Drammer - The Making Of

This technical presentation explains how Drammer exploits the Rowhammer hardware vulnerability to obtain Android root access without user permissions or software vulnerabilities. It follows the research process, including bit-flip experiments, memory massaging, page-table targeting, and evaluation on ARM devices.

Syllabus

Intro
A Little Background
Rawhammer
Bypass the CPU cache
Select the Aggressor Rows
Rowhammer Exploitation
Hammering a Needle in the Software Stack
A Quick Google Search
Arrival at Santa Barbara
Benchmarking DRAM Bandwidth
Kernel Module
A piece of art: meh.cc
Debug, Hammer, Debug
E-Mail From The Bos
Flipping Bits On The Beach
Downward Spiral
The cacheflush System Call
Pointer Chasing
Flipping Bits By Executing Code
Cache Maintenance Operations
Martina
Memory templating
Scientific Value
Land sensitive data
a. Exhaust Large Chunks
b. Find a Bit Flip
Release Vulnerable Chunk
Exhaust Rows (again)
a. Release Vulnerable Row
b. Release Large Chunks
Allocate Pages until we hit the vulnerable now
Padding
Map a Page Table
Evaluation
Wrapping Up
Disclosure
Drammer