Then why's the paper[1] say different? The odds of a double-flip are smaller than s single-flip; a single flip gets corrected, a double stops the box (depending on the bios etc), an even rarer triple may not get detected... the odds are exactly why it just takes longer. This paper reports observing it happening.

1: http://www.thirdio.com/rowhammer.pdf

I presume 'tdullien' assumes that "attack" refers to privilege escalation. I think he's claiming you are unlikely to get an undetected and exploitable triple bit flip before you crash the machine with the more single and double bit flips. Thus he says that ECC "turns it from an exploitable security issue into a denial-of-service issue".

Does the paper claim that in fact triple bit flips are sufficiently more frequent than one would expect, and thus an exploitable security issue still exists with ECC? This would be interesting news. But if you are defining "attack" to include denial-of-service by crashing the machine, I presume the disagreement is only about terminology.

I noticed supercomputer vendors and Oracle are using ChipKill plus ECC. Does adding that change the results any or still reduce to DOS?

So I do not know (in the mathematical sense) that ChipKill won't create a problem, but I think it is unlikely.

In general, if the ECC infrastructure works (e.g. DRAM detecting bit corruption and reporting it to the OS), the odds of an attacker finding a piece of RAM that flips bits "just right" to bypass the checksumming without triggering a OS panic are low enough that I'd rather worry about software bugs.

DoS may still be a pretty viable attack, though.

Not just supercomputer vendors - Chipkill has been a standard option on IBM X-Series (their standard server range) for years now. I remember deploying a whole bunch of servers back 2011 or so that had it.

It can mitigate the DoS if you have enough spare RAM. if you are right on the edge that removed RAM will turn into an OOM condition and will become a DoS.

Appreciate everyone's insightful replies. :)

That could still be extraordinarily entertaining for an attacker to execute on a shared hosting environment, though.