Now someone has to come up with a JavaScript version of this exploit and the disaster is complete.
More difficult since you can't execute CLFLUSH from there.
Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
41–50 of 103 posts
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#42Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#43Earlier quoted context omitted.
Not necessary, see the original paper. For example, SECDED (single error-correction, double error- detection) can correct only a single-bit error within a 64-bit word. If a word contains two victims, however, SECDED cannot correct the resulting double-bit error. And for three or more victims, SECDED cannot even detect the multi-bit er- ror, leading to silent data corruption. Edit: link http://users.ece.cmu.edu/~yoong…
Technically, SECDED cannot reliably detect errors involving more then 3 bits since they might generate a valid code, they might not however and in that case they might be detected as single or double bit error or possible something else.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#44Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…
If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#45Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…
I don't think laptops have SODIMM memory these days.
(On a different note: the ThinkPad maxes out at 8GB and the Acer at 12GB, whereas previous generations went up to 16GB at least. Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people)
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#46Earlier quoted context omitted.
I don't think laptops have SODIMM memory these days.
Depends on the laptop. I have bought two laptops in the past 14 months, a $2000 ThinkPad and a $600 Acer. Both came with 4GB soldered on and a single free SODIMM. (On a different note: the ThinkPad maxes out at 8GB and the Acer at 12GB, whereas previous generations went up to 16GB at least. Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people)
Really? I think the latest Haswell can go to 16GB just fine if there are two SO-DIMM slots.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#47Earlier quoted context omitted.
Technically, SECDED cannot reliably detect errors involving more then 3 bits since they might generate a valid code, they might not however and in that case they might be detected as single or double bit error or possible something else.
Also the typical reaction to an uncorrectable ECC error is to halt the system with a NMI.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#48Now someone has to come up with a JavaScript version of this exploit and the disaster is complete.
More difficult since you can't execute CLFLUSH from there.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#49Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…
If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)
Not true - there are some Atoms that do, but they're targeted at NAS type uses. It is the case you can't get Core-series processors with ECC.
AMD used to offer very broad support for ECC, but data integrity clearly didn't win market share.
Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
#50Earlier quoted context omitted.
Can you get killed as a result of privilege escalation? The law hasn't caught up in part because the potential consequences aren't nearly as dire.
Modern medical technology relies heavily on computers and software. Take an infusion pump for example. Controlled by a microcontroller and using software. Or insulin pumps; and some vendors are actually considering to add Bluetooth to insulin pumps, so that patients using such a pump can check its status on their smartphone (or on the upcomming smart watches). Also you can adjust the infusion rate of an insulin pump…