“An example is the Google Pixel: of the three devices that we bought, we could only flip bits on two of them.” “This is why we state that every mobile device with LPDDR2, LPDDR3, or LPDDR4 is potentially affected: we have seen flips on devices shipped with all these types of memory, but we have also seen devices without any bit flips,” van der Veen explained in the email. In a blog post published last Wednesday, Van der Veen and his colleagues said that “every mobile device that is shipped with LPDDR2, LPDDR3, or LPDDR4 memory is potentially affected, which is effectively every mobile phone since 2012.” In an email, he said that he and his colleagues have successfully achieved bit flips on Nexus 5 devices shipped with LPDDR3, a Nexus 4 with LPDDR2, and a Google Pixel 1 with LPDDR4, but they have not done it consistently. If we then allocate a large chunk, chances of getting contiguous memory increase, and we can confirm this by using existing side channels.” By allocating and releasing memory chunks, we can ‘defragment’ physical memory, freeing up large holes. “Taking the disabled contiguous heap as an example again, we found that you can still obtain physically contiguous memory by playing with the allocator.

“With RAMpage, we show that the deployed software patches are not good enough,” Victor van der Veen, a Vrije Universiteit Amsterdam professor who helped devise both Drammer and RAMpage exploits, wrote in an email.

Slay the spire rampage