4 ms·
Co-author of the original exploit writing here. ECC doesn't "make the attack take longer", it turns it from an exploitable security issue into a denial-of-servi
by tdullien 11y ago
Co-author of the original exploit writing here. ECC doesn't "make the attack take longer", it turns it from an exploitable security issue into a denial-of-service issue (as odds are the ECC will detect the bitflip and the kernel will shut down the box).
- nickpsecurity 11y agoI noticed supercomputer vendors and Oracle are using ChipKill plus ECC. Does adding that change the results any or still reduce to DOS?
- tdullien 11y agoSo I do not know (in the mathematical sense) that ChipKill won't create a problem, but I think it is unlikely. In general, if the ECC infrastructure works (e.g. DRAM detecting bit corruption and reporting it to the OS), the odds of an attacker finding a piece of RAM that flips bits "just right" to bypass the checksumming without triggering a OS panic are low enough that I'd rather worry about software bugs. DoS may still be a pretty viable attack, though.
- baruch 11y agoIt can mitigate the DoS if you have enough spare RAM. if you are right on the edge that removed RAM will turn into an OOM condition and will become a DoS.
- darkr 11y agoNot just supercomputer vendors - Chipkill has been a standard option on IBM X-Series (their standard server range) for years now. I remember deploying a whole bunch of servers back 2011 or so that had it.
- nickpsecurity 11y agoAppreciate everyone's insightful replies. :)
- greglindahl 11y agoThen why's the paper[1] say different? The odds of a double-flip are smaller than s single-flip; a single flip gets corrected, a double stops the box (depending on the bios etc), an even rarer triple may not get detected... the odds are exactly why it just takes longer. This paper reports observing it happening. 1: http://www.thirdio.com/rowhammer.pdf http://www.thirdio.com/rowhammer.pdf
- nkurz 11y agoI presume 'tdullien' assumes that "attack" refers to privilege escalation. I think he's claiming you are unlikely to get an undetected and exploitable triple bit flip before you crash the machine with the more single and double bit flips. Thus he says that ECC "turns it from an exploitable security issue into a denial-of-service issue". Does the paper claim that in fact triple bit flips are sufficiently more frequent than one would expect, and thus an exploitable security issue still exists with ECC? This would be interesting news. But if you are defining "attack" to include denial-of-service by crashing the machine, I presume the disagreement is only about terminology.
- rodgerd 11y agoThat could still be extraordinarily entertaining for an attacker to execute on a shared hosting environment, though.