This software is the open-source component of our paper "GuardION: Practical Mitigation of DMA-based Rowhammer Attacks on ARM", published in the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA) 2018. It allows you to patch an Android kernel so that DMA allocations are guarded with empty rows, resulting in the isolation of bitflips and thus mitigation of Drammer-like attacks.
The code is released under the Apache 2.0 license.
This repository does not contain any exploit code for our RAMpage exploit.
If, for some weird reason, you think running this code broke your device, you get to keep both pieces.
All code was compiled and tested on a Google Pixel, running Android 7.1.1 (Nougat), with kernel version 3.18:
android-7.1.1_r0.5 / android-msm-marlin-3.18-nougat-mr1 Pixel XL (marlin) / Pixel (sailfish). The makefiles assume that you have an ARM64 sysroot install of the Android NDK (version r11c) in
/opt/android-ndk-r11c/sysroot-arm64/. For more information on how to obtain such sysroot, have a look at the Drammer README.
A typical example of how to install our patches:
cd ~ git clone https://android.googlesource.com/kernel/msm cd msm git checkout -b android-msm-marlin-3.18-nougat-mr1 origin/android-msm-marlin-3.18-nougat-mr1 export CROSS_COMPILE=/opt/android-ndk-r11c/sysroot-arm64/bin/aarch64-linux-android- export ARCH=arm64 make marlin_defconfig make -j6 # Run make menuconfig to enable loadable kernel module support if you want to compile nohammer (see below). # (make sure to also enable "Module unloading") # This should result in a compiled kernel, we can now apply our patches and recompile: cd ~/msm cp /path/to/guardion/ion/isolation.patch . cp /path/to/guardion/bitmap/bitmap.patch . git apply -v isolation.patch make -j6
The patch in
bitmap/ enables isolation of DMA memory that uses the bitmap (used by ION CMA heap)
The patches in
ion/ enables isolation for the regular ION heaps.
isolation-debug.patch adds some debug prints that were used to measure the memory use at run-time.
The files in
nohammer/ hold our attempt at implementing nohammer, as proposed by Pavel Machek at the kernel harderning mailinglist. Note that our experiences with this approach were not very positive (the device would become unresponsive). Not all of the provided code may work and may require some additional changes.