4 ms·

In case someone is wondering, ECC DRAM does not prevent rowhammer attack.

toast0 5y ago
ECC doesn't prevent rowhammer, but it makes it a lot easier to spot. If you flip only one bit, that will at least increase a correctable error count. It you flip only two bits, most OSes will panic, although sophisticated OSes can kill only the process which had that address mapped, or take that address out of the mapping and kill the process on access, etc. It's only if you flip three bits that it might be undetected. From what I've seen the probability of flipping one or two bits is much higher than three or more, so ECC is useful to probabalistically turn a security bypass into a denial of service.
- benlivengood 5y ago
  GCP at least takes the approach of monitoring single and double bit flips to kill offending VMs. There's also a potential performance tradeoff (no idea if GCP is using this) of running some single channel DIMMs for isolating VMs from the kernel and kvm userspace. Reference: https://www.google.com/amp/s/cloudblog.withgoogle.com/products/gcp/7-ways-we-harden-our-kvm-hypervisor-at-google-cloud-security-in-plaintext/amp/ https://www.google.com/amp/s/cloudblog.withgoogle.com/produc...
ajross 5y ago
ECC fails to prevent rowhammer in more or less exactly the same way that address space randomization and similar hardening techniques fail to prevent stack smash attacks. Which is to say, it basically prevents rowhammer in a practical sense. You can flip the bits, but you don't have the level of control needed to flip the right bits.
- pedro2 5y ago
  wrong. https://www.vusec.net/projects/eccploit/ https://www.vusec.net/projects/eccploit/
  - Dylan16807 5y ago
    That will work some of the time, but it requires the system to ignore a lot of single bit errors and keep running.
  - staticassertion 5y ago
    I'm not sure this actually makes them wrong, if you take their statement as "ECC makes the attack more difficult/ statistically less likely". The attack you're describing is sort of akin to a heap spray attack to improve your chances of hitting your shell code. But dropping the analogies entirely and stating explicitly is a lot better. ECC makes rowhammer less likely to succeed and slower to exploit.

ECC doesn't prevent rowhammer, but it makes it a lot easier to spot. If you flip only one bit, that will at least increase a correctable error count. It you flip only two bits, most OSes will panic, although sophisticated OSes can kill only the process which had that address mapped, or take that address out of the mapping and kill the process on access, etc. It's only if you flip three bits that it might be undetected. From what I've seen the probability of flipping one or two bits is much higher than three or more, so ECC is useful to probabalistically turn a security bypass into a denial of service.

benlivengood 5y ago
GCP at least takes the approach of monitoring single and double bit flips to kill offending VMs. There's also a potential performance tradeoff (no idea if GCP is using this) of running some single channel DIMMs for isolating VMs from the kernel and kvm userspace. Reference: https://www.google.com/amp/s/cloudblog.withgoogle.com/products/gcp/7-ways-we-harden-our-kvm-hypervisor-at-google-cloud-security-in-plaintext/amp/ https://www.google.com/amp/s/cloudblog.withgoogle.com/produc...

ajross 5y ago

ECC fails to prevent rowhammer in more or less exactly the same way that address space randomization and similar hardening techniques fail to prevent stack smash attacks. Which is to say, it basically prevents rowhammer in a practical sense. You can flip the bits, but you don't have the level of control needed to flip the right bits.

pedro2 5y ago
wrong. https://www.vusec.net/projects/eccploit/ https://www.vusec.net/projects/eccploit/
- Dylan16807 5y ago
  That will work some of the time, but it requires the system to ignore a lot of single bit errors and keep running.
- staticassertion 5y ago
  I'm not sure this actually makes them wrong, if you take their statement as "ECC makes the attack more difficult/ statistically less likely". The attack you're describing is sort of akin to a heap spray attack to improve your chances of hitting your shell code. But dropping the analogies entirely and stating explicitly is a lot better. ECC makes rowhammer less likely to succeed and slower to exploit.