English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

In the past decade, many vulnerabilities were discovered inmicroarchitectures which yielded attack vectors and motivated the study ofcountermeasures. Further, architectural and physical imperfections in DRAMs ledto the discovery of Rowhammer attacks which give an adversary power tointroduce bit flips in a victim's memory space. Numerous studies analyzedRowhammer and proposed techniques to prevent it altogether or to mitigate itseffects.  In this work, we push the boundary and show how Rowhammer can be furtherexploited to inject faults into stack variables and even register values in avictim's process. We achieve this by targeting the register value that isstored in the process's stack, which subsequently is flushed out into thememory, where it becomes vulnerable to Rowhammer. When the faulty value isrestored into the register, it will end up used in subsequent iterations. Theregister value can be stored in the stack via latent function calls in thesource or by actively triggering signal handlers. We demonstrate the power ofthe findings by applying the techniques to bypass SUDO and SSH authentication.We further outline how MySQL and other cryptographic libraries can be targetedwith the new attack vector. There are a number of challenges this workovercomes with extensive experimentation before coming together to yield anend-to-end attack on an OpenSSL digital signature: achieving co-location withstack and register variables, with synchronization provided via a blockingwindow. We show that stack and registers are no longer safe from the Rowhammerattack.

Mayhem: Targeted Corruption of Register and Stack Variables