ECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory
summary
First end-to-end Rowhammer on Intel servers with Hynix DDR4 ECC memory demonstrating bit flips in an average of 25 hours and RSA key breaks in 10 hours. Uses FPGA to expose a sampling-based TRR bias, a data-for interposer and logic analyzer for logic-analyzer ECC recovery to extract the controller’s 64–72 byte code and distance-4 layout, templates single-bit victims, detects flips via an Intel timing side channel, exploits chipkill behavior and uses allocator massaging to place and flip RSA public keys.
AI-written summary · about
chapters (8)
- 0:00Rowhammer and ECC memory
- 2:40Rowhammer basics and server memory
- 6:30Targeted bit flips bypass ECC
- 9:26ECC matrix recovery and templating
- 11:58Chipkill error correction bypass
- 13:02End-to-end attack with allocator massaging
- 14:48Practical results and RSA forgery
- 15:20Q&A
related talks
38mCSI:Rowhammer: Closing the Case of Half-Double and Beyond
40mRowhammer Attacks: A Walkthrough Guide
29mCAn’t Touch This...
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
25mDRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
28mFlip Feng Shui: Hammering a Needle in the Software Stack
34mLeapFrog: The Rowhammer Instruction Skip Attack
51mExploiting Hardware Glitches And Side Channels In Perfect Software