If the RAM is only slightly faulty, so that the machine boots apparently normally, but sometimes crashes. Can the fault be leveraged somehow?

  • 1
    It could cause an application to crash and the operating system could dump its (corrupted) memory to the disk, to be later read by a malicious process running on the same system. That's in theory. – A. Hersean May 6 '19 at 13:13
  • @A.Hersean Even if a userland program knows that some kind of a fault exists, can it force other applications to encounter the fault? To call this leveraging the attacker may need to do more than just get lucky, maybe increase the odds somehow. – Memto May 6 '19 at 13:22
  • Maybe, maybe not. That depends on the type of fault the memory is encountering. I guess this cannot be answered without getting into the physics of your memory. – A. Hersean May 6 '19 at 13:44
  • @Memto technically, what he said is a leveraging of the problem to gain unauthorised access to information. – schroeder May 6 '19 at 13:44
  • 2
    @Memto it looks like you have specific criteria for this problem and how to leverage it. Can you edit your question to add more details on what you are expecting? – schroeder May 6 '19 at 13:44

Possible? Yes. Probable? Hardly. It's way more a reliability (or availability) issue than a security one.

A faulty RAM can lead to data corruption, and that corruption almost always will lead to a Segmentation Fault and crash the process. If the process is the kernel, or a critical process (like init on Linux systems), the entire computer crashes.

A less common effect is basically a hardware-induced RowHammer Attack. In this attack, a cell have its value changed intentionally. If you RAM banks are defective, there's an infinitesimal (but bigger than zero) chance that the byte changed will not crash the application and give it super powers. A bash shell with UID 0 or a cmd.exe instance with admin privileges are possible, but so improbable that you cannot count on it.

But leveraging a fault memory chip to actually attack the computer is almost out of question. An attacker that can execute code on the computer could employ countless privilege escalation attacks to gain more access, and an attacker with physical access can just take the disk, image it, and leave.

| improve this answer | |
  • I wouldn't be so quick to say that it's hardly probable. I've seen a screen lock tool break simply because the underlying terminal emulator segfaulted, and the segfault was traced back to a memory error. – forest May 7 '19 at 1:07
  • The issue is that OP wants to leverage the fault. Accidents happen, but leverage an accident to gain an advantage is another level of improbable. – ThoriumBR May 7 '19 at 1:50
  • I'd think that bad RAM would be hyper-susceptible to rowhammer and related attacks. – forest May 7 '19 at 1:52
  • 1
    Unless there a is way for a unprivileged program to detect a fault and then influence a critical bit to be located at the fault, then the odds are indeed just too low for a practical attack. Other than a single malfunctioning cell, are there other common RAM faults that could be relevant? – Memto May 8 '19 at 6:32
  • 1
    A study of DRAM failures in the field Found that about 40% of permanent errors they found are single bit errors and the rest 60% affect larger portions of the memory, with 6% even affecting multiple ranks, probably indicating a faulty chip affecting shared external circuits. – Memto May 8 '19 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.