On June 11th, security researchers published a paper titled “RAMBleed Reading Bits in Memory without Accessing Them”. This paper describes vector against Dynamic Random Access Memory (DRAM) modules that are already susceptible toRowhammer-style attacks.
Systems using DRAM modules mitigated against Rowhammer style attacks remain protected from RAMBleed.
This vector may affects hardware products, among which some used by OVH.
This vulnerability has been referenced as:
According to the researchers, “RAMBleed’s rate of reading memory is modest, toping at around 3–4 bits per second. This allows sufficient time for memory scrubbing countermeasures to remove shortlived secret data from the target’s memory.“
At this point of time, OVH has not received any information demonstrating that the vector has been exploited on its infrastructure.
Note that in order to gain access to a secret, the attacker should be authenticated on the operating system, and no other process should be running.
We estimate the risk for our clients as very low as this vector is unable to cross Virtual Machine boundaries.
To remain up to date on any topic regarding OVH’s technical environment, do not hesitate to consult regularly:
