Once Thought Safe, DDR4 Memory Shown To Be Vulnerable To 'Rowhammer' (arstechnica.com)

An anonymous reader writes from an Ars Technica article: Physical weaknesses in memory chips that make computers and servers susceptible to hack attacks dubbed "Rowhammer" are more exploitable than previously thought and extend to DDR4 modules, not just DDR3, according to a recently published research paper. The paper, titled How Rowhammer Could Be Used to Exploit Weaknesses in Computer Hardware (PDF), arrived at that conclusion by testing the integrity of dual in-line memory modules, or DIMMs, using diagnostic techniques that hadn't previously been applied to finding the vulnerability. The tests showed many of the DIMMs were vulnerable to a phenomenon known as "bitflipping," in which 0s were converted to 1s and vice versa.

Comments

Pratchett's Woodpecker

[spiritplumber]

I know it's a problem, but love how this works. Wonder if it was around when Going Postal was written.

Re:Pratchett's Woodpecker

[Anne Thwacks]

It has been around as long as semiconductor memory has been around. And not just in DRAM. Static memory, including on-cpu cache can have it. It is a well known potential defect that should be tested for during manufacture.

Some manufacturers cheat.

Re:Pratchett's Woodpecker

[Megol]

Bullshit. The cheat part that is, that nearby signals can interfere is true but trivially so. Water is wet, signals can interfere - so what?

The problems isn't caused by cheating and implying that not only confuses people but also takes away the important lesson that computers are complex on many levels and that avoiding bugs is f-king hard.

[And that critical systems should have ECC in hardware, software or preferably both]

Names

[Anonymous Coward]

Why does every exploit need a trendy name? Rowhammer, Superfish, Heartbleed, etc. just sound dumb.

Re:Names

[peragrin]

Have you ever heard of hacking groups that didn't have trendy names?

Also rowhammer is what it does. It is descriptive.

Re:Names

[Zero__Kelvin]

Because Bit Tickler sounds like a marital aid?

Re:Names

[Anonymous Coward]

You sure did. If you had a proper cock, you would have rubbed her tonsils raw.

Re:Names

[skids]

Mostly only the newsworthy ones get them, ones that need widespread attention even for administrative domains that can't afford a dedicated security person/department. It's a lot easier to give them names then have meetings saying "where do we stand on CVE-year-four-digit-number" simply because the human brain wraps around names better. Especially if a clue as to the shape of the exploit is embedded in the name, serving as a mnemonic -- e.g. HeartBlead is used to blead information from heartbeat exchanges.

Re:Names

[Anonymous Coward]

You sure did. If you had a proper cock, you would have rubbed her tonsils raw.

lol good one

duplicate

[Anonymous Coward]

Slashdot...always late as usual... no wonder everybody goes to HackerNews.

So why haven't you promoted my submitted story from yesterday? https://slashdot.org/submission/5686403/rowhammer-attack-now-works-on-ddr4-memory

We need a cartoon to demonstrate the bit flipping

[JoeyRox]

https://www.youtube.com/watch?...

Re:frost 4ist!

[KiloByte]

goat.cx

Warning! Do not click this link -- it's an advertisement for a sleazy domain peddler rather than a bona-fide goatse mirror.

The only safe device

[JustAnotherOldGuy]

I'm convinced that the only safe device these days is a Speak 'N Spell. (I heard the Etch A Sketch is vulnerable to "vibration-hacking" and "elbow-jogging" attacks by annoying younger brothers and sisters.)

Ha ha I'm safe

[JustAnotherOldGuy]

Ha ha, I'm safe because I'm still using 16-pin DIPs in my PC XT. Suck it, hackers!

Is this DIMM specific or is it IC specific?

[Anonymous Coward]

Do they have information on which ICs were used in the DIMMs?

Not an exploit...

[Anonymous Coward]

This is just a characteristic of modern memory. If you run "good" quality memory
at its rated speed, timing, and voltage, you'll get random errors - even after memtest.
I've discovered that if I increase the ram's voltage, I can eliminate these faults w/o
playing with any of the timing, etc.) I do *a lot* on my box that persists (as opposed to
a game where a flipped pixel will not be noticed), so I was actually able to consistently
reproduce the error. Not saying upping the voltage is everybody's answer, but it seems
the stock 1.5 volts is too low for the density of these chips.

CAP === 'picking'

Re: Not an exploit...

[Anonymous Coward]

It's why the general consumer market should be using using ECC as part of the default standard. its one thing to have a odd display glitch, it's quite another to have data corrupted in RAM and then be commited to disk.

1001001 in distress?

[Zero__Kelvin]

Getty Lee is already well aware of this pattern!

Re:1001001 in distress?

[pepsikid]

Dude, that's Geddy Lee, as in, how his Polish granny pronounced his birth name "Gary Lee Weinrib".

Re:1001001 in distress?

[pepsikid]

Er, his momma, anyway.

Fix?

[MichaelKaiserProScri]

Wouldn't a fairly simple fix be to make it so that consecutive rows in the RAM do not correspond to consecutive memory addresses? The virtual memory manager is already serving up the physical RAM in 4k pages. Right now the rows within the 4k page are consecutive, but any given block of RAM bigger than 4k may actually be comprised of pages from anywhere in the physical RAM. If you reordered the rows within the 4k page at a hardware level it would be difficult to know which rows were actually consecutive. Potentially use a different order for each page. If done on a hardware level this would add a tiny bit of overhead, but not that much. Basically you would need a mapping table that could translate a 12 bit value into some other 12 bit value.

Re:Fix?

[Anonymous Coward]

Yes, but that would make it harder for operating systems to protect against this kind of exploit once someone actually figures out a viable attack.
With consecutive rows it is just a matter of allocating buffer pages between different programs allocation to prevent one form accessing another.
Scatter the addresses around and that method will be a lot more complex. Exploit programmers will however still be able to target a specific system.

Re:Fix?

[mathew7]

Actually, just switching the LSBs from the row address would be enough, with the manufacturer hiding it (or even better: randomizing).
Since "researching" for this, I saw some information that they already have a mapping for production yelding; which is logical, as you can get more chips with target-size+10% and 91% working (100 from 110) than target-sized and perfect. But I think they currently just "skip", instead of re-arrange rows.
Also, the individual chips which eventually feed the 64-bit bus (with 512bits in 1 DDR3 cycle) could be configured differently (so 2 consecutive rows as seen by the CPU could have only some physical adjacency...think about modules with 8 or 16 chips).

Re:Fix?

[mathew7]

I don't support making a SW protection in the 1st place. It just adds complexity which could open another door. SW is NOT the answer to everything.

Re:Fix?

[Anonymous Coward]

I read the original article back when it was first published. The exploit does not rely on knowing how things are laid out in RAM. It allocates a massive TLB, then hammers RAM as hard as it can until it gets lucky and flips the right bit in the TLB to give itself write access to its own TLB. From there, you own the machine.

Never had this happen

[Chirs]

As far as I know I've never had this happen on any of my machines. Laptops, tablets, Android media boxes, or desktop. It just hasn't been an issue.