RowPress: Amplifying Read Disturbance in Modern DRAM Chips

by   Haocong Luo, et al.

Memory isolation is critical for system reliability, security, and safety. Unfortunately, read disturbance can break memory isolation in modern DRAM chips. For example, RowHammer is a well-studied read-disturb phenomenon where repeatedly opening and closing (i.e., hammering) a DRAM row many times causes bitflips in physically nearby rows. This paper experimentally demonstrates and analyzes another widespread read-disturb phenomenon, RowPress, in real DDR4 DRAM chips. RowPress breaks memory isolation by keeping a DRAM row open for a long period of time, which disturbs physically nearby rows enough to cause bitflips. We show that RowPress amplifies DRAM's vulnerability to read-disturb attacks by significantly reducing the number of row activations needed to induce a bitflip by one to two orders of magnitude under realistic conditions. In extreme cases, RowPress induces bitflips in a DRAM row when an adjacent row is activated only once. Our detailed characterization of 164 real DDR4 DRAM chips shows that RowPress 1) affects chips from all three major DRAM manufacturers, 2) gets worse as DRAM technology scales down to smaller node sizes, and 3) affects a different set of DRAM cells from RowHammer and behaves differently from RowHammer as temperature and access pattern changes. We demonstrate in a real DDR4-based system with RowHammer protection that 1) a user-level program induces bitflips by leveraging RowPress while conventional RowHammer cannot do so, and 2) a memory controller that adaptively keeps the DRAM row open for a longer period of time based on access pattern can facilitate RowPress-based attacks. To prevent bitflips due to RowPress, we describe and evaluate a new methodology that adapts existing RowHammer mitigation techniques to also mitigate RowPress with low additional performance overhead. We open source all our code and data to facilitate future research on RowPress.


page 3

page 9

page 24

page 26


Retrospective: Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors

Our ISCA 2014 paper provided the first scientific and detailed character...

HiRA: Hidden Row Activation for Reducing Refresh Latency of Off-the-Shelf DRAM Chips

DRAM is the building block of modern main memory systems. DRAM cells mus...

Mitigating Wordline Crosstalk using Adaptive Trees of Counters

High access frequency of certain rows in the DRAM may cause data loss in...

Fundamentally Understanding and Solving RowHammer

We provide an overview of recent developments and future directions in t...

RowHammer: A Retrospective

This retrospective paper describes the RowHammer problem in Dynamic Rand...

Randomized Line-to-Row Mapping for Low-Overhead Rowhammer Mitigations

Modern systems mitigate Rowhammer using victim refresh, which refreshes ...

Scalable and Secure Row-Swap: Efficient and Safe Row Hammer Mitigation in Memory Systems

As Dynamic Random Access Memories (DRAM) scale, they are becoming increa...

Please sign up or login with your details

Forgot password? Click here to reset