7 ms·
ZenHammer: Rowhammer attacks on AMD Zen-based platforms
- wmf 3y agoThe real news appears to be that rowhammer is mostly fixed on DDR5.
- samtheprogram 3y agoNot news, and per the article: > Furthermore, we show that ZenHammer can trigger Rowhammer bit flips on a DDR5 device for the first time.
- merb 3y agoWell they said that it needs further testing. If it would be mostly fixed, it would mean that ecc could help even more. I mean the on-die-ecc probably already helps
- dist-epoch 3y agoDDR5 is so fragile they had to include on-die ECC to make it work, even when ECC is not exposed externally.
- jeffbee 3y agoThat only brings DRAM into alignment with flash and magnetic storage, so it's not really a negative. Everything in your computer is converging on semiconductor with bounded probabilistic state + math.
- titzer 3y agoIt's always been that way, just how many nines of reliability we're talking about. E.g. at Google scale, bitflips in memory from cosmic rays and general noise happy every day. Everything has checksums on it.
- samstave 3y agoMay you please ELI5 why DDR5 is 'fragile' as you put it? Was its design pushing material sciences such that the theory worked, but practical implementation required the 'crutch' of ECC?
- adgjlsfhk1 3y agobasically. pushing the timing and sizes makes it likely that some of your bits will fail to be built correctly. rather than dropping the speed and sizes to get reliability, you just throw an extra chip on to give you redundancy.
- RachelF 3y agoTake a look at the spec. The speeds are so high that they use some modem channel characterization features on the memory bus. Linus was right about ECC being needed, with higher capacities and speeds and reduced feature size it's becoming a must.
- deleted 3y ago[deleted]
- DarkNova6 3y agoI know far too little about hardware security. Is this one of the many inevitable vulnerabilities that arise from CPU optimization and are of little feasibility in the real world?
- dist-epoch 3y agoThis is a RAM problem, not a CPU one.
- rocqua 3y agoArguably worse. This arises from the physics of DRAM. This occurs at a much lower level than an edge case of a feature that lets you leak info over a side channel. Instead this is just: the data is stored as a small charge in a grid by flipping nearby points on the grid alot you can leak some charge into your target charge. The smaller the charge, and the closer together the charges, the easier rowhammer attacks are. Also, the smaller and closer together the charges, the faster, cheaper, denser, and efficient your RAM gets. There are mitigations, but they are pushed to the limit.
- KennyBlanken 3y agoFrom what I understand, it arises from DRAM manufacturers, interested in maximizing profits as much as possible, have been pushing the limits of how small they can make the RAM chip's features, and then backing off slightly until they felt ram was reliable "enough", but Rowhammer et al demonstrate it's very easy to cause bit flipping?
- markhahn 3y ago"maximize profits" and "best product for customer" are dual. you specifically want small chip features - or don't you like speed, power efficiency, and low cost?
- throwaway48476 3y agoThe point of engineering is trade offs. No one is trying to make a worse DRAM.
- VHRanger 3y agoSerious question: as an average person, are those hardware security issues (rowhammer, spectre, meltdown) an actual risk? My understanding with spectre and meltdown was that it was an issue for escaping VMs and similar attacks - something AWS engineers should care about, but not me
- transpute 3y agoFirst paragraph: This poses a significant risk as DRAM devices in the wild cannot easily be fixed, and previous work showed that Rowhammer attacks are practical, for example, in the browser, on smartphones, across VMs, and even over the network.
- ngneer 3y agoThat is just one view, namely the authors' view. You may wish to consider recent perfect 10 vulnerabilities for comparison, as these are far more likely to cause problems.
- hathawsh 3y agoFrom a security perspective, a web browser is a kind of VM hypervisor, where each web site may have its own VMs. So yes, everyone can be affected.
- gary_0 3y agoThe solution is to disable JavaScript and not run any untrusted apps. And then move to a shack in the woods and live off the land, because you just cut yourself off from modern society.
- oldge 3y agoDoes this work when full memory encryption, poisoning, and address xor is turned on?
- reliabilityguy 3y agoWith memory encryption it wont lead to system exploitation, just to a system crash. So, with memory encryption you are safer.
- ciupicri 3y agoI wonder: does Secure Memory Encryption [1] help against this? [1]: https://www.amd.com/en/developer/sev.html https://www.amd.com/en/developer/sev.html
- anticensor 3y agoYes, but you might end up in a huge loss in stability. Even a single bitflip might become a fatal error.
- formerly_proven 3y agoIf oyu get that many bitflips the system wasn't stable to begin with.
- wtallis 3y agoI think the implication was that memory encryption could mean that a rowhammer-induced bitflip would be amplified into scrambling the entire word of memory, which is more likely to have catastrophic effects than a single bit flip. That would be true for any reasonable definition of "stable" that admits any susceptibility to rowhammer.
- indeyets 3y agoBut that’s a good thing. Sane state would be synced to disk and any successful bitflip will halt a system telling you that something bad is going on. It would be “catastrophic” for runtime but not for the data
- axytol 3y agoThey mention Zen 2 and 3, any info on Zen 1? Would it simply apply as well?
