Slashdot Mirror
Rowhammer Attacks Can Now Bypass ECC Memory Protections (zdnet.com)
Catalin Cimpanu, reporting for ZDNet: Academics from the Vrije University in Amsterdam, Holland, have published a research paper this week describing a new variation of the Rowhammer attack. For readers unfamiliar with the term, Rowhammer is the name of a class of exploits that takes advantage of a hardware design flaw in modern memory cards. By default, a memory card stores temporary data inside storage units named cells, which are arranged on the physical silicon chip in multiple rows, in the form of a grid. [...] In research [PDF] published today, named ECCploit, academics expanded the previous Rowhammer techniques with yet another variation. This one, they said, bypasses ECC memory, one of the memory protections that hardware makers said could detect and prevent Rowhammer attacks in the past.
ECC stands for Error-Correcting Code and is a type of memory storage included as a control mechanism with high-end RAM, typically deployed with expensive or mission-critical systems. ECC memory works by protecting against rogue bit flips, like the ones caused by Rowhammer attacks. Surprisingly, it wasn't developed to deal with Rowhammer. It was initially developed in the 90s to protect against bit flips caused by alpha particles, neutrons, or other cosmic rays, but when Rowhammer came out, it also proved to be effective against it, as well. But after spending months reverse engineering the designs of ECC memory, the Vrije University team discovered that this protection mechanism has its limits.
ECC stands for Error-Correcting Code and is a type of memory storage included as a control mechanism with high-end RAM, typically deployed with expensive or mission-critical systems. ECC memory works by protecting against rogue bit flips, like the ones caused by Rowhammer attacks. Surprisingly, it wasn't developed to deal with Rowhammer. It was initially developed in the 90s to protect against bit flips caused by alpha particles, neutrons, or other cosmic rays, but when Rowhammer came out, it also proved to be effective against it, as well. But after spending months reverse engineering the designs of ECC memory, the Vrije University team discovered that this protection mechanism has its limits.
as being able to bypass ECC Memory Protections.
It has been possible all along, it is just that someone has publicly proved that the theoretical vulnerability is an actual vulnerability. VERY important difference from title, since this could have allowed the compromise of servers since DDR3 came out and maybe even further back (although the glitches allowing this were only proven in certain brands of DDR3 early on. I have not heard whether it is now ALL DDR3, or still only certain DDR3 lithography processes.
Assumed DDR4 is also compromised until you hear otherwise, and for anything that needs security, only run buffered ram, which is believed resistant if not immune to the attack.
Doesn't Address Space Layout Randomisation basically make this impractical?
https://en.wikipedia.org/wiki/...
The fact that servers normally utilize ECC RAM is probably the main reason this didn't blow up into a Spectre-style fiasco. I expect plenty of scrambling, in addition to slowdowns in VMs attempting to detect Rowhammer exploits. Rowhammer resistance for DRAM might be developed now, just like how Spectre resistance was a bullet point for the latest Intel CPUs, which is good since consumer devices were left vulnerable to Rowhammer.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Unregistered ECC is basically only ever used on consumer grade chips. Registered memory is supported on anything server grade, and is usually cheaper than unregistered for the same capacity.
The concern here is it means systems that DO support unregistered ECC, specifically AMD 939-AM4 systems and 115x series Xeons/Pentiums are now proven susceptible to rowhammer attacks, which means unless you keep them isolated from the possibility of exploits or running unverified remote code (like javascript), they can be hacked from even unprivileged user code without any software exploits on the system itself.
I have a very vague notion about how row hammer operates but it's really vague. COuld someone explain it both in terms of how it works, how one gets sidechannel information from being able to flip the bits, and then, pratically, how one makes a nefarious use out of spotty info.
Some drink at the fountain of knowledge. Others just gargle.
Alpha Particles.. Lol... This author did not do his homework.. I piece of paper can stop an Alpha Particle... No way is an Alpha going to penetrate all the matter surrounding the memory silicon..
No, the AC fails his homework. The alpha particles that caused problems in the past came from inside the chip packaging itself. DRAM manufacturers now go to great lengths to exclude any isotopes that could undergo alpha decay in their chips.
If you want to play this game of unlimited AC posts, then I have unlimited mod points.
Usually I don't bother because your shit is too funny.
ZIP
The real issue is that ECC memory is so expensive that it is not often used. It should be used everywhere.
A few extra bits should only cost a few extra percent. But the price triples because it is considered a fancy server feature.
I suspect many system crashes and unrepeatable bugs are due to rare random memory errors. I had once buggy memory and it was maddening until sorted. And memory thrashers never found the issue.
Operating systems should get very upset at more than a few correctable ECC errors, closing down pages of memory, error messages to users etc. But they probably don't.
Was always curious why rowhammer still works after scramblers built into current day memory controllers. They explain some of the reason it still works on page 10.
S|TME (total memory encryption) should be completely effective against these types of problems in future hardware.