LeapFrog: The Rowhammer Instruction Skip Attack

on YouTube ↗34m

" summary

Rowhammer flips saved return addresses in memory so a single one bit flip in a stack-stored return pointer causes an instruction to be skipped, letting execution jump by powers of two. The team builds a profiling pipeline: find flippy pages via local hammering, free “bait” pages with the buddy allocator, time-sweep to collocate the victim PC (30–50% success in trials) and inject the fault. Demonstrated on OpenSSL TLS handshake, sudo and AES traces; initial TLS scan shows ~2,493 one-bit-safe candidates, filtered down to a few working exploits.

AI-written summary · about

" chapters (15)

1. 0:00Introduction
2. 0:23What is Rowhammer
3. 3:12DRAM fundamentals
4. 5:40Rowhammer timeline
5. 7:03Mayhem attack overview
6. 8:05Program counter basics
7. 10:37LeapFrog attack explained
8. 11:21Real-world TLS attack
9. 14:12Memory allocation attack
10. 16:20Profiling bait pages
11. 18:03Finding LeapFrog gadgets
12. 20:54Attack timing and windows
13. 22:42TLS attack results
14. 23:47Countermeasures
15. 25:10Q&A session

" related talks

• 28mFlip Feng Shui: Hammering a Needle in the Software StackHerbert Bos, Ben Gras, Erik Bosman, Kaveh Razavi, Cristiano Giuffrida, Bart Preneel · USENIX Security '16
• 40mRowhammer Attacks: A Walkthrough GuideDaniel Gruss, Dr. Clémentine Maurice · RuhrSec 2017
• 15mPosthammer: Pervasive Browser-based Rowhammer Attacks with Postponed...Kaveh Razavi, Patrick Jattke, Finn de Ridder · USENIX Security '25
• 25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...Lucian Radu Teodorescu, Yuan Xiao, Xiaokuan Zhang, Yinqian Zhang · USENIX Security '16
• 38mCSI:Rowhammer: Closing the Case of Half-Double and BeyondAndreas Kogler, Jonas Juffinger · Black Hat Europe 2022
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 10mRowhammer-Based Trojan Injection: One Bit Flip Is Sufficient...Xiang Li, Junming Chen, Lannan Luo, Qiang Zeng, Ying Meng · USENIX Security '25
• 29mCAn’t Touch This...Lucas Vincenzo Davi, Christopher Liebchen, Ahmad-Reza Sadeghi, Ferdinand Brasser, David Gens · 26th USENIX Security Symposium (USENIX Security '17)