Once Thought Safe, DDR4 Memory Shown To Be Vulnerable To 'Rowhammer'

An anonymous reader writes from an Ars Technica article: Physical weaknesses in memory chips that make computers and servers susceptible to hack attacks dubbed "Rowhammer" are more exploitable than previously thought and extend to DDR4 modules, not just DDR3, according to a recently published research paper. The paper, titled How Rowhammer Could Be Used to Exploit Weaknesses in Computer Hardware (PDF), arrived at that conclusion by testing the integrity of dual in-line memory modules, or DIMMs, using diagnostic techniques that hadn't previously been applied to finding the vulnerability. The tests showed many of the DIMMs were vulnerable to a phenomenon known as "bitflipping," in which 0s were converted to 1s and vice versa.

Pratchett's Woodpecker

[spiritplumber]

I know it's a problem, but love how this works. Wonder if it was around when Going Postal was written.

Re:

[Anne Thwacks]

It has been around as long as semiconductor memory has been around. And not just in DRAM. Static memory, including on-cpu cache can have it. It is a well known potential defect that should be tested for during manufacture.

Some manufacturers cheat.

Re:

[Megol]

Bullshit. The cheat part that is, that nearby signals can interfere is true but trivially so. Water is wet, signals can interfere - so what?

The problems isn't caused by cheating and implying that not only confuses people but also takes away the important lesson that computers are complex on many levels and that avoiding bugs is f-king hard.

[And that critical systems should have ECC in hardware, software or preferably both]

Re:

[peragrin]

Have you ever heard of hacking groups that didn't have trendy names?

Also rowhammer is what it does. It is descriptive.

Re:

[Zero__Kelvin]

Because Bit Tickler sounds like a marital aid?

Re:

[skids]

Mostly only the newsworthy ones get them, ones that need widespread attention even for administrative domains that can't afford a dedicated security person/department. It's a lot easier to give them names then have meetings saying "where do we stand on CVE-year-four-digit-number" simply because the human brain wraps around names better. Especially if a clue as to the shape of the exploit is embedded in the name, serving as a mnemonic -- e.g. HeartBlead is used to blead information from heartbeat exchanges

We need a cartoon to demonstrate the bit flipping

[JoeyRox]

https://www.youtube.com/watch?... [youtube.com]

Re:frost 4ist!

[KiloByte]

goat.cx

Warning! Do not click this link -- it's an advertisement for a sleazy domain peddler rather than a bona-fide goatse mirror.

The only safe device

[JustAnotherOldGuy]

I'm convinced that the only safe device these days is a Speak 'N Spell [wikipedia.org]. (I heard the Etch A Sketch [wikipedia.org] is vulnerable to "vibration-hacking" and "elbow-jogging" attacks by annoying younger brothers and sisters.)

Ha ha I'm safe

[JustAnotherOldGuy]

Ha ha, I'm safe because I'm still using 16-pin DIPs in my PC XT. Suck it, hackers!

Never had this happen

[Chirs]

As far as I know I've never had this happen on any of my machines. Laptops, tablets, Android media boxes, or desktop. It just hasn't been an issue.

1001001 in distress?

[Zero__Kelvin]

Getty Lee is already well aware of this pattern [slashdot.org]!

Re:

[pepsikid]

Dude, that's Geddy Lee, as in, how his Polish granny pronounced his birth name "Gary Lee Weinrib".

Re:

[pepsikid]

Er, his momma, anyway.

Fix?

[MichaelKaiserProScri]

Wouldn't a fairly simple fix be to make it so that consecutive rows in the RAM do not correspond to consecutive memory addresses? The virtual memory manager is already serving up the physical RAM in 4k pages. Right now the rows within the 4k page are consecutive, but any given block of RAM bigger than 4k may actually be comprised of pages from anywhere in the physical RAM. If you reordered the rows within the 4k page at a hardware level it would be difficult to know which rows were actually consecutive.

Re:

[mathew7]

I don't support making a SW protection in the 1st place. It just adds complexity which could open another door. SW is NOT the answer to everything.

Re:

[mathew7]

Actually, just switching the LSBs from the row address would be enough, with the manufacturer hiding it (or even better: randomizing).
Since "researching" for this, I saw some information that they already have a mapping for production yelding; which is logical, as you can get more chips with target-size+10% and 91% working (100 from 110) than target-sized and perfect. But I think they currently just "skip", instead of re-arrange rows.
Also, the individual chips which eventually feed the 64-bit bus (with 512b