Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
8

The Exploiting the DRAM rowhammer bug to gain kernel privileges article linked to in @J.A.K.'s answer had a link to Google's rowhammer-test program for checking for this vulnerability on "Linux or Mac OS X" and "x86-32 or x86-64". It runs indefinitely, stopping only if it detects a bit flip. One forum post recommends running for at least 30 minutes before ...


6

For DDR4: One DRAM manufacturer, Micron, indicated that they are putting rowhammer mitigations into some of their DDR4 DRAM (see this data sheet). Other manufacturers might be doing the same. Note that it is not necessarily true that "DDR4 is OK". There's nothing in the DDR4 standard that makes DDR4 memory safer than DDR3 memory -- the DDR4 standard does ...


5

The only reliable hardware mitigation that does not involve downgrading to a motherboard with DDR2 is to use memory that supports TRR (Target Row Refresh), which is optional for LPDDR4 (not the same as DDR4). Unfortunately, many DDR4 modules do not support TRR, and there is often no easy way to tell if it is supported without digging deep. There is also pTRR ...


3

Rowhammer only works by accelerating the discharge of capacitors. Cells don't get charged by rowhammer, only discharged. The reason you may see a logical 0 change to a logical 1 is that modern DRAM memory uses a technique called scrambling, where a small 32-bit seed is used to power an LFSR stream cipher to encrypt memory. This encryption is not designed to ...


2

The research paper itself which uncovered this did not specifically identify the manufacturers by name. In fact, they anonymized them on purpose. Suffice it to say that it would be reasonable to assume it was the majority of DRAM modules that have been recently manufactured: From the paper: As listed in Table 3, we tested for disturbance errors in a ...


2

MemTest86* version 7 has a Rowhammer test, but it only works on systems with UEFI support. * not to be confused with MemTest86+.


2

Yes, the principle and impact is the same. One of the specific properties of Rowhammer is that it is affecting nearby memory rows only (hence the name rowhammer). This makes establishing non-destructive attacks a challenge.


2

There are no means to disable typed arrays in the browser. Much like you can't disable the use of 'img src' or 'a href' tags in the code. What you can do however is prevent the execution of javascript via this method. In Firefox typed 'about:config' in the address bar Click "I accept the risk" on the dialogue box that comes up Type 'javascript.enabled' in ...


Only top voted, non community-wiki answers of a minimum length are eligible