Google says Rowhammer attacks are gaining range as RAM is getting denser • Hacker News Board

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#41

Post by chmod775 » Fri, May 28, 2021, 8:44 PM UTC

CalChris wrote: post #36

campuscodi wrote: post #10

Earlier quoted context omitted.

Yes, Rowhammer can bypass ECC. Forgot to include this in the article, mainly because there's so much Rowhammer research. See here: https://www.vusec.net/projects/eccploit/

Can Rowhammer bypass ECC and not be detected by an hw_event_mc_err_type ? I don't think so. Why would someone have ECC without a sufficiently sophisticated driver?

> Can Rowhammer bypass ECC and not be detected by an hw_event_mc_err_type?

Afaik, yes it can (unless you're counting HW_EVENT_ERR_CORRECTED). They specifically try to get 1 or 3 bit flips, never 2.

See here: https://www.vusec.net/projects/eccploit/

(yes, that's the same link)

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#42

Post by [deleted] » Fri, May 28, 2021, 8:50 PM UTC

CalChris wrote: post #36

campuscodi wrote: post #10

Earlier quoted context omitted.

Yes, Rowhammer can bypass ECC. Forgot to include this in the article, mainly because there's so much Rowhammer research. See here: https://www.vusec.net/projects/eccploit/

Can Rowhammer bypass ECC and not be detected by an hw_event_mc_err_type ? I don't think so. Why would someone have ECC without a sufficiently sophisticated driver?

[deleted]

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#43

Post by kuschku » Fri, May 28, 2021, 8:51 PM UTC

karmicthreat wrote: post #3

Is there any evidence of Rawhammer being used in a successful attack in the wild?

Wasn’t there a rowhammer based website for rooting android phones in the past?

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#44

Post by a1369209993 » Fri, May 28, 2021, 8:51 PM UTC

CalChris wrote: post #36

campuscodi wrote: post #10

Earlier quoted context omitted.

Yes, Rowhammer can bypass ECC. Forgot to include this in the article, mainly because there's so much Rowhammer research. See here: https://www.vusec.net/projects/eccploit/

Can Rowhammer bypass ECC and not be detected by an hw_event_mc_err_type ? I don't think so. Why would someone have ECC without a sufficiently sophisticated driver?

> Can Rowhammer bypass ECC and not be detected by an hw_event_mc_err_type?

It's definitely possible in theory. You'd need four bit flips rather than three, so you'd probably need more time between accesses to the victim row, but thats a quantitative improvement at best. This can be mitigated by using different ECC bit encodings per memory location[0], so hammered data, with correct ECC for its row, always has wrong ECC values for the adjacent rows, but I don't think anyone does that.

0: This is important in order to make fake ECC memory, which uses a (cheap) combinatoric circuit in place of a (more expensive) ninth DRAM chip, not work, so it should be happening even without Rowhammer, but AFAIK it isn't.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#45

Post by sroussey » Fri, May 28, 2021, 9:17 PM UTC

notriddle wrote: post #28

creato wrote: post #22

Earlier quoted context omitted.

DRAM manufacturers continue (knowingly at this point) to manufacture faulty products, and we should blame Intel?

Yes. Intel is an industry leader. EFI, Thunderbolt, and the "ultrabook" product category are all their ideas. By adding a feature to their CPU products, they induce demand for anything that complements it. By putting ECC support into their highest-end mobile CPUs only, they made them into high-end luxuries instead of industry standard. https://ark.intel.com/content/www/us/en/ark/search/featurefi...

That doesn’t explain Apple and the M1 though.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#46

Post by GekkePrutser » Fri, May 28, 2021, 9:36 PM UTC

staticassertion wrote: post #39

campuscodi wrote: post #10

Earlier quoted context omitted.

Yes, Rowhammer can bypass ECC. Forgot to include this in the article, mainly because there's so much Rowhammer research. See here: https://www.vusec.net/projects/eccploit/

It's really worth noting that ECC does impact Rowhammer effectiveness, even if it is not enough to prevent the attack 100% of the time.

But as part of this it'll also have a high chance of triggering a system shutdown due to ECC mismatch, right? So in most cases it can't be exploited for things other than DoS.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#47

Post by vbezhenar » Fri, May 28, 2021, 9:37 PM UTC

notriddle wrote: post #9

In other words, blame Intel for trying to pass off ECC as a "Enterprise Feature" instead of the basic necessity that it is.

Do you think many Ryzen PCs use ECC? I doubt that. It's accepted truth among gamers and power users, that ECC is waste of budget. I don't share this position, but if you'd ask on some computer forums, that's what you'll hear. If ECC would be enabled on all Intel CPUs, nothing fundamentally would change, most users would prefer to save 10% on their RAM.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#48

Post by GekkePrutser » Fri, May 28, 2021, 9:38 PM UTC

creato wrote: post #22

notriddle wrote: post #9

In other words, blame Intel for trying to pass off ECC as a "Enterprise Feature" instead of the basic necessity that it is.

DRAM manufacturers continue (knowingly at this point) to manufacture faulty products, and we should blame Intel?

They could include ECC but it wouldn't work on most systems so why would they bother?

At least on AMD it works these days.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#49

Post by GekkePrutser » Fri, May 28, 2021, 9:40 PM UTC

vbezhenar wrote: post #47

notriddle wrote: post #9

In other words, blame Intel for trying to pass off ECC as a "Enterprise Feature" instead of the basic necessity that it is.

Do you think many Ryzen PCs use ECC? I doubt that. It's accepted truth among gamers and power users, that ECC is waste of budget. I don't share this position, but if you'd ask on some computer forums, that's what you'll hear. If ECC would be enabled on all Intel CPUs, nothing fundamentally would change, most users would prefer to save 10% on their RAM.

I don't use it on mine, but my Ryzen PC is my gaming box.. Where the impact from such things is very limited.

But ECC RAM is a lot more than 10% more expensive. This is part of the problem. Intel pushes it into a high-end niche which puts it in a much more expensive category, and it also loses economy of scale.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#50

Post by nightfly » Fri, May 28, 2021, 9:47 PM UTC

creato wrote: post #22

notriddle wrote: post #9

In other words, blame Intel for trying to pass off ECC as a "Enterprise Feature" instead of the basic necessity that it is.

DRAM manufacturers continue (knowingly at this point) to manufacture faulty products, and we should blame Intel?

How many times more expensive would DRAM that is immune to rowhammer cost?