Re:OpenAI Finds 948 Local Privilege Escalation Bugs in the L...
by spwa4 on Friday November 06, 2026 @07:08PM
(#50400263)
How do you decide what risks you can just leave open? Because that's what you're doing. The only thing that protects us from targeted rowhammer exploits for your hardware is our ability to research and write exploits ...
Re:OpenAI Finds 948 Local Privilege Escalation Bugs in the L...
by GuB-42 on Friday November 06, 2026 @08:41PM
(#50400809)
I don't decide, doing anything involve some risks, some of them can't be eliminated. Or, I guess I can decide to not do anything, but it won't get me anywhere.
To go back with the human analogy. I have a server in a datacenter, there is a weakness in that someone can go to the machine physically and do nasty stuff, including hitting it with a literal hammer. This is a risk, but I can't do anything about it. Someone has to do the maintenance. But it can be mitigated with access control to the datacenter, among other things.
If the door to the server room can be opened with a toothpick, that's a vulnerability and it has to be fixed, because to "real" solution of not letting anyone in is not viable. I didn't chose to let people in the server room, it is just impossible not to.
The physics makes the rowhammer impossible to fix in practice, but you can add various mitigations: scrambling, ECC, detection and response, etc... On the application level, you can also make it so that it is not possible to do a rowhammer in the first place. Fix everything that can be fixed and mitigate what can't be fixed.
And there is another security issue that can't be fixed, and is much worse than rowhammer: people. But we can't remove people, just like we can't remove DRAM for the performance level we need, so we mitigate the risk. It is not game over because we have other layers of security.