PT-2020-12008 · Samsung · Ddr4+1

Published 2020-03-10 · Updated 2020-03-16 · CVE-2020-10255

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected, specifically chips produced by SK Hynix, Micron, and Samsung.

Description The issue is related to a vulnerability in the deployment of internal mitigations against RowHammer attacks, known as Target Row Refresh (TRR), aka the TRRespass issue. To exploit this vulnerability, an attacker needs to create certain access patterns to trigger bit flips on affected memory modules, aka a Many-sided RowHammer attack. This allows attackers to conduct privilege-escalation attacks against the kernel, conduct privilege-escalation attacks against the Sudo binary, and achieve cross-tenant virtual-machine access by corrupting RSA keys.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-10255

Affected Products

Ddr4

Lpddr4

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-10255 · Security Note
• https://github.com/vusec/trrespass · Note
• https://thehackernews.com/2020/03/rowhammer-vulnerability-ddr4-dram.html · Note
• https://twitter.com/vu5ec/status/1237399112590467072 · Note
• https://twitter.com/antumbral/status/1237425959407513600 · Note
• https://download.vusec.net/papers/trrespass_sp20.pdf · Note
• https://t.me/cvenotify/1470 · Telegram Post
• https://t.me/opennews/6523 · Telegram Post
• https://vusec.net/projects/trrespass · Note
• https://t.me/tmfeed/79520 · Telegram Post
• https://t.me/cybersecuritytechnologies/779 · Telegram Post