Redirecting DRAM memory pages: Examining the threat of system memory Hardware Trojans

Abstract

The trustworthiness of electronic components procured and deployed in critical infrastructure can not be guaranteed. These components may contain Hardware Trojans. Understanding the threat characteristics of these Hardware Trojans is critical to the development of future security risk mitigations. One key threat is posed by Hardware Trojans located in System Memory chips, such as those found in DIMM memory. We present a physical prototype of a Memory Hardware Trojan that only requires 230 slices, performs physical page address redirection, operates in standard systems, and can be leveraged by an unprivileged software process to bypass memory protection. We demonstrate the effectiveness of our trojan with privilege escalation and virtual machine breakout use cases. Based on our designs and experimental findings, we identify insights and discuss mitigation strategies.