Rowhammer

[Demi Obenour]

Are either of the Qubes-certified laptops vulnerable to Rowhammer or to TRRespass?  I believe that immunity to both should be required.  Also, are Lenovo P51s vulnerable?

Sincerely,

Demi

[David Hobach]

It is a matter of thetype of RAM the manufacturer uses which I guess may
change depending on availability.

memtest86 has a test for Rowhammer, but in my experience it usually
shows "all good" which contradicts the papers ("80% vulnerable to
Rowhammer").

[Zach Lym]

You should probably ask the vendors who are selling it.

The only truly effective mitigation for ROWHAMMER that I am aware of is encrypted memory, which is only available on some AMD processors.  

[dhorf-qrir...@hashmail.org]

On Fri, May 15, 2020 at 09:52:32AM -0700, Zach Lym wrote:
> The only truly effective mitigation for ROWHAMMER that I am aware of is
> encrypted memory, which is only available on some AMD processors.

do you have any reference/paper/link for this?

aiui pure "destructive" rowhammer will not be changed by "memory
encryption" at all.

a "privilege escalation / limited targeted write" rowhammer will
only be a little harder and easier to detect. (depending on
implementation details)

and a memory encrpytion implementation that was designed with this
problem in mind might make "rambleed / reading through reverse
rowhammer" somewhat hard.

[Zach Lym]

Damn, you are right: AMD uses weasle wording in their documention, but from their security notices it doesn't appear that they are verify integrity.