Live data from Hacker News

Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

googleprojectzero.blogspot.com

41–50 of 103 posts

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#41
post #39
post #38

Now someone has to come up with a JavaScript version of this exploit and the disaster is complete.

More difficult since you can't execute CLFLUSH from there.

Maybe some JS commands trigger a CLFLUSH internally. I don't know, but it'd be "funny" if that exploit worked in JS.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#42

Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…

If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#43
post #14

Earlier quoted context omitted.

Not necessary, see the original paper. For example, SECDED (single error-correction, double error- detection) can correct only a single-bit error within a 64-bit word. If a word contains two victims, however, SECDED cannot correct the resulting double-bit error. And for three or more victims, SECDED cannot even detect the multi-bit er- ror, leading to silent data corruption. Edit: link http://users.ece.cmu.edu/~yoong…

Technically, SECDED cannot reliably detect errors involving more then 3 bits since they might generate a valid code, they might not however and in that case they might be detected as single or double bit error or possible something else.

Also the typical reaction to an uncorrectable ECC error is to halt the system with a NMI.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#44

Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…

If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)

It used to be the case that all AMD CPUs supported ECC back in the AM2/AM3 era, apparently this may no longer be true though. Not all motherboards bothered to route the extra traces required for it and include BIOS support though.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#45

Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…

I don't think laptops have SODIMM memory these days.

Depends on the laptop. I have bought two laptops in the past 14 months, a $2000 ThinkPad and a $600 Acer. Both came with 4GB soldered on and a single free SODIMM.

(On a different note: the ThinkPad maxes out at 8GB and the Acer at 12GB, whereas previous generations went up to 16GB at least. Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people)

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#46
post #45

Earlier quoted context omitted.

I don't think laptops have SODIMM memory these days.

Depends on the laptop. I have bought two laptops in the past 14 months, a $2000 ThinkPad and a $600 Acer. Both came with 4GB soldered on and a single free SODIMM. (On a different note: the ThinkPad maxes out at 8GB and the Acer at 12GB, whereas previous generations went up to 16GB at least. Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people)

Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people

Really? I think the latest Haswell can go to 16GB just fine if there are two SO-DIMM slots.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#47
post #43

Earlier quoted context omitted.

Technically, SECDED cannot reliably detect errors involving more then 3 bits since they might generate a valid code, they might not however and in that case they might be detected as single or double bit error or possible something else.

Also the typical reaction to an uncorrectable ECC error is to halt the system with a NMI.

Yeah, ECC is going to make exploiting this reliably a lot harder - you'd need to flip three or more bits in the right combination, without first hitting a combination of bits that'd be detected as an uncorrectable error. Google's report suggests they haven't even been able to cause uncorrectable two-bit errors yet, let alone undetectable three-bit ones.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#48
post #39
post #38

Now someone has to come up with a JavaScript version of this exploit and the disaster is complete.

More difficult since you can't execute CLFLUSH from there.

Maybe, though as they say it'd potentially be possible to cause a cache spill and attack it that way. I was looking at the associativity of various CPU caches with a vague eye to trying this in JavaScript a few days back and in theory it shouldn't take many reads to evict a cache line, so long as they're from the right addresses.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#49

Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…

If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)

> Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC.

Not true - there are some Atoms that do, but they're targeted at NAS type uses. It is the case you can't get Core-series processors with ECC.

AMD used to offer very broad support for ECC, but data integrity clearly didn't win market share.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#50
post #12

Earlier quoted context omitted.

Can you get killed as a result of privilege escalation? The law hasn't caught up in part because the potential consequences aren't nearly as dire.

Modern medical technology relies heavily on computers and software. Take an infusion pump for example. Controlled by a microcontroller and using software. Or insulin pumps; and some vendors are actually considering to add Bluetooth to insulin pumps, so that patients using such a pump can check its status on their smartphone (or on the upcomming smart watches). Also you can adjust the infusion rate of an insulin pump…

It's an interesting attack vector, recently covered by Person of Interest episode, in which an abusive husband got killed by having his insulin pump wirelessly hacked and making him overdose the drug. While fiction, I'm pretty sure this kind of thing will happen (after all, no one writes bug-free software, and even if, you can always steal the keys...) - and initially will be very hard to detect because of its uncommon nature.
Post reply on HN