3 ms·
RowHammer is a category of security vulnerabilities that work by exploiting DRAM that suffers from bit-flips when accessed in particular patterns. It can be use
by jimrandomh 9y ago
RowHammer is a category of security vulnerabilities that work by exploiting DRAM that suffers from bit-flips when accessed in particular patterns. It can be used for local privilege escalation; for example a cell-phone app without permissions could use it to take full control of the phone, a server on a shared cloud host could attack other sites on the same host, or in the worst case, a browser Javascript program could break out of the browser (not done in this paper, but done as a proof-of-concept with caveats in one of the papers it cites). The main finding of this paper is that none of the existing mitigations is fully adequate, not even ECC.
On the plus side, using RowHammers to make a fully working exploits is much harder than most other types of exploits, and the exploits people have managed to make so far have all involved major caveats (like requiring hundreds of hours of full CPU usage to work, or providing memory layout information that would be difficult for attackers to obtain). Still, the fact that this class of exploit has proven so difficult to fully fix is worrying.
There's a section of proposed mitigations at the end, one of which sounds particularly promising, though:
> "Kim et al. [38] and Kim et al. [37] proposed to eliminate bit flips in hardware by probabilistically opening adjacent or non-adjacent rows, whenever a row is opened or closed. As an ongoing Rowhammer attack would open and close a certain row repeatedly, the vulnerable adjacent rows would be refreshed before bit flips occur. We consider their approaches as a possible solutions to mitigate Rowhammer attacks in the future."
- zokier 9y ago> The main finding of this paper is that none of the existing mitigations is fully adequate, not even ECC. I think that is bit misleading; this paper specifically did not analyze the effects of ECC at all, all their work is strictly focused on non-ECC systems. All the references to ECC are to other papers. Furthermore, while not "fully adequate", ECC is still quite effective mitigation > [...] existing hardware countermeasures such as using memory with error-correction codes (ECC-RAM) appear to make Rowhammer attacks harder [...] > ECC RAM can detect and correct 1-bit errors and, thus, deal with single bit flips caused by the Rowhammer attack. [...] However, uncorrectable multi-bit flips can be exploitable [2, 3, 42] or can result in a denial-of-service attack similar as described in Section IX-A depending on how the operating system responds to the error Unless the situation has radically changed, my understanding is that ECC changes Rowhammer from a practical attack to more of a theoretical threat. And generally DoS is highly preferable over something like privilege escalation, which is further benefit of ECC. Consumer-grade ECC can't come soon enough.
- KGIII 9y agoI haven't looked into it for a while, but AMD often supports ECC so long as the motherboard supports it. I haven't checked the current lineup, but looked at it for my last home-server build. I agree with you entirely, to be sure. A quick Google led me to here: https://www.reddit.com/r/Amd/comments/6f7s28/what_is_the_state_of_ryzen_and_ecc/ https://www.reddit.com/r/Amd/comments/6f7s28/what_is_the_sta... It's a thread that is about four months old and they are discussing ECC support with Rizen CPUs. It looks like they have some current-gen solutions.
- StillBored 9y agoI sure would like to know how ECC fails to alleviate this. People forget that the standard single bit correction, double bit detection really means, guaranteed single bit correction, and guaranteed double bit detection with a probability of detecting > 2 bits depending on how/where they flip.
- theyregreat 9y ago(SECDED.) RH and bitsquatting are two reasons ECC should be the standard, not the exception, in all manner of consumer endpoints, network gear and servers.
- cryptonector 9y agoTFA said nothing about ECC failing to stop RowHammer. TFA does discuss the cost of ECC (or ChipKill) and the fact that Intel does not even support ECC on consumer kit -- i.e., ECC's availability is rather limited.
- StillBored 9y agoto quote TFA. "ECC RAM can detect and correct 1-bit errors and, thus, deal with single bit flips caused by the Rowhammer attack. Furthermore, IBM’s Chipkill error correction [27] allows to successfully recover from 3-bit errors. However, uncorrectable multi-bit flips can be exploitable [2, 3, 42] " Maybe that, combined with a lot of weasel words about the effectiveness of ECC muddy the water.
- cryptonector 9y agoBut they did not actually demonstrate any attacks on ECC.
- ris 9y ago> The main finding of this paper is that none of the existing mitigations is fully adequate, not even ECC. I suspect AMD's new memory encryption would provide significant protection as specific bit flips in rows that do not share the same key would be totally unpredictable.