ZenHammer: Rowhammer attacks on AMD Zen-based platforms

I thought the same as you, but the situation's less dire thankfully. Wrote a post about it a while back that was top of HN: https://sunshowers.io/posts/am5-ryzen-7000-ecc-ram/

Nothing changed since first Ryzen launch:

- Desktop Ryzen CPUs support ECC, but implementation by motherboard vendors is not mandatory

- Laptop and G-series Ryzen CPUs only support ECC in pro variant

- Threadripper has ECC support

edit: not confirmed but supposedly laptop and APUs starting with 6000 series all support ECC.

Is it disabled or is it simply not certified?

Last I checked ECC was not certified to work on most "consumer" oriented hardware, but AMD didn't make any attempt to actually disable it.

Is that a change? I think what you described applies equally to every generation of Zen processors: Pro-branded chips have ECC capability officially, laptop chips don't have it, and consumer-branded chips have it unofficially with ECC capability optional for motherboards.

All the Ryzen 7000 series desktop processors support ECC, I think. Check each model's specs to be sure.

Asus motherboards for those CPUs also support it, as stated in the BIOS manuals I looked over. It requires changing the BIOS ECC setting from Auto to Enable.

I have done this on one such system, and the appropriate EDAC messages showed up in the Linux boot log.

Have you considered a 7950X3D? The larger CPU cache might make up for the RAM speed difference.

Keep in mind that for my 5950X I had to buy Micron Rev E 16Gbit x8 due based DIMMs, rated 3200CL22, running 3600CL18. I.e., they just don't ship with XMP presets.

Overclock it yourself. It's not that hard.

and it's slower or more expensive or both compared to the equivalent-capacity non-ECC memory.

That's not anything new though.

My local supplier (https://www.scorptec.com.au) has a fair amount of both, with ECC currently being about double the price (ugh).

When the AM4 generation was current, the difference in price was a lot less though. :/

Still it's worth it for piece of mind. Especially if you're undervolting the cpu. ;)

it's slower or more expensive or both compared to the equivalent-capacity non-ECC memory

How much of that is it being actually slower and how much is it just ECC memory not being sold at pre-overclocked speeds?

The reality is that Rowhammer remains one of the hardest ways to compromise a machine, largely because the software stack most people are running isn't great.

Even a "gamer" on a pure gaming computer will have some crucial information on that machine

Which belongs to the gamer user, so it can be extracted or encrypted by every malware running on that system. No need for esoteric attacks like rowhammer at this point. Unless you think about, for example, exploring user machine via rowhammer in js running in a browser tab, but as far as I know that was never made practical.

It will detect (by crashing) enough to make exploitation impractical. That is the key point.

Memory bit flips are very rare.

Normally a memory error does not happen more than a few times per year, unless you have a huge amount of memory.

Therefore when 2 memory correctable or uncorrectable errors happen in the same day, that should be enough to trigger an immediate report to the user or administrator of the computer that either there is an ongoing RowHammer attack that must be stopped or one of the memory modules is approaching its end-of-life due to aging and it must be replaced before it will begin to have very frequent memory errors.

At least on server computers it should be easy to configure their logging system so that a second memory error per day, even if it was correctable, should immediately send an e-mail message and/or an SMS to the administrator.

The same workload starts crashing after migrating to multiple machines?

Sounds like a process thing that would need to be developed by each team. So probably a mix of results there.

Sure: you replace the hardware with brand new hardware and it keeps happening. Then you know it's not the hardware.

If it has ECC memory, it's going to be branded as a workstation or server or industrial device, not marketed as a consumer device.

Among consumer products, some AMD desktop CPUs and motherboards support ECC memory, and that's about it.

The laptops with ECC memory are expensive and they are available for now only with Intel CPUs (while it should be possible to use mobile AMD CPUs I have never seen any such product). They are sold as "mobile workstations" by Dell, Lenovo and HP. I have a Dell Precision mobile workstation laptop with ECC memory bought in 2016 and it still works fine. However I had to pay for it EUR 3000 in 2016 and now something similar would be even more expensive (it had an NVIDIA Quadro GPU and 32 GB of ECC memory).

