2 research outputs found
RowPress: Amplifying Read Disturbance in Modern DRAM Chips
Memory isolation is critical for system reliability, security, and safety.
Unfortunately, read disturbance can break memory isolation in modern DRAM
chips. For example, RowHammer is a well-studied read-disturb phenomenon where
repeatedly opening and closing (i.e., hammering) a DRAM row many times causes
bitflips in physically nearby rows.
This paper experimentally demonstrates and analyzes another widespread
read-disturb phenomenon, RowPress, in real DDR4 DRAM chips. RowPress breaks
memory isolation by keeping a DRAM row open for a long period of time, which
disturbs physically nearby rows enough to cause bitflips. We show that RowPress
amplifies DRAM's vulnerability to read-disturb attacks by significantly
reducing the number of row activations needed to induce a bitflip by one to two
orders of magnitude under realistic conditions. In extreme cases, RowPress
induces bitflips in a DRAM row when an adjacent row is activated only once. Our
detailed characterization of 164 real DDR4 DRAM chips shows that RowPress 1)
affects chips from all three major DRAM manufacturers, 2) gets worse as DRAM
technology scales down to smaller node sizes, and 3) affects a different set of
DRAM cells from RowHammer and behaves differently from RowHammer as temperature
and access pattern changes.
We demonstrate in a real DDR4-based system with RowHammer protection that 1)
a user-level program induces bitflips by leveraging RowPress while conventional
RowHammer cannot do so, and 2) a memory controller that adaptively keeps the
DRAM row open for a longer period of time based on access pattern can
facilitate RowPress-based attacks. To prevent bitflips due to RowPress, we
describe and evaluate a new methodology that adapts existing RowHammer
mitigation techniques to also mitigate RowPress with low additional performance
overhead. We open source all our code and data to facilitate future research on
RowPress.Comment: Extended version of the paper "RowPress: Amplifying Read Disturbance
in Modern DRAM Chips" at the 50th Annual International Symposium on Computer
Architecture (ISCA), 202
An Experimental Analysis of RowHammer in HBM2 DRAM Chips
RowHammer (RH) is a significant and worsening security, safety, and
reliability issue of modern DRAM chips that can be exploited to break memory
isolation. Therefore, it is important to understand real DRAM chips' RH
characteristics. Unfortunately, no prior work extensively studies the RH
vulnerability of modern 3D-stacked high-bandwidth memory (HBM) chips, which are
commonly used in modern GPUs.
In this work, we experimentally characterize the RH vulnerability of a real
HBM2 DRAM chip. We show that 1) different 3D-stacked channels of HBM2 memory
exhibit significantly different levels of RH vulnerability (up to 79%
difference in bit error rate), 2) the DRAM rows at the end of a DRAM bank (rows
with the highest addresses) exhibit significantly fewer RH bitflips than other
rows, and 3) a modern HBM2 DRAM chip implements undisclosed RH defenses that
are triggered by periodic refresh operations. We describe the implications of
our observations on future RH attacks and defenses and discuss future work for
understanding RH in 3D-stacked memories.Comment: To appear at DSN Disrupt 202