Yes, they're safe. Consumer memory DIMMs use volatile SDRAM memory. Volatile means that it does not hold its state after you turn it off.
SDRAM memory chips are constructed from an array of memory cells, with one cell per bit of data stored. Modern memory ICs have billions of cells each. Each memory cell is constructed from a transistor and a capacitor. A transistor is like an electronic switch, and a capacitor is like a tiny battery. The value stored in the cell is a single bit - a value of 0 or 1, represented by a low or high voltage.
Here's a circuit diagram of a simple memory cell:
You can simulate this circuit in your browser here, and I'll talk you through how it works. You can control the simulation with the "Run/STOP" and "Reset" buttons on the top right. If the run/stop button is red, you've stopped the simulation. If it's grey, it's running.
I've labelled the transistor and the capacitor, so you can see where they are. The parts marked 10k, 100k, and 1M are resistors - don't worry about those for now.
At the top left of the circuit we've got our input data. This is a switch that selects either 5V or 0V (ground), to represent a value of 1 or 0. We use this switch to select which value we want to write into the cell. On the right, we've got our output data. This will show as 1 or 0 when we read from the cell.
Underneath that, we have a write/read switch. This selects which operation we want to perform. When switched to the left it writes a value to the cell, using whichever value was set by the input data switch. When switched to the right it reads a value from the cell and displays it on the output data.
The enable switch allows us to decide whether or not we want to talk to this specific cell at any point in time. When there are many of these cells all connected to the same input and output signals, this allows us to select just one cell to be read from or written to.
There's another switch marked "leakage". I'll get to that later - leave that switch open for now.
First, let's write a 1 to the cell. Set the input data switch to 1 and the write/read switch to write. Then close the enable switch. You'll see the bottom of the circuit light up green, and little yellow dots will move for a moment to indicate that a current is flowing as the capacitor charges up.
The top part of the capacitor goes green, indicating that the capacitor is now charged up and the cell's value is set to 1.
Next, flip the write/read switch to the right, in order to read from the cell. The output data now shows 1.
Repeat this again, but for an input value of 0.
Also have a play with the enable switch - you'll see that when it is open, the output data will always be 0 regardless of what you do with the input value and the write/read switch. Additionally, whatever value is stored in the capacitor stays there until you turn the enable switch back on.
What we've looked at so far is an ideal memory cell. It can store a 0 or 1 almost perpetually. However, in reality there is always some leakage in the capacitor that causes it to slowly lose its charge. You can simulate this with the leakage switch I included in the circuit.
Close the leakage switch, then set the input data to 1, the write/read switch to write, and close the enable switch. This will cause a 1 to be written to the cell. Now change the write/read switch to read, and look at the output data. It will show 1, just as before. Now wait a few seconds. The output data will flip back to 0.
If you watch the path through the leakage switch and the 10k resistor, you'll see the current dots flowing slowly along as the capacitor charge leaks out. Eventually, the capacitor voltage drops below the threshold voltage, causing it to be read as a 0 instead of a 1.
Try this a few times to get a feel for what's happening. Once you're happy with that, it's time for another experiment.
With the leakage switch closed, repeat the write process again and store a 1 in the cell. This time, instead of immediately performing a read operation, open the enable switch beforehand. Wait a few seconds, then close the enable switch. Here's the full steps in case it's not clear:
- Close the leakage switch.
- Set the input data to 1.
- Set the write/read switch to write.
- Close the enable switch. Observe the capacitor charging up.
- Open the enable switch.
- Set the write/read switch to read.
- Wait 5 seconds.
- Close the enable switch.
Notice that the output data is zero! What happened is that the charge in the capacitor leaked away while you were waiting, causing it to drop from 1 to 0.
This happens in real DRAM chips, too. The controller on the memory chip has to constantly refresh the data in the cells by reading them and writing their values back, to keep up with leakage. When you turn off your computer the data in the DRAM memory chips quickly degrades and leaks back to all zeroes. This process normally takes only a few seconds.
(interesting little aside here: the time it takes to set up the switches and get the data in and out of a specific cell is what defines the latency of memory, often listed as four numbers or just something like "CL16" - the memory timings wiki has some further info on this)
The leakage process can be artificially slowed down by cooling the chips down to very low temperatures, in what's known as a cold boot attack. This causes the cells to retain their values for much longer. It only works if you freeze the RAM right at the same time as powering the system off - if you wait even a few seconds before freezing it all the data will have begun to degrade. As such it's not a problem for you.
