News for hackers. Stuff that matters.

A comment on Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations. Parent comment

Re:Blacksmith – Rowhammer bit flips on all DRAM devices toda... by XMPPwocky on Monday November 15, 2021 @08:09PM (#29235311)
While ECC memory is probably important and probably better than nothing, if there's one thing we've learned about Rowhammer it's that the obvious mitigations that "should" stop or detect it often fail to a clever attacker.

Just the first thing that popped into my head, but: say you watch the ECC correctable error rate over time, and somehow (not so easy!) determine which process is causing those errors. You forcibly kill the process and log a message about it, and also terminate/notify processes potentially affected (say, send them a SIGBUS or something and unmap the pages containing the affected data).

I, a "clever" attacker, use this to leak out your secrets- I do my hammering juuust right so that, if some secret bit is 0, your hammering flips ECC bits, while if it's 1 your hammering doesn't affect things. Lovely little side-channel.

Universal memory encryption and authentication seems to be the only sure way out of the cycle of "attack, mitigation, attack the mitigation", and it's already starting to roll out.

[ Parent | on HN ]
Re:Blacksmith – Rowhammer bit flips on all DRAM devices toda... by tentacleuno on Tuesday November 16, 2021 @03:19AM (#29238182)
> I, a "clever" attacker, use this to leak out your secrets- I do my hammering juuust right so that, if some secret bit is 0, your hammering flips ECC bits, while if it's 1 your hammering doesn't affect things. Lovely little side-channel.

Would ASLR make this harder? I assume it would because it'd be a lot harder to get to the correct memory location (?).

[ Parent | on HN ]
Re:Blacksmith – Rowhammer bit flips on all DRAM devices toda... by account42 on Tuesday November 16, 2021 @06:04AM (#29239157)
ASLR adds nothing to attacks that rely on the physical location of pages since those area already allocated independently of the virtual address space.
[ Parent | on HN ]
Re:Blacksmith – Rowhammer bit flips on all DRAM devices toda... by rajnathani on Wednesday November 17, 2021 @01:48PM (#29257160)
Noob question: With DDR5's option for in-chip ECC, if Animats' suggestion of monitoring ECC anomalies is implemented on a control unit on the DIMM module, then will that make the attack impossible?
[ Parent | on HN ]