- crotchfire 3y agoWhat about DIMMs with Error Correction Codes (ECC)? Previous work on DDR3 showed that ECC cannot provide protection against Rowhammer. This is incredibly misleading. The paper they cite states: When the ECC detection is used correctly 0.65%-7.42% of all bit flips still cause silent corruptions... On setup AMD-1, uncorrectable errors crash the system. The attacker will need to cause dozens of machine halts in order to achieve even a single exploitable bitflip. Dozens of machine halts is not something that goes undetected. Kudos for calling out JEDEC's terrible behavior on the rowhammer question, but we should not be downplaying ECC as a near-term solution.
- transpute 3y agoAny recommendations for client devices with ECC memory?
- wtallis 3y agoIf it has ECC memory, it's going to be branded as a workstation or server or industrial device, not marketed as a consumer device. Among consumer products, some AMD desktop CPUs and motherboards support ECC memory, and that's about it.
- justinclift 3y agoFor desktops, ASRock motherboards seem to be the common choice for people wanting ECC memory. It's specifically mentioned on the ASRock motherboard pages under "Specifications". Some random examples: • https://www.asrock.com/mb/AMD/B650%20Pro%20RS/index.asp#Specification https://www.asrock.com/mb/AMD/B650%20Pro%20RS/index.asp#Spec... • https://pg.asrock.com/mb/AMD/B650%20PG%20Lightning%20WiFi/index.asp#Specification https://pg.asrock.com/mb/AMD/B650%20PG%20Lightning%20WiFi/in... • https://www.asrock.com/mb/AMD/X670E%20Taichi/index.asp#Specification https://www.asrock.com/mb/AMD/X670E%20Taichi/index.asp#Speci... These all have: Supports DDR5 ECC/non-ECC, un-buffered memory up to 7200+(OC)
- jeffbee 3y ago
- tdullien 3y agoCoauthor of the original Rowhammer exploit here. ECC remains a highly effective method for turning this from a security issue to a reliability issue, mostly. As an individual owner of a server, if that server has ECC and you expect to notice machine halts due to uncorrectable ECC errors, the security implications for you are modest. Now, if you are a cloud provider that provides VMs on multitenant hosts, your threat model may be different. Either way, avoid machines without ECC. TRR was a lame duck even when Rowhammer was still fresh, and bits flipping in DRAM will not go away unless the economics in DRAM manufacturing change (e.g. not).
- c2h5oh 3y agoI would expect that increased crash rate of multi-tenant hosts would be something that would be detected and investigated by the cloud provider. At the same time targeting a specific tenant would require a lot of luck.
- treprinum 3y agoAMD now took Intel's market segmentation approach and is disabling ECC on most Ryzen CPUs. Only Pro and Threadrippers have it guaranteed, then some boards with some desktop Ryzens.
- wtallis 3y agoIs that a change? I think what you described applies equally to every generation of Zen processors: Pro-branded chips have ECC capability officially, laptop chips don't have it, and consumer-branded chips have it unofficially with ECC capability optional for motherboards.
- adrian_b 3y agoAlready since a few generations, at least since Zen 3, the desktop Ryzen CPU have official ECC support, not unofficial ECC support like the first Ryzen. This can be verified easily on the AMD site by reading the CPU specifications. For laptop CPUs, there has been a time interval between the beginning of 2022 and the autumn of 2023 when ECC support was specified for all mobile Rembrandt and Phoenix CPUs, but then the ECC support has been removed suddenly from the specifications of all non-Pro laptop CPUs.
- Jasmine209 3y ago[dead]
- swozey 3y agoI have a very vague understanding of all of these DDR bitflip attacks, but I found the original Hammertime paper and it's actually very easy to read. I haven't gone through all of it but it breaks things down to be better understood very well. I've heard bitflipping a million times and never really got it (not that I made serious effort) until this. https://comsec.ethz.ch/wp-content/files/hammertime_raid18.pdf https://comsec.ethz.ch/wp-content/files/hammertime_raid18.pd... I feel like I just went through a 101 EE course. I had NO idea any of this was related to the actual hardware manufacturing imperfections, etc. That explains the name Rowhammer. I've probably been under a rock and everyones knows this stuff. > Due to the extreme density of modern DRAM arrays, small manufacturing imperfections can cause weak electrical coupling between neighboring cells. This, combined with the minuscule capacitance of such cells, means that every time a DRAM row is read from a bank, the memory cells in adjacent rows leak a small amount of charge. If this happens frequently enough between two refresh cycles, the affected cells can leak enough charge that their stored bit value will “flip”, a phenomenon known as “disturbance error” or more recently as Rowhammer.
- KennyBlanken 3y ago> Due to the extreme density of modern DRAM arrays, small manufacturing imperfections can cause weak electrical coupling between neighboring cells. This makes it sound like it's unavoidable and inherent to making DRAM. It isn't. DRAM manufacturers have been pushing the limits to an extreme. That's why. Pursuit of profit. This is no different from Ford deciding the cost of settling Pinto lawsuits (from injuries and deaths) was less than the cost of fixing the car's design.
- binkHN 3y ago> ...ZenHammer could not trigger flips on nine out of ten devices ... more research is necessary to find more effective patterns for DDR5 devices. So I guess DDR5 still has a little bit of time here. Anyone know if this also affects LPDDR5x?
- wtallis 3y agoThe DRAM interface is pretty well decoupled from the memory array itself. So whether you're looking at DDR5 or LPDDR5(x) or GDDR6(x) or HBM3(e) isn't the right question. What matters are the implementation details up to the manufacturer's discretion, such as on-die ECC.
- sasha89 3y ago[flagged]