LeapFrog: The Rowhammer Instruction Skip Attack

Andrew Adiletta,Caner Tol,Berk Sunar

2024-04-12

Abstract:Since its inception, Rowhammer exploits have rapidly evolved into increasingly sophisticated threats not only compromising data integrity but also the control flow integrity of victim processes. Nevertheless, it remains a challenge for an attacker to identify vulnerable targets (i.e., Rowhammer gadgets), understand the outcome of the attempted fault, and formulate an attack that yields useful results.

Cryptography and Security,Hardware Architecture

What problem does this paper attempt to address?

### Problems the Paper Aims to Solve

This paper aims to introduce a new Rowhammer attack method called the "LeapFrog gadget," which can bypass critical security checks in code. Specifically, when the victim's code stores the program counter (PC) value on the stack during function calls or context switches, the attacker can induce bit flips through Rowhammer to alter the PC value, thereby controlling the code execution flow and skipping certain critical code segments (such as authentication logic, encryption rounds, etc.).

#### Main Contributions:
1. **Introduction of the LeapFrog Gadget**: Proposes a new Rowhammer attack method that flips bits in the PC value stored on the stack, allowing attackers to bypass security-critical parts of the code.
2. **Practical Demonstration**: Validates the feasibility of this attack by successfully bypassing the TLS handshake process in a standard OpenSSL implementation.
3. **Automated Detection Tool**: Develops the first simulation tool specifically for detecting LeapFrog gadgets, based on the Intel Pin tool and combined with time-domain analysis to systematically analyze binary files.
4. **Defense Measures**: Proposes defense measures against LeapFrog attacks and evaluates their effectiveness, providing insights to enhance the system's resistance to advanced Rowhammer attacks.

### Background and Related Work

The paper first introduces the basic principles of Rowhammer attacks and their impact on DRAM, then discusses some existing Rowhammer attack methods and defense measures. It then describes in detail the working mechanism of the LeapFrog gadget and demonstrates its attack effects through real-world cases.

### Experiments and Results

The authors validate the effectiveness of the LeapFrog gadget through actual experiments and demonstrate how to detect potential LeapFrog gadgets using automated tools. Additionally, they propose several defense measures to enhance system security.