Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

51–60 of 103 posts

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#51

Post by MichaelGG »

ChuckMcM wrote: post #21

Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…

Not just laptops! SQL Azure doesn't use ECC memory[1], which might suggest the rest of the Azure platform doesn't, either. I haven't found citations for AWS using ECC, so perhaps they don't. Maybe this could be used to break out of VMs on those platforms.

1: https://social.msdn.microsoft.com/Forums/azure/en-us/84000f7... (I remember I asked about Windows Azure, but my posting clearly says SQL Azure, so perhaps it's a different hardware platform.)

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#52

Post by mindslight »

ScottBurson wrote: post #42
ChuckMcM wrote: post #21

Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…

If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)

i3 are dual cores that support ECC, aimed at NAS and the like (hence mini ITX boards with ECC SODIMMs). But you still need an explicit workstation chipset/mobo to support it.

i5 and i7 have no ECC because there are equivalent Xeons. At this level "Xeon" is just branding implying features like ECC, and it doesn't automatically mean expensive - a single socket non-E (LGA1150) Xeon build costs only a little more (~20%) than consumer cpu/mobo/ram (although there's better sales on the consumer stuff).

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#53

Post by bri3d »

sharkbot wrote: post #32

There was an older paper discussing using various methods of fault injection (heat, voltage changes, etc) to attack Java smart cards, essentially destroying the type system guarantees and thus opening up an attack surface: "The Sorcerer’s Apprentice Guide to Fault Attacks", https://eprint.iacr.org/2004/100.pdf

Fault injection is also how older Dish Network and DirecTV smart cards were hacked - there used to be a cottage industry selling "voltage glitchers" to reprogram Dish Network smart cards with the keys for additional programming tiers.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#54

Post by tux3 »

aselzer wrote: post #8
0x0 wrote: post #4

Does anyone know if Macbooks are known to be affected?

Seems like my Macbook Air 2014 is not affected (with a high probability) here's the test: https://github.com/google/rowhammer-test

Thanks for the link.

I haven't seen anything after 375 iterations (600s). So I may still be exploitable, but that means you'd have to keep something running at 100% CPU for > 600s and somehow have me not notice the laptop fans going crazy.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#55

Post by MichaelGG »

yuhong wrote: post #46
sspiff wrote: post #45

Earlier quoted context omitted.

Depends on the laptop. I have bought two laptops in the past 14 months, a $2000 ThinkPad and a $600 Acer. Both came with 4GB soldered on and a single free SODIMM. (On a different note: the ThinkPad maxes out at 8GB and the Acer at 12GB, whereas previous generations went up to 16GB at least. Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people)

Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people Really? I think the latest Haswell can go to 16GB just fine if there are two SO-DIMM slots.

There are 16GB SODIMMs, so why isn't Intel supporting those? The company that makes them claims this is purely on Intel/OEMs.

1: http://www.intelligentmemory.com/dram-modules/ddr3-so-dimm/

Update: Oh wow, the new Broadwell chips do support them. So maybe the new ThinkPad X250 isn't so useless after all! This is great news if true.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#56

Post by ferrari8608 »

makomk wrote: post #44
ScottBurson wrote: post #42

Earlier quoted context omitted.

If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)

It used to be the case that all AMD CPUs supported ECC back in the AM2/AM3 era, apparently this may no longer be true though. Not all motherboards bothered to route the extra traces required for it and include BIOS support though.

All AMD FX and Opteron CPUs support ECC. The APUs do not. For the CPUs that support ECC, it is still up to the motherboard manufacturer to support it on their end as well.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#57

Post by otakucode »

yuhong wrote: post #34

memtest86 etc should add tests for this if they didn't already, as this is the best place for such tests.

If they did so... the fallout would be interesting. Does anyone know what proportion of modern memory has this flaw? Would it result in tens of thousands of customers returning stick after stick of DRAM until they were able to get a reliable one?

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#58

Post by zf00002 »

rodgerd wrote: post #49
ScottBurson wrote: post #42

Earlier quoted context omitted.

If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)

> Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. Not true - there are some Atoms that do, but they're targeted at NAS type uses. It is the case you can't get Core-series processors with ECC. AMD used to offer very broad support for ECC, but data integrity clearly didn't win market share.

This is no longer true either. Intel has consumer desktop Celeron, Pentium, and i3 series chips that support ECC.

The i3's in particular are fairly popular with FreeNAS users.

http://ark.intel.com/search/advanced?s=t&SocketsSupported=FC...

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#59

Post by tenfingers »

otakucode wrote: post #57
yuhong wrote: post #34

memtest86 etc should add tests for this if they didn't already, as this is the best place for such tests.

If they did so... the fallout would be interesting. Does anyone know what proportion of modern memory has this flaw? Would it result in tens of thousands of customers returning stick after stick of DRAM until they were able to get a reliable one?

memtest86 has this feature in beta, and it's already generating some heat.

I would be personally more interested in this test on memtest86+ though.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#60

Post by zf00002 »

mindslight wrote: post #52
ScottBurson wrote: post #42

Earlier quoted context omitted.

If I understand correctly, Intel doesn't even ship a consumer CPU (i.e., a non-Xeon) that supports ECC. (Don't know about AMD.)

i3 are dual cores that support ECC, aimed at NAS and the like (hence mini ITX boards with ECC SODIMMs). But you still need an explicit workstation chipset/mobo to support it. i5 and i7 have no ECC because there are equivalent Xeons. At this level "Xeon" is just branding implying features like ECC, and it doesn't automatically mean expensive - a single socket non-E (LGA1150) Xeon build costs only a little more (~20%)…

Heck, if you are buying a non-K series i7, the equivalent Xeon E3 will probably be cheaper by a few dollars.
Post reply on HN