[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <06836fd6-a1eb-4af8-a5f9-012b37a6c162@gmail.com>
Date: Fri, 26 Sep 2025 19:06:18 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: Demi Marie Obenour <demiobenour@...il.com>,
oss-security@...ts.openwall.com, Peter Gutmann <pgut001@...auckland.ac.nz>,
"Adiletta, Andrew" <ajadiletta@....edu>, Solar Designer
<solar@...nwall.com>, Andrew Cooper <andrew.cooper3@...rix.com>
Cc: "openssh@...nssh.com" <openssh@...nssh.com>, "Tol, Caner" <mtol@....edu>,
"Sunar, Berk" <sunar@....edu>, "Doroz, Yarkin" <ydoroz@....edu>,
"Todd C. Miller" <Todd.Miller@...rtesan.com>
Subject: Re: Re: [EXT] Re: CVE-2023-51767: a
bogus CVE in OpenSSH
On 9/26/25 09:19, Demi Marie Obenour wrote:
> On 9/25/25 22:33, Jacob Bachmeyer wrote:
> [...]
>> It seems highly likely that Rowhammer is an inherent consequence of DRAM
>> density beyond a certain limit and highly *unlikely* that reducing DRAM
>> density below the "Rowhammer threshold" will prove to be an acceptable
>> solution.
> See https://arxiv.org/pdf/2407.09995 for the proper solution: store a
> per-row activation counter alongside the row itself, and when any row
> in a bank exceeds the threshold, take action.
I am somewhat skeptical about this, simply because there have been many
"proper solutions" to Rowhammer that have thus far failed.
>> [...]
>>
>>
>> The stack is intrinsically aligned on much finer than page granularity;
>> introducing additional "jitter" to the locations of stack variables (and
>> spilled registers) is a solution available today with minimal cost. All
>> you need is "size_t slide_size=random_stack_slide_size(); void *
>> slide=alloca(slide_size); memset(slide,0,slide_size);" near the top of
>> main (and possibly other functions to "mix it up" more) and a function
>> random_stack_slide_size() that gives an appropriate unpredictable value.
>>
>> The key is to avoid trying to prevent bits from being flipped (that
>> proverbial ship has sailed on current hardware) but instead prevent an
>> attacker from being able to predict accomplishing something useful with
>> those bit-flips.
> I suspect that in general this is provably impossible.
You suspect that ASLR is generally provably useless? "Sliding" the
stack is the same basic principle as ASLR.
The "Rowhammer Mayhem" attack evades ASLR by exploiting the kernel's
physical page allocation policy, effectively converting the significant
address to an ordinal page number ("Nth page allocated") and offset
instead of a virtual or physical address.
> My hope is that
> EU regulations like CRA and PLD will force hardware recalls when defects
> like Rowhammer are detected.
You realize that legal cudgels like that could very well kill the entire
computing industry if it turns out that Rowhammer is due to physical
limitations, right?
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
