DRAM Physical Memory RAMBleed information disclosure

Summaryinfo

A vulnerability, which was classified as critical, has been found in DRAM. Impacted is an unknown function of the component Physical Memory Handler. The manipulation leads to information disclosure (RAMBleed). This vulnerability is documented as CVE-2019-0174. The attack can be initiated remotely. Additionally, an exploit exists. This vulnerability has a historic impact because of its background and how it was received.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in DRAM (affected version unknown). This issue affects an unknown functionality of the component Physical Memory Handler. The manipulation with an unknown input leads to a information disclosure vulnerability (RAMBleed). Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access.

The weakness was released 06/11/2019 by Andrew Kwong, Daniel Genkin, Daniel Gruss and Yuval Yarom as RAMBleed: Reading Bits in Memory Without Accessing Them as confirmed paper (Website). The advisory is shared at rambleed.com. The public release happened without involvement of the project team. The identification of this vulnerability is CVE-2019-0174 since 11/13/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a private exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/03/2023). MITRE ATT&CK project uses the attack technique T1592 for this issue. Due to its background and reception, this vulnerability has a historic impact. The advisory points out:

RAMBleed is a side-channel attack that enables an attacker to read out physical memory belonging to other processes. The implications of violating arbitrary privilege boundaries are numerous, and vary in severity based on the other software running on the target machine. As an example, in our paper we demonstrate an attack against OpenSSH in which we use RAMBleed to leak a 2048 bit RSA key. However, RAMBleed can be used for reading other data as well.

It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k. The advisory illustrates:

RAMBleed is based on a previous side channel called Rowhammer, which enables an attacker to flip bits in the memory space of other processes. We show in our paper that an attacker, by observing Rowhammer-induced bit flips in her own memory, can deduce the values in nearby DRAM rows. Thus, RAMBleed shifts Rowhammer from being a threat not only to integrity, but confidentiality as well. Furthermore, unlike Rowhammer, RAMBleed does not require persistent bit flips, and is thus effective against ECC memory commonly used by server computers.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

rambleed.com is providing further details. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• DRAM

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion