Statistical distributions of row-hammering induced failures in DDR3 components

Park, Kyung Bae; Yun, Donghyuk; Baeg, Sanghyeon

doi:10.1016/j.microrel.2016.10.014

Cited by 26 publications

(34 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since the RowHammer failure is mainly caused by the traps in the interface (according to the authors' hypotheses), the authors show that this technique can help to improve DRAM reliability against crosstalk and thus alleviate RowHammer attacks. [192] and [193] experimentally test DDR3 devices for RowHammer susceptibility, show statistical distributions of RowHammer failures across many devices, and present evidence that the root cause of the RowHammer phenomenon is charge recombination of the victim cell with electrons from the current channels between neighboring cells and their corresponding bitlines.…”

Section: Circuit-level Studies Of Rowhammermentioning

confidence: 92%

RowHammer: A Retrospective

Mutlu

Kim

2020

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

161

129

View full text Add to dashboard Cite

This retrospective paper describes the RowHammer problem in Dynamic Random Access Memory (DRAM), which was initially introduced by Kim et al. at the ISCA 2014 conference [133]. RowHammer is a prime (and perhaps the first) example of how a circuit-level failure mechanism can cause a practical and widespread system security vulnerability. It is the phenomenon that repeatedly accessing a row in a modern DRAM chip causes bit flips in physically-adjacent rows at consistently predictable bit locations. RowHammer is caused by a hardware failure mechanism called DRAM disturbance errors, which is a manifestation of circuit-level cell-to-cell interference in a scaled memory technology.Researchers from Google Project Zero demonstrated in 2015 that this hardware failure mechanism can be effectively exploited by user-level programs to gain kernel privileges on real systems. Many other follow-up works demonstrated other practical attacks exploiting RowHammer. In this article, we comprehensively survey the scientific literature on RowHammer-based attacks as well as mitigation techniques to prevent RowHammer. We also discuss what other related vulnerabilities may be lurking in DRAM and other types of memories, e.g., NAND flash memory or Phase Change Memory, that can potentially threaten the foundations of secure systems, as the memory technologies scale to higher densities. We conclude by describing and advocating a principled approach to memory reliability and security research that can enable us to better anticipate and prevent such vulnerabilities.

show abstract

Section: Circuit-level Studies Of Rowhammermentioning

confidence: 92%

RowHammer: A Retrospective

Mutlu

Kim

2020

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

161

129

View full text Add to dashboard Cite

show abstract

“…The simplifying assumption used in (5) and (6) as was used by Sakurai [14] is that the source resistance of the circuit driving the wordlines is negligible compared to the line resistance. This seems reasonable in the case of a DRAM wordline where the tungsten gate will probably result in tens of ohms per cell.…”

Section: Capacitive Crosstalkmentioning

confidence: 99%

On DRAM Rowhammer and the Physics of Insecurity

Walker¹,

Lee

Beery³

2021

IEEE Trans. Electron Devices

View full text Add to dashboard Cite

The dynamic random access memory (DRAM) disturb known as rowhammer (RH) has come to dominate the insecurity of computing systems worldwide. Several studies have concentrated on electron injection from a switching cell select transistor and capture by nearby storage node junctions as being the main mechanism for the effect. This article for the first time looks in-depth at RH from the point of view of both electron injection and capture, and capacitive crosstalk. The absence of such comprehensive studies at the silicon level in the literature can be attributed to its sensitive nature within the industry and highlights the difficulty of DRAM scaling. This review article, therefore, forms a broad foundation to extend understanding of this dangerous disturb mechanism and in so doing provides an informed view on the ability of future DRAM technologies to solve RH once and for all. Index Terms-Crosstalk, dynamic random access memory (DRAM), electron injection, rowhammer (RH). I. INTRODUCTION T HE story of dynamic random access memory (DRAM) is that of the semiconductor industry itself [1], [2]. Fifty years of scaling a field-effect transistor and a capacitor has resulted in DRAM as the "main memory" in all compute systems from cloud servers through laptops to mobile phones. This success makes such systems prone to any security weakness that may lurk within DRAM itself. The DRAM disturb known as rowhammer (RH) has been causing increasing concern since its public unmasking in [3]. It is characterized by corrupted data in cells close to a row that is turned on and off many times between data refresh. Although the actual problem seems to have been known since 2010, and most probably before that within DRAM Research and Development, with some patent applications in 2012, RH was propelled to the forefront of hardware security issues when it was used to gain computer kernel privileges [4]. After ten years from the first inkling of a problem, the RH disturb varies widely between Manuscript

