DDR3 memory rowhammer vulnerability - BIOS updates

Talk about "WhatEVER !"..
Post Reply
Message
Author
Puppy
Senior ThinkPadder
Senior ThinkPadder
Posts: 2256
Joined: Sat Oct 30, 2004 4:52 am
Location: Prague, Czech Republic

DDR3 memory rowhammer vulnerability - BIOS updates

#1 Post by Puppy » Sun May 17, 2015 5:53 pm

Exploiting the DRAM rowhammer bug to gain kernel privileges
http://googleprojectzero.blogspot.com/2 ... -gain.html

Very interesting security issue from technical point of view. There is probably no solution, even BIOS updates won't help much.

Lenovo response http://support.lenovo.com/us/en/product ... row_hammer that contains list of affected products. Since "Any sub 40nm (e.g. DDR3) memory made after 2011 and before 2014 may be impacted by this issue" it is not sure whether .20 series are affected as well or just not tested :(
ThinkPad (1992 - 2012): R51, X31, X220, Tablet 8

rkawakami
Admin
Admin
Posts: 10052
Joined: Sun Jun 04, 2006 1:26 am
Location: San Jose, CA 95120 USA
Contact:

Re: DDR3 memory rowhammer vulnerability - BIOS updates

#2 Post by rkawakami » Mon May 18, 2015 2:29 am

From a memory testing point of view this is indeed an old problem made new again due to the usage of smaller geometries in the design of memory cells. I've written some memory test patterns in the past that have done this "hammering", however in order to be truly effective, one needs to know the physical layout of the memory array. I believe that all of the DRAM and SRAM designs that I've been involved in testing over the last 35 years have always scrambled the order of the row and/or column addresses.

To put it briefly, the electrical (also called logical) address (that which is applied to the input pins of the memory device) is not the same as the physical address of where that row is located in the array. In other words, logical row address 0 is not always physically located next to logical row address 1. This is the due to the way how the layout designers construct the memory array. One of the favorite techniques is to construct a sequence of physical rows but "flip" them for the next section. So if the first 4 logical rows are physically laid out in a 0, 2, 3, 1 sequence, then the next four will be 6, 4, 5, 7.

However, if the intent of this hammering is to simply alter (corrupt) data located elsewhere in the memory array, then one doesn't really need to know the logical-to-physical translation.

Running this type of disturb data pattern can add several seconds to the overall test time when the memory chip or module is being tested before leaving the factory. It would also tend to increase the cost of the memory as added test time means added cost to whoever is buying the product.
Ray Kawakami
X22 X24 X31 X41 X41T X60 X60s X61 X61s X200 X200s X300 X301 Z60m Z61t Z61p 560 560Z 600 600E 600X T21 T22 T23 T41 T60p T410 T420 T520 W500 W520 R50 A21p A22p A31 A31p
NOTE: All links to PC-Doctor software hosted by me are dead. Files removed 8/28/12 by manufacturer's demand.

Puppy
Senior ThinkPadder
Senior ThinkPadder
Posts: 2256
Joined: Sat Oct 30, 2004 4:52 am
Location: Prague, Czech Republic

Re: DDR3 memory rowhammer vulnerability - BIOS updates

#3 Post by Puppy » Mon May 18, 2015 3:06 am

rkawakami wrote:However, if the intent of this hammering is to simply alter (corrupt) data located elsewhere in the memory array, then one doesn't really need to know the logical-to-physical translation.
Read the article, at least the Conclusion paragraph. They were able to perform targeted attack causing kernel privilege escalation. So it is not a random error only.
ThinkPad (1992 - 2012): R51, X31, X220, Tablet 8

hhhd1
Junior Member
Junior Member
Posts: 488
Joined: Mon Nov 17, 2014 7:23 pm
Location: Cairo, Egypt

Re: DDR3 memory rowhammer vulnerability - BIOS updates

#4 Post by hhhd1 » Thu May 21, 2015 1:01 am

That is more reason to starting making laptops with ECC ram support, the processors needed for this are already available.
===

Puppy
Senior ThinkPadder
Senior ThinkPadder
Posts: 2256
Joined: Sat Oct 30, 2004 4:52 am
Location: Prague, Czech Republic

Re: DDR3 memory rowhammer vulnerability - BIOS updates

#5 Post by Puppy » Wed May 27, 2015 11:20 am

Lenovo has released BIOS update for .20 series as well https://download.lenovo.com/ibmdl/pub/p ... uj26us.txt

<1.40-1.24>
UEFI: 1.40 / ECP: 1.24
- [Important]
Mitigate risk of security vulnerability related to DRAM Row Hammering.
ThinkPad (1992 - 2012): R51, X31, X220, Tablet 8

bit_twiddler
Junior Member
Junior Member
Posts: 422
Joined: Wed May 16, 2012 3:36 pm
Location: Salinas, CA

Re: DDR3 memory rowhammer vulnerability - BIOS updates

#6 Post by bit_twiddler » Wed May 27, 2015 7:39 pm

That is more reason to starting making laptops with ECC ram support, the processors needed for this are already available.
Unlikely, but DDR4 is coming along with CRC, which is probably good enough for laptops.
Daily Drivers: W520 i7-2860QM | T420 FHD IPS i7-2640m | W701
Others: W510 | T400 | W500 WUXGA | 701C (on its shrine) | R61 14W (in the boneyard)
Non-TP: Dell T7500 (workstation), Dell m7510
Currently Experimenting With: T420s

Post Reply
  • Similar Topics
    Replies
    Views
    Last post

Return to “Off-Topic Stuff”

Who is online

Users browsing this forum: No registered users and 0 guests