On DRAM Rowhammer and the Physics of Insecurity

Walker, Andrew; Lee, Sungkwon; Beery, Dafna

doi:10.1109/ted.2021.3060362

Cited by 32 publications

(29 citation statements)

References 51 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Modern DRAM chips suffer from an error mechanism, called RowHammer [71,72,101] that happens when a DRAM row (i.e., aggressor row) is repeatedly activated enough times before its neighboring rows (i.e., victim rows) get refreshed [29,58,71,72,99,101,110,111,127,153,[164][165][166]. Due to the aggressive reduction in manufacturing process technology node size, DRAM cells become smaller and closer to each other, exacerbating the RowHammer vulnerability.…”

Section: The Rowhammer Vulnerabilitymentioning

confidence: 99%

“…Thus, it is necessary to rigorously understand the RowHammer vulnerability of modern DRAM chips, project future attacks, and develop effective RowHammer defense mechanisms in modern systems that use DRAM. Through characterization [71,72,110,111] and modeling [29,58,111,123,127,153,[164][165][166], past research shows that circuit-level capacitive coupling [58,123] and trap-assisted leakage [166] have a significant effect on RowHammer bit flips [153].…”

Section: The Rowhammer Vulnerabilitymentioning

confidence: 99%

“…We provide the first rigorous characterization of RowHammer considering the time that the aggressor row stays in the row buffer (i.e., aggressor row active time). Prior works [109,110,153] propose circuit models and suggest that RowHammer vulnerability of a victim row can depend on the aggressor row active time based on preliminary data on a very small number of DRAM cells (i.e., only one carefully-selected DRAM row from each manufacturer) [109,110]. However, none of these works conduct a rigorous analysis of how RowHammer vulnerability varies with aggressor row active time across a significant population of DRAM rows from real offthe-shelf DRAM modules.…”

Section: Aggressor Row Active Time Analysismentioning

confidence: 99%

“…Unfortunately, these reductions have been shown to negatively impact DRAM reliability [92,98] and expose vulnerabilities such as RowHammer [71,72,101]. RowHammer is an error mechanism that is caused by hammering, or opening and closing (i.e., activating and precharging), a DRAM row (i.e., aggressor row) many times, which can cause bit flips in physically-nearby rows (i.e., victim rows) [29,58,72,99,101,110,111,127,153,[164][165][166]. RowHammer has gained attention in both academia and industry, and various attacks have exploited the RowHammer vulnerability to escalate privilege, leak private data, and manipulate critical application outputs [1,10,13,20,21,26,27,33,34,39,43,49,56,78,85,99,101,118,119,122,129,133,145,150,151,156,158,167,…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

Orosa

Yağlıkçı

Luo

et al. 2021

MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture

View full text Add to dashboard Cite

RowHammer is a circuit-level DRAM vulnerability where repeatedly accessing (i.e., hammering) a DRAM row can cause bit flips in physically nearby rows. The RowHammer vulnerability worsens as DRAM cell size and cell-to-cell spacing shrink. Recent studies demonstrate that modern DRAM chips, including chips previously marketed as RowHammer-safe, are even more vulnerable to RowHammer than older chips such that the required hammer count to cause a bit flip has reduced by more than 10X in the last decade. Therefore, it is essential to develop a better understanding and in-depth insights into the RowHammer vulnerability of modern DRAM chips to more effectively secure current and future systems.Our goal in this paper is to provide insights into fundamental properties of the RowHammer vulnerability that are not yet rigorously studied by prior works, but can potentially be 𝑖) exploited to develop more effective RowHammer attacks or 𝑖𝑖) leveraged to design more effective and efficient defense mechanisms. To this end, we present an experimental characterization using 248 DDR4 and 24 DDR3 modern DRAM chips from four major DRAM manufacturers demonstrating how the RowHammer effects vary with three fundamental properties: 1) DRAM chip temperature, 2) aggressor row active time, and 3) victim DRAM cell's physical location. Among our 16 new observations, we highlight that a RowHammer bit flip 1) is very likely to occur in a bounded range, specific to each DRAM cell (e.g., 5.4% of the vulnerable DRAM cells exhibit errors in the range 70 °C to 90 °C), 2) is more likely to occur if the aggressor row is active for longer time (e.g., RowHammer vulnerability increases by 36% if we keep a DRAM row active for 15 column accesses), and 3) is more likely to occur in certain physical regions of the DRAM module under attack (e.g., 5% of the rows are 2x more vulnerable than the remaining 95% of the rows). Our study has important practical implications on future RowHammer attacks and defenses. We describe and analyze the implications of our new findings by proposing three future RowHammer attack and six future RowHammer defense improvements.

show abstract

Section: The Rowhammer Vulnerabilitymentioning

confidence: 99%

Section: The Rowhammer Vulnerabilitymentioning

confidence: 99%

Section: Aggressor Row Active Time Analysismentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

Orosa

Yağlıkçı

Luo

et al. 2021

MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture

View full text Add to dashboard Cite

show abstract

“…However, as semiconductor technology gradually advances and new memory structures are continuously developed, it is unrealistic to model every aspect of memory failure mechanisms. For example, it is not possible to describe all aspects of the radiation-induced or rowhammer failure mechanisms because the mechanisms can vary with power, voltage, and temperature (PVT) conditions, as well as other memory constraints [6], [7], [8]. An FM is an abstraction of a failure mechanism [9], [10]; when the failure mechanisms are not properly blended into the FMs, test algorithms generated based on these FMs cannot properly test the memory failure mechanisms.…”

Section: Introductionmentioning

confidence: 99%

Fault Coverage Re-Evaluation of Memory Test Algorithms With Physical Memory Characteristics

2021

View full text Add to dashboard Cite

A memory fault model (FM) is an abstraction of the physical mechanism of memory failure. When the physical failure mechanisms are not fully represented in FMs, the coverage of the FMs can be different from that of the failure mechanisms. However, it is impractical (or impossible) to model every electrical aspect of the failure mechanisms with one or more FMs. This problem has become even worse with emerging technologies. Thus, in this study, the fault coverage (FC) consequences are investigated when the physical memory characteristics are not properly linked to the FMs or even test algorithms. Three physical characteristics were considered for this exploration: electrical masking, address scrambling, and electrical neighborhoods. To this end, memory fault simulations were performed, and the test algorithms were reevaluated in terms of FC. Simulations were performed on the 1 kB area of the example SRAM model; three classes of FMs (56 static faults (SFs), 126 dynamic faults (DFs), and 192 neighborhood pattern-sensitive faults (NPSFs)) were simulated for FC evaluation; and March MSS, March MD2, and March 12N were used to re-evaluate the FCs of SFs, DFs, and NPSFs, respectively. From the simulation results, we observed the negative impact of physical characteristics on FC. When masking was considered, FC reductions of 10.72% SFs and 9.52% DFs were observed; when address scrambling was not available, an FC reduction of 80.21% NPSFs was observed. Finally, considering electrical neighborhood changes depending on the physical memory structure, an FC reduction of 41.67% NPSFs was observed.INDEX TERMS Fault coverage (FC) re-evaluation, electrical masking, address scrambling, electrical neighborhood, memory fault model (FM).

show abstract