CVE-2021-42114
Description
A Rowhammer flaw was found in the latest DDR4 DRAM hardware chips. This flaw is different from the previously known attack (CVE-2020-10255) by non-uniform patterns of memory access. These DDR4 DRAM hardware chips implement a Target Row Refresh (TRR) mitigation to prevent a Rowhammer flaw-induced bit corruption across memory space. This flaw allows an unprivileged system user to use Rowhammer attack variants to induce bit corruptions across memory space, potentially resulting in a denial of service or privileges escalation scenarios. With the currently known attack scenarios, the highest threat from this vulnerability is to system availability.
Statement
Red Hat Product Security is aware of this issue. This is a hardware issue. It can not be fixed via usual software updates.
For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/1377393
Mitigation
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. One way of possible (but non practical) mitigation is to check if hardware vulnerable with existing reproducer blacksmith and if yes, then use some software (currently only prototype available) to prevent attacks: like ARMOR or ANVIL. The other possible mitigation is to prevent high CPU (or high memory or high network) usage, because the currently known fuzzer requires some very high-speed memory access for some reasonable time period.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.3 | 8.3 | N/A |
| Attack Vector | Adjacent Network | Adjacent Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Changed | Changed | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
The AV:A is the best choice, because attack possible only for the local networks with very high bandwidth (since the attack requires high-speed memory access where every new network packet performs one more memory access). The AC:H, because this kind of attack is similar like to get complex race condition: need both to bypass existing Target Row Refresh (TRR) defense and both to find some specific bits in memory where bit corruptions possible, so likely not possible to write exploit that would repeat the same kind of attack to similar parts of memory if for different computers (for different memory chips). Both for previous similar known CVE-2020-10255 attack the AC:H used too.
Understanding the Weakness (CWE)
Other
Technical Impact: Quality Degradation; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
