<story><title>ZenHammer: Rowhammer attacks on AMD Zen-based platforms</title><url>https://comsec.ethz.ch/research/dram/zenhammer/</url></story><parent_chain></parent_chain><comment><author>tdullien</author><text>Coauthor of the original Rowhammer exploit here. ECC remains a highly effective method for turning this from a security issue to a reliability issue, &lt;i&gt;mostly&lt;/i&gt;. As an individual owner of a server, if that server has ECC and you expect to notice machine halts due to uncorrectable ECC errors, the security implications for you are modest.&lt;p&gt;Now, if you are a cloud provider that provides VMs on multitenant hosts, your threat model may be different.&lt;p&gt;Either way, avoid machines without ECC. TRR was a lame duck even when Rowhammer was still fresh, and bits flipping in DRAM will not go away unless the economics in DRAM manufacturing change (e.g. not).</text></comment>
<story><title>ZenHammer: Rowhammer attacks on AMD Zen-based platforms</title><url>https://comsec.ethz.ch/research/dram/zenhammer/</url></story><parent_chain></parent_chain><comment><author>crotchfire</author><text>&lt;i&gt;What about DIMMs with Error Correction Codes (ECC)? 
 Previous work on DDR3 showed that ECC cannot provide protection against Rowhammer.&lt;/i&gt;&lt;p&gt;This is incredibly misleading.  The paper they cite states:&lt;p&gt;&lt;i&gt;When the ECC detection is used correctly 0.65%-7.42% of all bit flips still cause silent corruptions... On setup AMD-1, uncorrectable errors crash the system.&lt;/i&gt;&lt;p&gt;The attacker will need to cause dozens of machine halts in order to achieve even a single exploitable bitflip.  Dozens of machine halts is not something that goes undetected.&lt;p&gt;Kudos for calling out JEDEC&amp;#x27;s terrible behavior on the rowhammer question, but we should not be downplaying ECC as a near-term solution.</text></comment>