show abstract

“…Scienti c Error-Characterization Studies. Scienti c errorcharacterization studies explore physical DRAM error mechanisms (e.g., data retention [42, 43, 46, 74, 75, 78-81, 109, 139, 157, 172, 173], reduced access-latency [16, 17, 20, 37, 83-85, 102, 104], circuit disturbance [35,79,81,86,90,135,136]) by deliberately exacerbating the error mechanism and analyzing the resulting errors' statistical properties (e.g., frequency, spatial distribution). ese studies help build error models [20,31,43,83,94,104,157,178], leading to new DRAM designs and operating points that improve upon the state-of-the-art.…”

Section: Secrecy Concerning On-die Eccmentioning

confidence: 99%

“…Deliberately inducing DRAM errors (e.g., by violating default timing parameters) reveals detailed information about a DRAM chip's internal design through the resulting errors' statistical characteristics. Prior works use custom memory testing platforms (e.g., FPGA-based [46]) and commodity CPUs [6,57] (e.g., by changing CPU con guration registers via the BIOS [56]) to study a variety of DRAM error mechanisms, including data-retention [26,90,95,109,110,138,139], circuit timing violations [17, 83-85, 102, 104], and RowHammer [86,90,125,126,135,136]. Our work focuses on dataretention errors because they exhibit well-studied properties that are helpful for our purposes: 1.…”

Section: Studying Dram Errorsmentioning

confidence: 99%

See 1 more Smart Citation

Bit-Exact ECC Recovery (BEER): Determining DRAM On-Die ECC Functions by Exploiting DRAM Data Retention Characteristics

Patel¹,

Kim²,

Shahroodi³

et al. 2020

Preprint

View full text Add to dashboard Cite

Increasing single-cell DRAM error rates have pushed DRAM manufacturers to adopt on-die error-correction coding (ECC), which operates entirely within a DRAM chip to improve factory yield. e on-die ECC function and its e ects on DRAM reliability are considered trade secrets, so only the manufacturer knows precisely how on-die ECC alters the externally-visible reliability characteristics. Consequently, on-die ECC obstructs third-party DRAM customers (e.g., test engineers, experimental researchers), who typically design, test, and validate systems based on these characteristics.To give third parties insight into precisely how on-die ECC transforms DRAM error pa erns during error correction, we introduce Bit-Exact ECC Recovery (BEER), a new methodology for determining the full DRAM on-die ECC function (i.e., its parity-check matrix) without hardware tools, prerequisite knowledge about the DRAM chip or on-die ECC mechanism, or access to ECC metadata (e.g., error syndromes, parity information). BEER exploits the key insight that non-intrusively inducing data-retention errors with carefully-cra ed test patterns reveals behavior that is unique to a speci c ECC function.We use BEER to identify the ECC functions of 80 real LPDDR4 DRAM chips with on-die ECC from three major DRAM manufacturers. We evaluate BEER's correctness in simulation and performance on a real system to show that BEER is e ective and practical across a wide range of on-die ECC functions. To demonstrate BEER's value, we propose and discuss several ways that third parties can use BEER to improve their design and testing practices. As a concrete example, we introduce and evaluate BEEP, the rst error pro ling methodology that uses the known on-die ECC function to recover the number and bit-exact locations of unobservable raw bit errors responsible for observable post-correction errors.

show abstract

Statistical distributions of row-hammering induced failures in DDR3 components

Cited by 26 publications

References 1 publication

RowHammer: A Retrospective

RowHammer: A Retrospective

On DRAM Rowhammer and the Physics of Insecurity

Bit-Exact ECC Recovery (BEER): Determining DRAM On-Die ECC Functions by Exploiting DRAM Data Retention Characteristics

Contact Info

Product

Resources

About