Re: Re: [EXT] Re: [oss-security] CVE-2023-51767: a bogus CVE in OpenSSH

[Jacob Bachmeyer <jcb62281 () gmail com>]

On 9/26/25 09:19, Demi Marie Obenour wrote:
> On 9/25/25 22:33, Jacob Bachmeyer wrote:
> [...]
> > It seems highly likely that Rowhammer is an inherent consequence of DRAM
> > density beyond a certain limit and highly *unlikely* that reducing DRAM
> > density below the "Rowhammer threshold" will prove to be an acceptable
> > solution.
> See https://arxiv.org/pdf/2407.09995 for the proper solution: store a
> per-row activation counter alongside the row itself, and when any row
> in a bank exceeds the threshold, take action.

I am somewhat skeptical about this, simply because there have been many 
"proper solutions" to Rowhammer that have thus far failed.

> > [...]
> >
> >
> > The stack is intrinsically aligned on much finer than page granularity;
> > introducing additional "jitter" to the locations of stack variables (and
> > spilled registers) is a solution available today with minimal cost.  All
> > you need is "size_t slide_size=random_stack_slide_size(); void *
> > slide=alloca(slide_size); memset(slide,0,slide_size);" near the top of
> > main (and possibly other functions to "mix it up" more) and a function
> > random_stack_slide_size() that gives an appropriate unpredictable value.
> >
> > The key is to avoid trying to prevent bits from being flipped (that
> > proverbial ship has sailed on current hardware) but instead prevent an
> > attacker from being able to predict accomplishing something useful with
> > those bit-flips.
> I suspect that in general this is provably impossible.

You suspect that ASLR is generally provably useless?  "Sliding" the 
stack is the same basic principle as ASLR.

The "Rowhammer Mayhem" attack evades ASLR by exploiting the kernel's 
physical page allocation policy, effectively converting the significant 
address to an ordinal page number ("Nth page allocated") and offset 
instead of a virtual or physical address.

> My hope is that
> EU regulations like CRA and PLD will force hardware recalls when defects
> like Rowhammer are detected.

You realize that legal cudgels like that could very well kill the entire 
computing industry if it turns out that Rowhammer is due to physical 
limitations, right?


-- Jacob