TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

339 pointsby j_bakerabout 10 years ago

14 comments

ChuckMcMabout 10 years ago
Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my memory is shredded.
评论 #9174283 未加载
评论 #9173208 未加载
评论 #9172789 未加载
评论 #9175165 未加载
评论 #9172350 未加载
sharkbotabout 10 years ago
There was an older paper discussing using various methods of fault injection (heat, voltage changes, etc) to attack Java smart cards, essentially destroying the type system guarantees and thus opening up an attack surface: &quot;The Sorcerer’s Apprentice Guide to Fault Attacks&quot;, <a href="https://eprint.iacr.org/2004/100.pdf" rel="nofollow">https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2004&#x2F;100.pdf</a>
评论 #9173369 未加载
kmoweryabout 10 years ago
The starting research that enabled this security work appeared last year at ISCA, but didn&#x27;t fully discuss the security implications:<p><a href="https://www.ece.cmu.edu/~safari/pubs/kim-isca14.pdf" rel="nofollow">https:&#x2F;&#x2F;www.ece.cmu.edu&#x2F;~safari&#x2F;pubs&#x2F;kim-isca14.pdf</a>
评论 #9175668 未加载
j_bakerabout 10 years ago
You know, this makes me wonder. If a car manufacturer or a toy company made a product that was found to be unsafe, there would be a recall. If hardware manufacturers make a product that is insecure, will there be a recall? Unfortunately, I suspect that this is a case where the law hasn&#x27;t caught up with technology.
评论 #9171808 未加载
评论 #9171917 未加载
评论 #9175734 未加载
评论 #9171831 未加载
评论 #9171843 未加载
评论 #9171985 未加载
jacquesmabout 10 years ago
Laptops are particularly at risk for stuff like this: components are more densely packed and may use smaller process sizes and have less powerful supplies which may be a factor in keeping bits in adjacent rows stable.<p>That may be the reason why the desktops mentioned are less sensitive, they&#x27;ll use full size memory modules and will have beefy power supplies.<p>It&#x27;d be interesting to repeat the experiments with the laptops running off their internal battery.
评论 #9172253 未加载
Aissenabout 10 years ago
Very little information on time scales. In one case they speak about 5 minutes vs 40 minutes (both might be acceptable for an exploit). Also no information about how long it took to bitflip in their per-hardware table.<p>And why name no hardware vendor ? I&#x27;m guessing they expect people to use the tool they provided and draw their own conclusions, but I don&#x27;t understand why they&#x27;d treat them differently from software vendors.
评论 #9172462 未加载
评论 #9173970 未加载
评论 #9175383 未加载
yuhongabout 10 years ago
memtest86 etc should add tests for this if they didn&#x27;t already, as this is the best place for such tests.
评论 #9173600 未加载
p1mrxabout 10 years ago
On my desktop (DH87RL &#x2F; i7-4770 &#x2F; 2x8GB Crucial DDR3L-1600), rowhammer_test reported errors after ~20 iterations (less than a minute).<p>I went into the BIOS and tried lowering the tREFI value from 6300 to 3150 (not sure what the units are). So far, it&#x27;s gone 1000 iterations with no problems detected.<p>Edit: Actually, the units are probably multiples of the cycle time, just like CAS latency. So, for DDR3-1600, that would mean 6300x1.25ns=7.8μs, and 3150x1.25ns=3.9μs<p><a href="http://en.wikipedia.org/wiki/CAS_latency" rel="nofollow">http:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;CAS_latency</a>
评论 #9177124 未加载
评论 #9176701 未加载
zokierabout 10 years ago
Surprised that the mitigations section did not mention ECC RAM. Wouldn&#x27;t it be effective mitigation?
评论 #9172062 未加载
评论 #9172015 未加载
Kenjiabout 10 years ago
Now someone has to come up with a JavaScript version of this exploit and the disaster is complete.
评论 #9172695 未加载
ymraabout 10 years ago
Would reducing the speed memory is clocked at prevent this?
评论 #9172359 未加载
评论 #9172086 未加载
randomdevlprabout 10 years ago
My first gen Toshiba Chromebook ran the test 130 minutes without an error.
0x0about 10 years ago
Does anyone know if Macbooks are known to be affected?
评论 #9171913 未加载
评论 #9171840 未加载
upofadownabout 10 years ago
Is a memory error actually an exploit? If so then are the unwanted changes that occur with no deliberate action an example of the computer cracking itself?<p>Philosophical...
评论 #9174568 未加载
评论 #9172534 未加载
评论 #9172386 未加载