Would reducing the speed memory is clocked at prevent this?
Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
11–20 of 103 posts
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#12You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
Can you get killed as a result of privilege escalation? The law hasn't caught up in part because the potential consequences aren't nearly as dire.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#13Surprised that the mitigations section did not mention ECC RAM. Wouldn't it be effective mitigation?
"We also tested some desktop machines, but did not see any bit flips on those. That could be because they were all relatively high-end machines with ECC memory. The ECC could be hiding bit flips."
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#14Surprised that the mitigations section did not mention ECC RAM. Wouldn't it be effective mitigation?
Not necessary, see the original paper.
For example, SECDED (single error-correction, double error- detection) can correct only a single-bit error within a 64-bit word. If a word contains two victims, however, SECDED cannot correct the resulting double-bit error. And for three or more victims, SECDED cannot even detect the multi-bit er- ror, leading to silent data corruption.
Edit: link http://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.pdf
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#15Would reducing the speed memory is clocked at prevent this?
Anything that reduces the number of times memory can be accessed between refreshes can mitigate this, reducing RAM clock (probably) included
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#16Laptops are particularly at risk for stuff like this: components are more densely packed and may use smaller process sizes and have less powerful supplies which may be a factor in keeping bits in adjacent rows stable.
That may be the reason why the desktops mentioned are less sensitive, they'll use full size memory modules and will have beefy power supplies.
It'd be interesting to repeat the experiments with the laptops running off their internal battery.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#17You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
A few years ago I built a home PC for myself and bought an i5 sandy bridge processor with an appropriate motherboard. A few months later it was found out that a huge batch of the SATA controllers shipped on those types of motherboards were faulty[0]. Back then, Intel made a statement recalling all faulty motherboards and shipping out new ones, I just contacted my retailer where I purchased my board, sent it for RMA a…
Intel has a good history of recalls and replacements of their motherboards and processors. The Pentium FDIV bug comes to mind immediately, as does the recall of motherboards with the faulty 820-series memory translation hub.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#18Laptops are particularly at risk for stuff like this: components are more densely packed and may use smaller process sizes and have less powerful supplies which may be a factor in keeping bits in adjacent rows stable. That may be the reason why the desktops mentioned are less sensitive, they'll use full size memory modules and will have beefy power supplies. It'd be interesting to repeat the experiments with the lapt…
Also, lower refresh rates on DRAMs means less power consumption (so it's an easy fix in BIOS, independent of OS, clearly attractive to laptop makers), but also more exposition to this issue.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#19Very little information on time scales. In one case they speak about 5 minutes vs 40 minutes (both might be acceptable for an exploit). Also no information about how long it took to bitflip in their per-hardware table.
And why name no hardware vendor ? I'm guessing they expect people to use the tool they provided and draw their own conclusions, but I don't understand why they'd treat them differently from software vendors.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#20You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.
Can you get killed as a result of privilege escalation? The law hasn't caught up in part because the potential consequences aren't nearly as dire.
Modern medical technology relies heavily on computers and software. Take an infusion pump for example. Controlled by a microcontroller and using software. Or insulin pumps; and some vendors are actually considering to add Bluetooth to insulin pumps, so that patients using such a pump can check its status on their smartphone (or on the upcomming smart watches). Also you can adjust the infusion rate of an insulin pump to accommodate for ingested sugar. Overdosing on insulin can send a person into shock and kill.