Once thought safe, DDR4 memory shown to be vulnerable to “Rowhammer”

Re:Once thought safe, DDR4 memory shown to be vulnerable to ... by nickpsecurity on Friday March 18, 2016 @02:23AM (#11310254)

I noticed supercomputer vendors and Oracle are using ChipKill plus ECC. Does adding that change the results any or still reduce to DOS?

[ Parent | on HN ]

Re:Once thought safe, DDR4 memory shown to be vulnerable to ... by tdullien on Friday March 18, 2016 @02:46AM (#11310315)

So I do not know (in the mathematical sense) that ChipKill won't create a problem, but I think it is unlikely.

In general, if the ECC infrastructure works (e.g. DRAM detecting bit corruption and reporting it to the OS), the odds of an attacker finding a piece of RAM that flips bits "just right" to bypass the checksumming without triggering a OS panic are low enough that I'd rather worry about software bugs.

DoS may still be a pretty viable attack, though.

[ Parent | on HN ]

Re:Once thought safe, DDR4 memory shown to be vulnerable to ... by darkr on Friday March 18, 2016 @06:17AM (#11310831)

Not just supercomputer vendors - Chipkill has been a standard option on IBM X-Series (their standard server range) for years now. I remember deploying a whole bunch of servers back 2011 or so that had it.

[ Parent | on HN ]

Re:Once thought safe, DDR4 memory shown to be vulnerable to ... by baruch on Friday March 18, 2016 @02:58AM (#11310338)

It can mitigate the DoS if you have enough spare RAM. if you are right on the edge that removed RAM will turn into an OOM condition and will become a DoS.

[ Parent | on HN ]

Re:Once thought safe, DDR4 memory shown to be vulnerable to ... by nickpsecurity on Friday March 18, 2016 @12:54PM (#11313063)

Appreciate everyone's insightful replies. :)

[ Parent | on HN ]