Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
googleprojectzero.blogspot.com
Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
1–10 of 103 posts
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#2You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#3You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
A few years ago I built a home PC for myself and bought an i5 sandy bridge processor with an appropriate motherboard. A few months later it was found out that a huge batch of the SATA controllers shipped on those types of motherboards were faulty[0]. Back then, Intel made a statement recalling all faulty motherboards and shipping out new ones, I just contacted my retailer where I purchased my board, sent it for RMA and got a new one (different model, but that's another story). All of this for free.
[0] http://www.pcadvisor.co.uk/news/pc-components/3259061/intel-...
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#4Does anyone know if Macbooks are known to be affected?
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#5You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
In the EU, products have to be fit for purpose. You could then argue that if you bought (for example) a server for hosting virtual machines, then the RAM was not fit for purpose because the flaw made it incapable of isolating separate VMs.
Good luck trying that though!
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#6Does anyone know if Macbooks are known to be affected?
Download the tool and try it yourself? It supports Mac OS and there is a mailing list to report affected machines (nothing seems to be posted there yet).
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#7You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
Yes. This happened 20 years ago: http://en.wikipedia.org/wiki/Pentium_FDIV_bug
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#8Does anyone know if Macbooks are known to be affected?
Seems like my Macbook Air 2014 is not affected (with a high probability)
here's the test: https://github.com/google/rowhammer-test
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#9You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
Of the five vendors that they mentioned, the only one that did not have vulnerable memory was "DRAM vendor D", which also only had one entry on the table. Given the nature of the problem here, odds strike me as near-1 that "DRAM vendor D" has shipped RAM with this problem.
For that matter, the "no"s on that table really only prove that the exact stick they tested with the exact memory locations they tested did not exhibit detectable bit flips. It doesn't prove that those sticks are "safe", let alone that the product line they come from is safe.
So, basically, what's vulnerable? To a first approximation, everything. What would happen if we tried to recall every bit of DRAM produced in the past X years (where X is also unknown)? Well... you'd bankrupt the industry is what you'd do. That's not a very useful outcome.
In fact this sort of thing happens all the time. New safety tech is developed for cars all the time, but you can't go back and sue the auto companies for not including it before it was invented or the need for it was discovered [1]. This seems more like that problem than an actual problem of negligence or "defects" being produced.
[1]: Well... more or less. I know of cases where this was successfully done, though they tend to get overturned on appeal. Run with me here.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#10Surprised that the mitigations section did not mention ECC RAM. Wouldn't it be effective mitigation?