Tools for "Another Flip in the Wall"
One-Location Hammering Tool
This Rowhammer tool tests whether your system is susceptible for one-location hammering bit flips.
See https://github.com/IAIK/rowhammerjs/tree/master/native for a double-sided hammering test (which is more likely to find bit flips on your system).
Also see our paper "Another Flip in the Wall of Rowhammer Defenses": https://arxiv.org/abs/1710.00551
Build and Run
make ./rowhammer <gigabytes of memory to use>
The more gigabytes the better, but too much will bring your system out of memory. 60-90% of the available memory is a good range.
How long will it run? It might run days without bit flips. If it finds bit flips on your machine, please open an issue or send us a message, we'd like to see your results!
Linux Memory Waylaying Tool
These tools implement two parts of waylaying on Linux.
check tool prints the physical address of the first page of the specified binary.
relocate tool implements memory chasing (the non-stealthy variant of waylaying) to force relocation of a binary page.
Be aware that the
relocate tool allocates a file the size of your RAM. This should take less than a second on most systems.
Once the file exists the runtime of the
relocate tool should be consistently below one second.
Build and Run
make sudo ./check /usr/bin/sudo # sudo to get the physical address ./relocate <gigabytes of system memory> /usr/bin/sudo sudo ./check /usr/bin/sudo # sudo to get the physical address
The second run of the check tool will show a new physical address for the same binary page.
One-Location Hammering Demo (Skylake i7 DDR4-2133)
One-Location Hammering Demo (Haswell i7 DDR3-1600)
Waylaying Demo (Skylake i5 12 GB RAM)
Warning #1: We are providing this code as-is. You are responsible for protecting yourself, your property and data, and others from any risks caused by this code. This code may cause unexpected and undesirable behavior to occur on your machine. This code may not detect the vulnerability on your machine.
Be careful not to run this test on machines that contain important data. On machines that are susceptible to the rowhammer problem, this test could cause bit flips that crash the machine, or worse, cause bit flips in data that gets written back to disc.
Warning #2: If you find that a computer is susceptible to the rowhammer problem, you may want to avoid using it as a multi-user system. Bit flips caused by row hammering breach the CPU's memory protection. On a machine that is susceptible to the rowhammer problem, one process can corrupt pages used by other processes or by the kernel.