Are We Susceptible to Rowhammer? An End-to-End Methodology for Cloud Providers

Abstract

Cloud providers are concerned that Rowhammer poses a potentially critical threat to their servers, yet today they lack a systematic way to test whether the DRAM used in their servers is vulnerable to Rowhammer attacks. This paper presents an endto-end methodology to determine if cloud servers are susceptible to these attacks. With our methodology, a cloud provider can construct worst-case testing conditions for DRAM.We apply our methodology to three classes of servers from a major cloud provider. Our findings show that none of the CPU instruction sequences used in prior work to mount Rowhammer attacks create worst-case DRAM testing conditions. To address this limitation, we develop an instruction sequence that leverages microarchitectural side-effects to "hammer" DRAM at a near-optimal rate on modern Intel Skylake and Cascade Lake platforms. We also design a DDR4 fault injector that can reverse engineer row adjacency for any DDR4 DIMM. When applied to our cloud provider's DIMMs, we find that DRAM rows do not always follow a linear map.

On DRAM Rowhammer and the Physics of Insecurity

“…3 shows the importance of the data pattern on RH. The percentage of bits that flip in a victim row is a function of the percentage of bits in that row that have a data value of 1 [8]. Similar behavior again was seen before [3], [16], [27].…”

“…The first example of this lateral shepherding of electrons using buried reflecting electric fields is in the area of latch-up assumption that there is a linear mapping between physical and logical addresses (data as in [8]). The concept of a "blast radius" becomes obvious.…”

“…With this caveat and the assumption of a linear mapping of logical to physical addresses, Fig. 2 shows the number of RH bit-flips in each row in a DDR4 DRAM as a function of the adjacency of the row to the hammered row while the system-level RH mitigation has been turned off as much as possible [8].…”

“…The confluence of DRAM ubiquity, increasing RH susceptibility, and the possibility to use this unique disturb to gain unauthorized access has created a major hardware security concern across all modern computing systems [7] from cloud servers [8] through personal computers [4], [9] to mobile phones [10].…”

“…Two connected but distinct groups of RH literature concern us here. The first contains extensive and fascinating studies at the DRAM chip level usually carried out by the large DRAM users in combination with academic institutes [3], [6], [8]. These contain experimental data on RH behavior such as 1) the minimum number of aggressor row activations to induce the first flipped bit (the "hammer count") and the related "Maximum Activation Count" (MAC) being the maximum number of row activations before any flipped bits are encountered; 2) the locality of flipped bits with respect to the hammered row; 3) the effectiveness of bit flipping when the initial states are ones or zeros; 4) the observation that newer technology DRAMs have lower MACs; and finally 5) the differences between DRAM chips from various (unnamed) vendors.…”