Every Android Device Since 2012 Impacted by RAMpage Vulnerability

Topic

New Reply

Every Android Device Since 2012 Impacted by RAMpage Vulnerability

By Catalin Cimpanu | June 28, 2018

 
Almost all Android devices released since 2012 are vulnerable to a new vulnerability named RAMpage, an international team of academics has revealed today.

The vulnerability, tracked as CVE-2018-9442, is a variation of the Rowhammer attack.

Rowhammer is a hardware bug in modern memory cards. A few years back researchers discovered that when someone would send repeated write/read requests to the same row of memory cells, the write/read operations would create an electrical field that would alter data stored on nearby memory.

In the following years, researchers discovered that Rowhammer-like attacks affected personal computers, virtual machines, and Android devices. Through further researcher, they also found they could execute Rowhammer attacks via JavaScript code, GPU cards, and network packets.

RAMpage is the latest Rowhammer attack variation…
RAMpage may also impact Apple devices, PCs, and VMs…
Every Android device released in the past 6 years is affected

 
Read the full article here

3 users thanked author for this post.

SueW, HiFlyer, Elly

Reply | Quote

Replies

Researchers Devise Rowhammer Attacks Against Latest Android Versions
By Ionut Arghire | June 29, 2018

 
A team of researchers from universities worldwide have devised a new set of DMA-based Rowhammer attacks against the latest Android OS, along with a lightweight defense to prevent such attacks on ARM-based devices.

Rowhammer is a vulnerability impacting dynamic random-access memory (DRAM) chips that can be abused to gain kernel privileges on Linux systems. Discovered in 2012 but documented only in 2014, the bug can also be exploited remotely using JavaScript or via graphics processing units (GPUs)
…
Rowhammer is a hardware bug that “consists of the leakage of charge between adjacent memory cells on a densely packed DRAM chip.” This means that, when a row of bits in the DRAM module is used, the neighboring rows are slightly affected, and attackers can abuse this to completely subvert a system’s security.
…
The researchers are in the process of submitting the patch to Google for adoption.

 
Read the full article here

Reply | Quote