3 ms·

ECC is very resistant but not immune, but at least it will let you detect rowhammer attacks

• adrian_b 3y ago
  Yes, the advantage of ECC against RowHammer or RowPress attacks is detection, not prevention. The attacks usually produce more bit flips than can be corrected by ECC, but the attacker cannot control the number and the position of the bit flips. When a memory uses ECC (true end-to-end ECC, not the internal ECC of DDR5, which is useless against these attacks, because the errors are not reported to the OS), there are many more invalid memory bit configurations, than valid ones. Because of this, applying a random pattern of bit flips to the memory is much more likely to be detected as an ECC error, than to be ignored. Computers with ECC are normally configured to scrub all the memory periodically, so the bit flips caused by an attack will be detected even in unused memory. Because in a normal computer it is extremely unlikely to encounter more than one ECC error per day (either correctable or non-correctable), a decent operating system should immediately notify the user or the administrator in the case of repeated errors, which can appear only as a consequence of a hardware malfunction or of a RowHammer/RowPress attack (many servers are configured to send immediately an e-mail message or an SMS alert to the administrator when such events happen). Therefore, on computers with ECC it should be impossible for such attacks to remain undetected, even if they can succeed to corrupt the memory.