How much/what hardware does the rowhammer DRAM bug affects?

[jim bell]

  From: Georgi Guninski <guninski at guninski.com>
On Wed, Sep 16, 2015 at 08:03:54PM +0000, jim bell wrote:
>> I don't think the concept of this kind of weakness is new:  Even in 1980, DRAMs were tested for such repeated accesses, to ensure that such >>errors would not occur.  This was particularly true for a process called "device characterization", in which chips were attacked in all manner of >>electronically-abusive ways, to uncover these weaknesses, and fix the circuit design should such flaws be uncovered. One way these >>techniques could be thwarted is to return to the use of parity-bits (8+1 parity) in memory access, in DRAM module and computer design, to >>whatever extent they are no longer used.  Any (successful) attempt to modify bits in a DRAM would quickly end up causing a parity error, >>which >would at least show which manufacturer's DRAM chips are susceptible to this kind of attack.  A person who was forced to use a no->>parity >computer could, at least,  limit his purchases of such modules to those populated with DRAMs not susceptible to the problem. >> Jim Bell 

>I don't understand hardware and have some questions

>The POC appears non-deterministic per the nature of the bug.
I assume POC means "proof of concept".  Yes, the error is non-deterministic.  It arises from the fact that bits are stored as different voltages on individual capacitors in a chip, one capacitor per bit.   Think of a "0" as being zero volts, 1 is Vcc volts, where Vcc (the supply voltage to the chips) is usually 3 volts.  This represents a healthy difference, and could easily be detected.  The problem is that the chip can't have one voltage detector for each bit; usually there are about 1048 bits per voltage comparator.  When a given row needs to be read, the Row Address line activates, and those 1048 bits are each connected to their corresponding "bit line", which is a tiny electrical conductor with a capacitance much greater than that of the individual bit-cell (capacitor).  The resulting voltage difference between a "one" and a "zero" bit might be only a few tens of millivolts, which is rather small.  Then, the voltage detector amplifies the voltage difference, to restore it to either GND (0 volts) or Vcc.


>1. If I run the POC for time X and it fails, does
>this mean it will fail if I run it for time 100 X?
It's statistical.  Probably  the number of failures will be approximately proportional to the number of disturb-cycles done.

>2. Does increasing the temperature in the box
>(near or above overheating) increase the chance for>success?

Perhaps just a little.  Refreshing of an entire memory array is done once each 64 millisecond.  (Used to be 2 millisecond in the 1970s.)    It is said that many tens of seconds can elapse before any given bit is disturbed, if refresh is turned off.  There should be a lot of margin for loss of refresh, or an inadequate amount of refresh.

>3. If you have computer near you, can you induce bit
>flips on purpose remotely, without executing code on
>it? (lol, AFAICT if you wait looooong enough cosmic rays
>will this for you for free, but I am asking about
>realistic attack).
I don't think an external attack (with particles) is plausible.



  
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 6457 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks/attachments/20150918/03609588/attachment-0002.txt>