3 ms·
Then why's the paper[1] say different? The odds of a double-flip are smaller than s single-flip; a single flip gets corrected, a double stops the box (depending
by greglindahl 11y ago
Then why's the paper[1] say different? The odds of a double-flip are smaller than s single-flip; a single flip gets corrected, a double stops the box (depending on the bios etc), an even rarer triple may not get detected... the odds are exactly why it just takes longer. This paper reports observing it happening.
1: http://www.thirdio.com/rowhammer.pdf http://www.thirdio.com/rowhammer.pdf
- nkurz 11y agoI presume 'tdullien' assumes that "attack" refers to privilege escalation. I think he's claiming you are unlikely to get an undetected and exploitable triple bit flip before you crash the machine with the more single and double bit flips. Thus he says that ECC "turns it from an exploitable security issue into a denial-of-service issue". Does the paper claim that in fact triple bit flips are sufficiently more frequent than one would expect, and thus an exploitable security issue still exists with ECC? This would be interesting news. But if you are defining "attack" to include denial-of-service by crashing the machine, I presume the disagreement is only about terminology.