Re: [Xen-devel] Impact of HW vulnerabilities & Implications on Security Vulnerability Process

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Wed, 7 Sep 2016, Meng Xu wrote:
> On Wed, Sep 7, 2016 at 3:08 PM, Stefano Stabellini
> <sstabellini@xxxxxxxxxx> wrote:
> >
> > On Wed, 7 Sep 2016, Ian Jackson wrote:
> > > > Technical
> > > > =========
> > > > On the technical front, it would be good to understand whether
> > > > a) This is a real threat and whether thus, we as a community need to
> > > >    take action
> > >
> > > It is unclear what action the Xen upstream community can usefully
> > > take, other than providing users with information.
> > >
> > > But, users with deployments on actual hardware ought to try to find
> > > out whether they are vulnerable.  If they are then they could seek
> > > replacement non-faulty hardware from their vendor, or take unpleasant
> > > migitation measures (like switching to HVM, perhaps).
> >
> > How difficult is to check for it?
> >
> > Is there a simple test, maybe a little executable, that users could use
> > to find out whether their ram is vulnerable? That would be extremely
> > valuable.
> 
> Google does have a github repo to do the rowhammer test:
> https://github.com/google/rowhammer-test

Nice! It would be good to document this in a Xen Project document
somewhere.

The code is small enough that we could even consider pulling it in Xen
and running it at boot time (obviously it would be a kconfig option to
compile and a xen command line option to run the test). In case of
failure we could WARN the sysadmin and refuse to continue.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel