Are virtualized environments vulnerable to the Row Hammer attack?

Question

Row Hammer is an exploit which relies on RAM defects to get unrestricted access to the RAM content, allowing to read/write otherwise protected memory and to get higher privileges on the system.

To work, this exploit will access a legitimately accessible memory row in a loop at a very high rate and with no cache, and the frequency of this operation will induce a change in the value of the adjacent, restricted row.

Wikipedia describes the exploit as follow:

By combining the disturbance errors with memory spraying, this exploit is capable of altering page table entries (PTEs) used by the virtual memory system for mapping virtual addresses to physical addresses, which results in the exploit gaining unrestricted memory access.

As per my understanding, while this exploit may be able to provide the attacker a Super User privilege on a guest system (I do not talk about "root" since this attack is not OS dependent), I'm wondering if it can really allow him to escape the virtualized guest and reach either other guests or the host system itself.

• While this attack is described as providing "unrestricted access to all physical memory installed in a computer", this memory must still be addressable by the malicious process. As per my understanding a guest virtualized "physical" memory is mapped onto a region of the actual physical memory and several measures exists, both at the hardware (CPU with hardware-assited virutalization instruction sets) and the software (the virtualization software) layers, to ensure it will not be able to address memory outside of this area.
• In order to access normally restricted memory areas, the process has to modify the PTEs. Within the guest, only the PTEs of the guest system is accessible, not the PTEs of the host one.
• There is a chicken-and-egg problem: in order to circumvent the memory access enforced by the virtualization software, the process must alter its memory. However, since the virtualization software is running on the host system, the malicious process must first be able to address host system memory in order to do this.
• Wikipedia's definition mentions modifying the PTEs (Page Table Entries). Modern CPUs provide Second Level Address Tanslation (SLAT, aka nested paging to isolate guest's page tables at the hardware level). Would my assumptions above be bypassable, would this improve the resistance of virtualized systems against Row Hammer?

Answer 1

It depends on your adversary, though I will say no.

At the moment, there are no known vulnerabilities for this attack vector. Thus, if your adversaries are script kiddies, then you are safe.

It will be a box of chocolates (not knowing what you might get), thus a useless attack:

• A vulnerability likely might allow someone to read or modify a different row, but not knowing what information is where makes it nearly useless, thus eliminating most any adversary.
• The HV layer can re-map or even swap out memory at any given moment
• The HV might have a dozen or a hundred different VMs, there's no way to target one.
• The HV might do something like VMotion and move it to a different hardware host
• Even doing Row Hammer on the same VM to get elevated privileges is subject to the above, making it unpredictable.

When your threat / adversary has unlimited funding and is targeting you specifically, all bets are off, though likely, they would seek an easier path into the environment, including physical attacks.

Given the number of 0-day vulnerabilities, even those on Hypervisors themselves, Row hammer seems kinda pointless.

Answer 2

I think this needs to be broken down into smaller questions that can be reasonably answered.

Can the a VM repeatedly access the same memory address quickly enough to trigger the row hammer effect?

I see no reason why that would be impossible. It is certainly possible that something about the virtualized environment could end up interfering with that process. A Virtualized environment could theoretically monitor for that type of access pattern and try to block it but I suspect the overhead would be pretty bad and would negatively impact performance. I don't know of any off hand that actually implement this. It is also certainly possible that it could interfere with the process accidentally. As MikeP mentioned it could just happen to remap the memory in the middle of the attack or trigger a migration to another server in the middle of the attack or even simply preempt the VM to allow another VM to run. I'd assume the VM would try to avoid remapping memory that is being heavily used as that would likely have a negative performance impact but a VM migration could be triggered if the virtual environment sees the row hammer attack as a memory pressure and is trying to "fix" that.

The next question is if you can get a bit to flip can you use it to actually accomplish something?

IMO this gets far trickier. The virtualized environment adds at least one additional layer of address translation that makes identifying a row hammer target and that target could change at any time. It might also hide information about the underlying physical layout necessary to properly identify a target. I think these challenges on top of potential challenges even triggering the bit flip do make this impractical and probably make crafting a reliable exploit impossible. You are far more likely to essentially create a DoS attack by crashing a VM or the entire virtual environment than a reliable privilege escalation.

Answer 3

The theoretical success of a Row Hammer Attack in your scenario is given. But the practical possibilities might be limited or the complexity of the attack chain very high. This is not a limitation by Row Hammer per se, it is a dependency of the real-world scenario. An attacker in one Guest would have to affect the Host to gain elevated privileges or to affect another Guest directly. This might be possible under some circumstances but would require a very good preparation, a lot of time and even some luck.