Experiments and root cause analysis for active-precharge hammering fault in DDR3 SDRAM under 3 × nm technology

Park, Kyung Bae; Lim, Chun Kyu; Yun, Donghyuk; Baeg, Sanghyeon

doi:10.1016/j.microrel.2015.12.027

Cited by 44 publications

(49 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The percentage of bits that flip in a victim row is a function of the percentage of bits in that row that have a data value of 1 [8]. Similar behavior again was seen before [3], [16], [27]. The behavior that only charged cells can flip is slightly obscured by the fact that data can be stored as "true-cells" or "anticells" where, for a data 1, the former has the SN junction at a positive potential and the latter is close to ground [3], [8].…”

Section: Experimental Data At Chip Levelsupporting

confidence: 63%

“…Other relevant full-chip experimental data include the effect of temperature [3], [27], [16] where RH susceptibility has been seen to be the worst within the range of 13 • C to 30 • C [27] although the effect was not as pronounced in [16]. Also, more advanced DRAM technologies suffer more from this disturb in having greater numbers of bit-flips per aggressor wordline activation [3], [6], [8] and a lower hammer count needed to flip the first bit [6].…”

Section: Experimental Data At Chip Levelmentioning

confidence: 99%

“…Regarding the injected electrons from the hammered cell transistors, the blame for these has been placed on two different origins. The first describes a collapsing inversion layer associated with the hammered cell transistor where a population of electrons is injected into the p-well as the transistor's gate turns off [16]. The second describes electron injection from charge traps near the silicon/gate dielectric interface of the cell select transistor [13], [17].…”

mentioning

confidence: 99%

See 2 more Smart Citations

On DRAM Rowhammer and the Physics of Insecurity

Walker¹,

Lee

Beery³

2021

IEEE Trans. Electron Devices

View full text Add to dashboard Cite

The dynamic random access memory (DRAM) disturb known as rowhammer (RH) has come to dominate the insecurity of computing systems worldwide. Several studies have concentrated on electron injection from a switching cell select transistor and capture by nearby storage node junctions as being the main mechanism for the effect. This article for the first time looks in-depth at RH from the point of view of both electron injection and capture, and capacitive crosstalk. The absence of such comprehensive studies at the silicon level in the literature can be attributed to its sensitive nature within the industry and highlights the difficulty of DRAM scaling. This review article, therefore, forms a broad foundation to extend understanding of this dangerous disturb mechanism and in so doing provides an informed view on the ability of future DRAM technologies to solve RH once and for all. Index Terms-Crosstalk, dynamic random access memory (DRAM), electron injection, rowhammer (RH). I. INTRODUCTION T HE story of dynamic random access memory (DRAM) is that of the semiconductor industry itself [1], [2]. Fifty years of scaling a field-effect transistor and a capacitor has resulted in DRAM as the "main memory" in all compute systems from cloud servers through laptops to mobile phones. This success makes such systems prone to any security weakness that may lurk within DRAM itself. The DRAM disturb known as rowhammer (RH) has been causing increasing concern since its public unmasking in [3]. It is characterized by corrupted data in cells close to a row that is turned on and off many times between data refresh. Although the actual problem seems to have been known since 2010, and most probably before that within DRAM Research and Development, with some patent applications in 2012, RH was propelled to the forefront of hardware security issues when it was used to gain computer kernel privileges [4]. After ten years from the first inkling of a problem, the RH disturb varies widely between Manuscript

show abstract

Section: Experimental Data At Chip Levelsupporting

confidence: 63%

Section: Experimental Data At Chip Levelmentioning

confidence: 99%

mentioning

confidence: 99%

See 1 more Smart Citation

On DRAM Rowhammer and the Physics of Insecurity

Walker¹,

Lee

Beery³

2021

IEEE Trans. Electron Devices

View full text Add to dashboard Cite

show abstract

“…Since the RowHammer failure is mainly caused by the traps in the interface (according to the authors' hypotheses), the authors show that this technique can help to improve DRAM reliability against crosstalk and thus alleviate RowHammer attacks. [192] and [193] experimentally test DDR3 devices for RowHammer susceptibility, show statistical distributions of RowHammer failures across many devices, and present evidence that the root cause of the RowHammer phenomenon is charge recombination of the victim cell with electrons from the current channels between neighboring cells and their corresponding bitlines.…”

Section: Circuit-level Studies Of Rowhammermentioning

confidence: 93%

RowHammer: A Retrospective

Mutlu

Kim

2020

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

154

129

View full text Add to dashboard Cite

This retrospective paper describes the RowHammer problem in Dynamic Random Access Memory (DRAM), which was initially introduced by Kim et al. at the ISCA 2014 conference [133]. RowHammer is a prime (and perhaps the first) example of how a circuit-level failure mechanism can cause a practical and widespread system security vulnerability. It is the phenomenon that repeatedly accessing a row in a modern DRAM chip causes bit flips in physically-adjacent rows at consistently predictable bit locations. RowHammer is caused by a hardware failure mechanism called DRAM disturbance errors, which is a manifestation of circuit-level cell-to-cell interference in a scaled memory technology.Researchers from Google Project Zero demonstrated in 2015 that this hardware failure mechanism can be effectively exploited by user-level programs to gain kernel privileges on real systems. Many other follow-up works demonstrated other practical attacks exploiting RowHammer. In this article, we comprehensively survey the scientific literature on RowHammer-based attacks as well as mitigation techniques to prevent RowHammer. We also discuss what other related vulnerabilities may be lurking in DRAM and other types of memories, e.g., NAND flash memory or Phase Change Memory, that can potentially threaten the foundations of secure systems, as the memory technologies scale to higher densities. We conclude by describing and advocating a principled approach to memory reliability and security research that can enable us to better anticipate and prevent such vulnerabilities.

show abstract

“…As the chip density increases with technology scaling, the interaction between circuit components, such as transistors, capacitors, and wires increases, leading voltage fluctuations [8][9][10]. Specifically, when the cumulative interference to a DRAM wordline becomes strong enough, the state of nearby cells can change leading to memory errors [11,12]. Vulnerability to wordline electromagnetic coupling (crosstalk) exists in recent sub 40nm commodity DRAM chips due to physical limitations of these technologies.…”

Section: Introductionmentioning

confidence: 99%