Live data from Hacker News

Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

googleprojectzero.blogspot.com

31–40 of 103 posts

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#31

Is a memory error actually an exploit? If so then are the unwanted changes that occur with no deliberate action an example of the computer cracking itself? Philosophical...

I think there is a useful distinction between a fault/error and an exploit. A fault is a break from the "desired" or "expected" semantics of a system, while an exploit is an algorithm to predictably utilize a fault (or faults) to access unexpected behaviours in that system. I.e., a buffer overflow is a fault in a program (breaking the expectation that a buffer's contents will remain within a certain bound), while an exploit targeting that overflow will likely allow running arbitrary code in a program not designed to do so.

So, I'd put it, the memory error can be leveraged in an exploit.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#32
There was an older paper discussing using various methods of fault injection (heat, voltage changes, etc) to attack Java smart cards, essentially destroying the type system guarantees and thus opening up an attack surface: "The Sorcerer’s Apprentice Guide to Fault Attacks", https://eprint.iacr.org/2004/100.pdf

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#33
post #19

Very little information on time scales. In one case they speak about 5 minutes vs 40 minutes (both might be acceptable for an exploit). Also no information about how long it took to bitflip in their per-hardware table. And why name no hardware vendor ? I'm guessing they expect people to use the tool they provided and draw their own conclusions, but I don't understand why they'd treat them differently from software ve…

At a guess to avoid labeling laptop manufacturers and getting sued if it turns out that something else was at fault? The DRAM itself might be the culprit (probably is), laptops of a certain brand might come with RAM from different manufacturers.

I understood the litigation risk. In an integrated system it's always someone else's fault (DRAM, BIOS, CPU, laptop vendor). IMHO the last integrator (the one selling you the goods) is always the culprit.

Why would they fear hardware manufacturers' litigation more than software vendors' ? Especially at such a big company like Google ?

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#35
post #33

Earlier quoted context omitted.

At a guess to avoid labeling laptop manufacturers and getting sued if it turns out that something else was at fault? The DRAM itself might be the culprit (probably is), laptops of a certain brand might come with RAM from different manufacturers.

I understood the litigation risk. In an integrated system it's always someone else's fault (DRAM, BIOS, CPU, laptop vendor). IMHO the last integrator (the one selling you the goods) is always the culprit. Why would they fear hardware manufacturers' litigation more than software vendors' ? Especially at such a big company like Google ?

They also don't want to say "DellappLenoHP" laptops could not be attacked and turn out to be wrong. Or maybe they're right but only with factory 2GB modules used between May '11 and July '13.

Way too many variables to make any claims that is ethically defensible.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#36
post #5
post #2

You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.

In the EU, products have to be fit for purpose. You could then argue that if you bought (for example) a server for hosting virtual machines, then the RAM was not fit for purpose because the flaw made it incapable of isolating separate VMs. Good luck trying that though!

On the other hand, servers tend to use ECC memory.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#37
post #14
post #10

Surprised that the mitigations section did not mention ECC RAM. Wouldn't it be effective mitigation?

Not necessary, see the original paper. For example, SECDED (single error-correction, double error- detection) can correct only a single-bit error within a 64-bit word. If a word contains two victims, however, SECDED cannot correct the resulting double-bit error. And for three or more victims, SECDED cannot even detect the multi-bit er- ror, leading to silent data corruption. Edit: link http://users.ece.cmu.edu/~yoong…

Technically, SECDED cannot reliably detect errors involving more then 3 bits since they might generate a valid code, they might not however and in that case they might be detected as single or double bit error or possible something else.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#40
post #12
post #2

You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn't caught up with technology.

Can you get killed as a result of privilege escalation? The law hasn't caught up in part because the potential consequences aren't nearly as dire.

You can get killed as the result of a race condition[0] so privilege escalation is certainly possible.

[0] https://en.wikipedia.org/wiki/Therac-25

Post reply on HN