Even the most sacred memory table is, at its physical core, an array of tiny spark charge banks.
Lin Tao sat cross-legged before the chalk-marked boundary of his probe array. His land-mapper metal pen was held ready in his right hand. The out-of-bounds pointer write was queued in the CPU’s store buffer. But it was held back by the Extended Page Table permissions. Page Table Entry 0x184180, bit one, remained set to zero. Read-Only.
In physical silicon security research, Lin Tao reviewed, there exists an exploit that bypasses all software permissions without executing a single privileged order: Rowhammer.
DRAM chips were composed of millions of memory cells arranged in dense physical rows and columns. Each memory cell consisted of a single transistor and a tiny charge bank storing a spark charge representing a twin one or zero.
The physical rows were spaced mere nanometers apart. Because of that, accessing one row repeatedly at high hum caused magnetic crosstalk.
The rapid voltage oscillations along the wordline leaked spark charge into the charge banks of next-door, untouched rows. If a row was hammered fast enough before the memory controller could issue a refresh cycle, the leaked charge caused a bit flip!
A twin zero in a next-door row would flip to a twin one.
