A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

Abstract

RowHammer is a circuit-level DRAM vulnerability where repeatedly accessing (i.e., hammering) a DRAM row can cause bit flips in physically nearby rows. The RowHammer vulnerability worsens as DRAM cell size and cell-to-cell spacing shrink. Recent studies demonstrate that modern DRAM chips, including chips previously marketed as RowHammer-safe, are even more vulnerable to RowHammer than older chips such that the required hammer count to cause a bit flip has reduced by more than 10X in the last decade. Therefore, it is essential to develop a better understanding and in-depth insights into the RowHammer vulnerability of modern DRAM chips to more effectively secure current and future systems.Our goal in this paper is to provide insights into fundamental properties of the RowHammer vulnerability that are not yet rigorously studied by prior works, but can potentially be 𝑖) exploited to develop more effective RowHammer attacks or 𝑖𝑖) leveraged to design more effective and efficient defense mechanisms. To this end, we present an experimental characterization using 248 DDR4 and 24 DDR3 modern DRAM chips from four major DRAM manufacturers demonstrating how the RowHammer effects vary with three fundamental properties: 1) DRAM chip temperature, 2) aggressor row active time, and 3) victim DRAM cell's physical location. Among our 16 new observations, we highlight that a RowHammer bit flip 1) is very likely to occur in a bounded range, specific to each DRAM cell (e.g., 5.4% of the vulnerable DRAM cells exhibit errors in the range 70 °C to 90 °C), 2) is more likely to occur if the aggressor row is active for longer time (e.g., RowHammer vulnerability increases by 36% if we keep a DRAM row active for 15 column accesses), and 3) is more likely to occur in certain physical regions of the DRAM module under attack (e.g., 5% of the rows are 2x more vulnerable than the remaining 95% of the rows). Our study has important practical implications on future RowHammer attacks and defenses. We describe and analyze the implications of our new findings by proposing three future RowHammer attack and six future RowHammer defense improvements.

Uncovering In-DRAM RowHammer Protection Mechanisms:A New Methodology, Custom RowHammer Patterns, and Implications

“…Therefore, we implement RS and TRR-A using SoftMC [33,105], an FPGA-based DRAM testing infrastructure that provides precise control on the DDR commands issued to a DRAM module. We modify SoftMC to support testing DDR4 modules, as also done in [24,54,88,89]. Fig.…”

“…Kim et al [56] are the first to introduce and analyze the RowHammer phenomenon. Numerous later works develop RowHammer attacks to compromise various systems in various ways [1, 7, 8, 15, 16, 19, 23, 24, 28, 29, 34, 38, 44, 54, 62, 71, 82, 83, 96, 98, 100, 104, 109, 122-124, 128, 129, 136, 140] and analyze RowHammer further [15,16,28,54,89,97,98,122,126,135]. To our knowledge, this is the first work to 1) propose an experimental methodology to understand the inner workings of commonly-implemented in-DRAM RowHammer protection (i.e., TRR) mechanisms and 2) use this understanding to create custom access patterns that circumvent the TRR mechanisms of modern DDR4 DRAM chips.…”

“…Other works[46,51,65,89,96] also propose various methods for reverse engineering DRAM physical layout and their methods can also be used for our purposes.…”

PiDRAM: A Holistic End-to-end FPGA-based Framework for Processing-in-DRAM

“…SoftMC can issue arbitrary sequences of DDR3 commands to real DRAM devices. SoftMC is widely used in prior work that study the performance, reliability and security of real DRAM chips [18,27,33,35,43,51,61,67,70,77,90,108]. SoftMC is built to test DRAM devices, not to study end-to-end implementations of PuM techniques.…”

HARP: Practically and Effectively Identifying Uncorrectable Errors in Memory Chips That Use On-Die Error-Correcting Codes

“…Unfortunately, as memory designers shrink (i.e., scale) memory process technology node sizes to meet ambitious capacity, cost, performance, and energy efficiency targets, worsening reliability becomes an increasingly significant challenge to surmount [10,21,54,74,87,89,91,107,116,129,132,136,144,150,170]. For example, DRAM process technology scaling exacerbates cell-to-cell variation and noise margins, severely impacting error mechanisms that constrain yield, including cell data-retention [21,46,47,54,74,76,77,93,110,136,144,147,161,171] and read-disturb [40,52,87,91,131,132,141] phenomena. Similarly, emerging main memory technologies suffer from various error mechanisms that can lead to high error rates if left unchecked, such as limited endurance, resistance drift, and write disturbance in PCM [10,62,73,88,101,105] and data retention, endurance, and read disturbance in STT-RAM [9,…”