Alternate hammering test for application-specific DRAMs and an industrial case study

Huang, Rei-Fu; Yang, Haoyu; Chao, Mango C.-T.; Lin, Shih-Chin

doi:10.1145/2228360.2228543

Cited by 17 publications

(12 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Second, bridges are a well-known class of DRAM faults in which conductive channels are formed between unrelated wires and/or capacitors [3,4]. One study on embedded DRAM (eDRAM) found that toggling a wordline could accelerate the flow of charge between two bridged cells [29]. Third, it has been reported that toggling a wordline for hundreds of hours can permanently damage it by hot-carrier injection [17].…”

Section: Mechanics Of Disturbance Errorsmentioning

confidence: 99%

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Kim¹,

Daly²,

Kim³

et al. 2014

2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA)

449

1,019

View full text Add to dashboard Cite

Abstract. Memory isolation is a key property of a reliable and secure computing system -an access to one memory address should not have unintended side effects on data stored in other addresses. However, as DRAM process technology scales down to smaller dimensions, it becomes more difficult to prevent DRAM cells from electrically interacting with each other. In this paper, we expose the vulnerability of commodity DRAM chips to disturbance errors. By reading from the same address in DRAM, we show that it is possible to corrupt data in nearby addresses. More specifically, activating the same row in DRAM corrupts data in nearby rows. We demonstrate this phenomenon on Intel and AMD systems using a malicious program that generates many DRAM accesses. We induce errors in most DRAM modules (110 out of 129) from three major DRAM manufacturers. From this we conclude that many deployed systems are likely to be at risk. We identify the root cause of disturbance errors as the repeated toggling of a DRAM row's wordline, which stresses inter-cell coupling effects that accelerate charge leakage from nearby rows. We provide an extensive characterization study of disturbance errors and their behavior using an FPGA-based testing platform. Among our key findings, we show that (i) it takes as few as 139K accesses to induce an error and (ii) up to one in every 1.7K cells is susceptible to errors. After examining various potential ways of addressing the problem, we propose a low-overhead solution to prevent the errors.

show abstract

Section: Mechanics Of Disturbance Errorsmentioning

confidence: 99%

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Kim¹,

Daly²,

Kim³

et al. 2014

2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA)

449

1,019

View full text Add to dashboard Cite

show abstract

“…The Rowhammer bug has recently been studied [16,20,29] and the majority of off-the-shelf DRAM modules has been found vulnerable to bit flips using the clflush instruction. The clflush instruction flushes data from the cache, forcing the CPU to serve the next memory access from DRAM.…”

Section: The Rowhammer Bugmentioning

confidence: 99%

Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript

Gruss

Maurice

Mangard

2016

Lecture Notes in Computer Science

290

339

View full text Add to dashboard Cite

Abstract. A fundamental assumption in software security is that a memory location can only be modified by processes that may write to this memory location. However, a recent study has shown that parasitic effects in DRAM can change the content of a memory cell without accessing it, but by accessing other memory locations in a high frequency. This so-called Rowhammer bug occurs in most of today's memory modules and has fatal consequences for the security of all affected systems, e.g., privilege escalation attacks. All studies and attacks related to Rowhammer so far rely on the availability of a cache flush instruction in order to cause accesses to DRAM modules at a sufficiently high frequency. We overcome this limitation by defeating complex cache replacement policies. We show that caches can be forced into fast cache eviction to trigger the Rowhammer bug with only regular memory accesses. This allows to trigger the Rowhammer bug in highly restricted and even scripting environments. We demonstrate a fully automated attack that requires nothing but a website with JavaScript to trigger faults on remote hardware. Thereby we can gain unrestricted access to systems of website visitors. We show that the attack works on off-the-shelf systems. Existing countermeasures fail to protect against this new Rowhammer attack.

show abstract

“…In 2014, Kim et al [44] showed that such bit errors can be caused in a DRAM row by rapidly accessing memory locations in adjacent DRAM rows (also known as row hammering [29]). To achieve these rapid DRAM accesses, data-caching mechanisms need to be bypassed, either by flushing the cache, e.g., using clflush [44], cache eviction [1,6,24], or uncached memory accesses [58].…”

Section: A the Rowhammer Bugmentioning

confidence: 99%

Another Flip in the Wall of Rowhammer Defenses

Gruss

Lipp

Schwarz

et al. 2018

2018 IEEE Symposium on Security and Privacy (SP)

172

237

View full text Add to dashboard Cite

The Rowhammer bug allows unauthorized modification of bits in DRAM cells from unprivileged software, enabling powerful privilege-escalation attacks. Sophisticated Rowhammer countermeasures have been presented, aiming at mitigating the Rowhammer bug or its exploitation. However, the state of the art provides insufficient insight on the completeness of these defenses.In this paper, we present novel Rowhammer attack and exploitation primitives, showing that even a combination of all defenses is ineffective. Our new attack technique, one-location hammering, breaks previous assumptions on requirements for triggering the Rowhammer bug, i.e., we do not hammer multiple DRAM rows but only keep one DRAM row constantly open. Our new exploitation technique, opcode flipping, bypasses recent isolation mechanisms by flipping bits in a predictable and targeted way in userspace binaries. We replace conspicuous and memory-exhausting spraying and grooming techniques with a novel reliable technique called memory waylaying. Memory waylaying exploits system-level optimizations and a side channel to coax the operating system into placing target pages at attackerchosen physical locations. Finally, we abuse Intel SGX to hide the attack entirely from the user and the operating system, making any inspection or detection of the attack infeasible. Our Rowhammer enclave can be used for coordinated denialof-service attacks in the cloud and for privilege escalation on personal computers. We demonstrate that our attacks evade all previously proposed countermeasures for commodity systems.

show abstract

Alternate hammering test for application-specific DRAMs and an industrial case study

Cited by 17 publications

References 13 publications

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript

Another Flip in the Wall of Rowhammer Defenses

Contact Info

Product

Resources

About