There are some additional interesting things that can be talked about here, such as SPD flash, NVDIMM, and Intel Optane, but I'm due to play a D&D game in ten minutes so I don't have time to expand this answer right now. I'll come back later and edit them in. Don't worry, though - they don't affect the safety of your sale!
Ok, zombie beholder's dead. Let's talk non-volatile RAM.
There's a special type of memory technology called NVDIMM. An NVDIMM is like a regular DDR SDRAM module, except it has a battery backup on it and a non-volatile flash memory chip. This allows the system to be powered off without losing memory state. The battery backup on the DIMM allows it to continue to refresh the memory cells. It then copies the contents of the memory cells into the non-volatile flash chip. It can then safely power off, because the contents of memory are saved and the volatile memory chips do not need to be refreshed. The operating system has to be built with support for this feature. This is a specialist memory technology usually reserved for server applications where you need to be able to recover the contents of memory during a power outage, or bring the system up to the same state quickly after maintenance (e.g. replacing a PSU or UPS).
Another type of non-volatile DIMM is Intel Optane. This is actually not RAM at all - it's better to think of it like a very low latency NVMe SSD that just happens to plug into a DIMM slot.
Finally, let's talk about SPD flash. When you plug a DIMM into your system, your motherboard needs to be able to identify it and learn about its specs and features - its name, size, type, speed, latencies, voltage requirements, inbuilt overclocking profiles, and all sorts of other details. This information is provided by a standard interface called Serial Presence Detect (SPD). In practice, the information is stored in a table (the exact format and contents of which is defined by JEDEC) in a small non-volatile flash EEPROM chip on the DIMM, which the motherboard can talk to via SMBus. The operating system can also talk to this chip to find out information about the memory - you can view it with a tool like CPU-Z.
Normally this SPD data is written to the EEPROM at the factory and never changed. However, it is entirely possible to write to the flash chip from the operating system. Some chips do technically have the ability to lock the first half of the data (usually the first 256 bytes) but often this is not done, and the second half of the data is always writable. The size of the SPD table for DDR4 is 383 bytes. However, nobody makes 383 byte EEPROM chips - that'd be weird. Instead, you'll usually find that the chip is 512 bytes in size. This means that there are 129 bytes left in the EEPROM that aren't used for anything. If you wanted to, you could store 129 bytes of non-volatile data in every stick of RAM in your computer, by writing to the SPD flash. I wouldn't recommend trying this yourself, since there's every chance you could brick your RAM if you do it wrong, but I did this as an on-stage demo at a security conference a while back.
The SPD interface isn't usually exposed to anything but the kernel, but there are many signed Windows drivers out there that either provide write access to SPD by design, as well as drivers that provide write access to SPD by accident, which you can abuse to write a small amount of data to the SPD flash chips.
There is, therefore, a scenario in which an attacker could use one of these drivers to write to the SPD flash. This data would remain on the DIMMs even after the system rebooted, or even if you re-installed your OS. The data doesn't do anything by itself - you need malicious code to already be running on the system to actually read and write it - but it is a nice little hidden storage location for a few bytes of data. There's almost no reason to abuse this storage location in practice - it's complicated, error-prone, requires admin and a loaded driver, for almost no benefit in return - but it is a fun little trick to store non-volatile data on regular volatile memory DIMMs!
One scenario where this is actually really important is bare-metal cloud hosting environments. In these environments, customers rent physical systems that they have complete administrative access to, rather than virtualised instances. Providers of these services need to ensure that there is no data remanence between one customer and the next. The SPD writing trick is one way for an attacker to achieve data remanence. There are plenty of other EEPROMs on the motherboard, hard disks, network card, RAID card, etc. that can also potentially be written to by an attacker with that kind of access. Bare-metal cloud providers have to implement special checks to ensure that these non-volatile flash memory devices were not modified. It's quite a challenge and hardware attestation is far from a solved problem. Again, this doesn't affect your consumer memory DIMMs, but it's a situation where a device that you expect to be volatile or stateless may actually have some non-volatile state.