For desktops it is much easier to choose ECC memory, because the additional cost (the cost of the memory modules is 50% higher for DDR5-4800) remains a small fraction of the cost of an entire computer.

What is needed is to buy a motherboard with ECC support.

An example of a good motherboard with ECC support is ASUS PRIME X670E-PRO WIFI (for AMD Ryzen). I have been using a similar ASUS motherboard with ECC memory from the previous X570 generation for the last 5 years and it still works fine.

There are several other such MBs, mainly at ASUS and ASRock.

For Intel Raptor Lake there are fewer and more expensive such motherboards, but they can be found at ASUS (Pro WS W680M-ACE SE) and at Supermicro, as "workstation motherboards".

I think the point is that people with thousands of machines are probably going to notice if a meaningful chunk of them start halting.

Can you point to any botnets which were built using rowhammer attacks?

Rowhammer and speculative execution attacks are incredibly labor-intensive and target-specific. They are targeted attacks for high-value targets.

Sounds like a recipe to become to the next Ted Kaczynski.

The fact that JavaScript is essential to modern society makes me want to cry.

The year is 2024. Solar panels you installed from Alibaba begins to search for cell towers. Your local instance of LLM voice bot you built to keep you company is using a malicious npm package that suddenly communicates with the solar panels and starts sending packets to a Chinese server.

Some browsers (including Brave on iOS) can disable Javascript by default, to be enabled only on trusted sites where 3rd-party ads are blocked.

Noscript is annoying for like a week until you get the sites that you use frequently and basically trust whitelisted.

Sure, it isn’t perfectly safe. If HN or my employer goes evil, they can rowhammer me I guess. I’d expect it to cause a big todo, though, so I’m not that worried about it.

I don’t really understand why people seem to think disabling JS is a big hassle. Is this motivated reasoning by web devs or something?

It is not a big problem, and the sort of “ambient shittiness” of the internet greatly improved by doing it. Most sites work fine, they’ll default to some (better) less dynamic state, maybe some ads won’t load. For those sites that don’t work, you can make an exception or leave. Personally I’m now mostly visiting sites by people who don’t enjoy over complicating things, and who think about fallbacks. It is great!

If 99.9% of people can be exposed to the same malicious code and not even be aware that it was running in the background, it's all the more reason for a malicious actor to expose the largest amount of people to it with relatively minimal risk.

But "we", being the average tech expert, also has no way to know when that 1% will hit.

It takes only one creative genious to turn the next security issue into a thing that does affect us all. Some worm that eats all linuxes, a virus that spreads through all bsds or something that installs crypto miners on every second android or so. We cannot know.

And so we cannot defend ourselves against that. And so it's useless to worry about it. But it will happen. Our systems are way too monoculture, both soft- and hardware, to be protected against a digital potato famine.

Could you tell us what DIMMs you're using? I thought Rowhammer-free RAM was a thing of the past, but if some manufacturer has fixed theirs to be immune, they deserve the extra sales and publicity.

Definitely not a security expert here, but this is one of the reasons why I at least run ublock origin on just about everything - and recommend everyone do the same. The ad delivery networks is just such a huge vulnerability surface.

Noscript would be much better of course, I guess I'm just too lazy to go that extra step.

"could", theoretically. In practice, there has never been an observed exploitation of the supposed vulnerability.

mitigations=off

That is just one view, namely the authors' view. You may wish to consider recent perfect 10 vulnerabilities for comparison, as these are far more likely to cause problems.

May you please ELI5 why DDR5 is 'fragile' as you put it?

Was its design pushing material sciences such that the theory worked, but practical implementation required the 'crutch' of ECC?

That only brings DRAM into alignment with flash and magnetic storage, so it's not really a negative. Everything in your computer is converging on semiconductor with bounded probabilistic state + math.

From what I understand, it arises from DRAM manufacturers, interested in maximizing profits as much as possible, have been pushing the limits of how small they can make the RAM chip's features, and then backing off slightly until they felt ram was reliable "enough", but Rowhammer et al demonstrate it's very easy to cause bit flipping?

If oyu get that many bitflips the system wasn't stable to begin with.