5 ms·
Rowhammer-test – Test DRAM for bit flips caused by the rowhammer problem (2015)
- okket 10y agoLast commit: 11 Aug 2015, maybe add (2015) to the headline?
- BoorishBears 10y agoThat's a stretch...
- r721 10y agoLast versions of MemTest86 (>6.0) have Row hammer test too: "Version 6.0.0 13/Feb/2015 New Features New "Hammer Test" for detecting disturbance errors caused by charge leakage when repeatedly accessing addresses in the same memory bank but different rows in a short period of time." http://www.memtest86.com/support/ver_history.htm http://www.memtest86.com/support/ver_history.htm
- wolf550e 10y agoEven more enhancement in newer versions: "Version 7.0 20/July/2016 New Features Row Hammer Test (Test 13) now uses double-sided hammering and random data patterns in an attempt to expose more RAM modules susceptible to disturbance errors."
- throwaway41597 10y agoBeware that running this will corrupt your RAM, you'll have to reboot.
- r721 10y agoAnd even "cause bit flips in data that gets written back to disc". I think MemTest86's "create bootable CD/USB for testing" approach is safer.
- faragon 10y agoThat's scary. So all DDR3, an probably most DDR4 memories are affected by that. Anyone knows if ECC is protection enough?
- masklinn 10y agoIt is not, at least for DDR3: "How Rowhammer Could Be Used to Exploit Weaknesses in Computer Hardware"[0] tested ECC and rowhammered it. ECC can only reliably detect single and double-bit errors (in 64bit spans, and it can only correct single-bit errors), anything beyond that and detection is up to chance. ECC is a mitigation factor, but ultimately not a protection. [0] http://www.thirdio.com/rowhammer.pdf http://www.thirdio.com/rowhammer.pdf
- blockoperation 10y agoECC could also help to raise the alarm when you're under attack – the chances of flipping enough bits to evade ECC (and have them be the right bits to pull off your exploit) without getting a few detectable flips in the process must be quite slim.
- msbarnett 10y ago> ECC could also help to raise the alarm when you're under attack – the chances of flipping enough bits to evade ECC (and have them be the right bits to pull off your exploit) without getting a few detectable flips in the process must be quite slim. I'd strongly suggest reading the linked paper. The upshot is: no, the chances are actually quite good that ECC won't save you by raising the alarm, because of the poor job most vendors do of surfacing ECC errors.
- yuhong 10y agoIf you read the paper, you will notice that Micron is the worst here.
- rasz_pl 10y agothe only proper (other than radically redesigning geometry and topology of whole ram chip, probably losing capacity in the process) protection (known in the industry since middle nineties ...) is access counter per row inside the ram module or memory controller. But that would cost additional $0.1 per chip!!!1 :/
- Retr0spectrum 10y agoRoughly how long do I need to run this for to be sure that I'm safe?