and page blacklisting without requiring special CPU features, ensuring broad compatibility.
• G-CATT ensures that bit flips only affect memory within the same security domain, making exploitation impossible across trust boundaries.
• Both defenses are evaluated using standard benchmarks and real-world rowhammer exploits, with performance measured under normal workloads.

Experimental results

Research questions

• RQ1 Can a software-only defense prevent all known rowhammer attacks without hardware modifications?
• RQ2 Is it possible to achieve near-zero runtime overhead while guaranteeing protection against rowhammer bit flips?
• RQ3 Can memory isolation be enforced at the OS level to contain rowhammer-induced bit flips within attacker-controlled memory regions?
• RQ4 Does a bootloader-based memory blacklisting approach offer a practical and scalable solution for legacy systems?
• RQ5 Can a generic, OS-level memory allocator extension effectively mitigate rowhammer without relying on performance counters or heuristics?

Key findings

• B-CATT successfully prevents all known rowhammer attacks by blacklisting vulnerable physical memory pages at boot, with no impact on system stability.
• The worst-case runtime overhead of B-CATT is only 0.29%, significantly lower than the 8% overhead of prior heuristic-based defenses like ANVIL.
• G-CATT effectively contains rowhammer-induced bit flips within the attacker’s memory domain, preventing exploitation of co-located, trusted memory pages.
• Both defenses are fully functional on x86 and ARM platforms, demonstrating cross-architecture compatibility.
• The evaluation confirms that neither defense introduces false positives, unlike heuristic-based approaches such as ANVIL.
• The proposed defenses are deployable on virtually all x86-based systems without requiring OS or hardware changes, enabling immediate protection of legacy systems.