Tuesday, March 26th 2024
AMD Response to "ZENHAMMER: Rowhammer Attacks on AMD Zen-Based Platforms"
On February 26, 2024, AMD received new research related to an industry-wide DRAM issue documented in "ZENHAMMER: Rowhammering Attacks on AMD Zen-based Platforms" from researchers at ETH Zurich. The research demonstrates performing Rowhammer attacks on DDR4 and DDR5 memory using AMD "Zen" platforms. Given the history around Rowhammer, the researchers do not consider these rowhammering attacks to be a new issue.
Mitigation
AMD continues to assess the researchers' claim of demonstrating Rowhammer bit flips on a DDR5 device for the first time. AMD will provide an update upon completion of its assessment.
AMD microprocessor products include memory controllers designed to meet industry-standard DDR specifications. Susceptibility to Rowhammer attacks varies based on the DRAM device, vendor, technology, and system settings. AMD recommends contacting your DRAM or system manufacturer to determine any susceptibility to this new variant of Rowhammer.
AMD also continues to recommend the following existing DRAM mitigations to Rowhammer-style attacks, including:
AMD thanks ETH Zurich: Patrick Jattke, Max Wipfli, Flavien Solt, Michele Marazzi, Matej Boleskei, Kaveh Razavi for reporting their findings and engaging in coordinated vulnerability disclosure.
Source:
AMD
Mitigation
AMD continues to assess the researchers' claim of demonstrating Rowhammer bit flips on a DDR5 device for the first time. AMD will provide an update upon completion of its assessment.
AMD also continues to recommend the following existing DRAM mitigations to Rowhammer-style attacks, including:
- Using DRAM supporting Error Correcting Codes (ECC)
- Using memory refresh rates above 1x
- Disabling Memory Burst/Postponed Refresh
- Using AMD CPUs with memory controllers that support a Maximum Activate Count (MAC) (DDR4)
- 1st Gen AMD EPYC Processors formerly codenamed "Naples"
- 2nd Gen AMD EPYC Processors formerly codenamed "Rome"
- 3rd Gen AMD EPYC Processors formerly codenamed "Milan"
- Using AMD CPUs with memory controllers that support Refresh Management (RFM) (DDR5)
- 4th Gen AMD EPYC Processors formerly codenamed "Genoa"
AMD thanks ETH Zurich: Patrick Jattke, Max Wipfli, Flavien Solt, Michele Marazzi, Matej Boleskei, Kaveh Razavi for reporting their findings and engaging in coordinated vulnerability disclosure.
18 Comments on AMD Response to "ZENHAMMER: Rowhammer Attacks on AMD Zen-Based Platforms"
If you ask me, the industry has no answer short of a fundamental redesign and are basically telling people what a doctor tells you when you say "Doc, it hurts when I do this!"
"Well, then don't."
In other words, don't get infected with malware that might exploit this.
This problem is much worse than exploits. It's a reliability issue for DRAM generally. It applies to all DRAM uses everywhere.
Either ECC needs beefed up massively on the presumption that normal operation generates bulk groups of errors, or the DRAM array construction needs an overhaul.
Regular ECC is not intended to defend against conditions that produces a barrage of bit flips. At the very least you're looking at crashes from the memory corruption.
In theory ECC isn't sufficient but no one is making a more resilient form of memory than that. It's the simplest solution with no demonstrated data exfil on DDR4 or DDR5 yet. And the other solutions listed after it provide even less protection.
Yeah, ECC is the best we have right now, but it's not sufficient. ECC circuits are built to handle rare cases of single bit-flips, primarily from cosmic rays. Rowhammer is not actually an exploit problem but rather a reliability problem. DRAMs are, or have become, too fragile electrically. Probably the latter due to modern die shrinks.
Screaming at JEDEC might make DDR6/7 different but does nothing to help current machines.
There is a similarity to Flash memory trade-offs. Where long term reliability, and endurance, and speed are all properties of the number levels per cell. The effect is density is traded for performance. We might be seeing something similar emerging with DRAM. The highest densities will get relegated to low-grade consumer use.
www.vusec.net/projects/eccploit/