Abstract:RowHammer is a circuit-level DRAM vulnerability where repeatedly accessing (i.e., hammering) a DRAM row can cause bit flips in physically nearby rows. The RowHammer vulnerability worsens as DRAM cell size and cell-to-cell spacing shrink. Recent studies demonstrate that modern DRAM chips, including chips previously marketed as RowHammer-safe, are even more vulnerable to RowHammer than older chips such that the required hammer count to cause a bit flip has reduced by more than 10X in the last decade. Therefore, it is essential to develop a better understanding and in-depth insights into the RowHammer vulnerability of modern DRAM chips to more effectively secure current and future systems. Our goal in this paper is to provide insights into fundamental properties of the RowHammer vulnerability that are not yet rigorously studied by prior works, but can potentially be i) exploited to develop more effective RowHammer attacks or ii) leveraged to design more effective and efficient defense mechanisms. To this end, we present an experimental characterization using 248 DDR4 and 24 DDR3 modern DRAM chips from four major DRAM manufacturers demonstrating how the RowHammer effects vary with three fundamental properties: 1) DRAM chip temperature, 2) aggressor row active time, and 3) victim DRAM cell’s physical location. Among our 16 new observations, we highlight that a RowHammer bit flip 1) is very likely to occur in a bounded range, specific to each DRAM cell (e.g., 5.4% of the vulnerable DRAM cells exhibit errors in the range to ), 2) is more likely to occur if the aggressor row is active for longer time (e.g., RowHammer vulnerability increases by 36% if we keep a DRAM row active for 15 column accesses), and 3) is more likely to occur in certain physical regions of the DRAM module under attack (e.g., 5% of the rows are 2x more vulnerable than the remaining 95% of the rows). Our study has important practical implications on future RowHammer attacks and defenses. We describe and analyze the implications of our new findings by proposing three future RowHammer attack and five future RowHammer defense improvements.

Double-sided Row Hammer Effect in Sub-20 Nm DRAM: Physical Mechanism, Key Features and Mitigation

Understanding the Competitive Interaction in Leakage Mechanisms for Effective Row Hammer Mitigation in Sub-20 Nm DRAM

Row hammer-induced D0 failure improvement in sub-20 nm DRAM using air gap

Unveiling RowPress in Sub-20 nm DRAM Through Comparative Analysis With Row Hammer: From Leakage Mechanisms to Key Features

Understanding the Physical Mechanism of RowPress at the Device-Level in Sub-20 Nm DRAM

Design Guideline of Saddle-Fin-Based DRAM for Mitigating Rowhammer Effect

An Experimental Characterization of Combined RowHammer and RowPress Read Disturbance in Modern DRAM Chips

Design Technology Co-Optimization for the DRAM Cell Structure With Contact Resistance Variation

The Optimization of Spacer Engineering for Capacitor-Less DRAM Based on the Dual-Gate Tunneling Transistor

Rowhammer Vulnerability of DRAMs in 3-D Integration

RowHammer: Reliability Analysis and Security Implications

An Experimental Analysis of RowHammer in HBM2 DRAM Chips

On the Understanding and Modeling of Non-Negligible Subthreshold-State Degradation (SSD) in Sub-20-nm DRAM Technology

A Deeper Look into RowHammer’s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

DRAM-Profiler: An Experimental DRAM RowHammer Vulnerability Profiling Mechanism

Improving 3D DRAM Fault Tolerance Through Weak Cell Aware Error Correction.

Mithril: Cooperative Row Hammer Protection on Commodity DRAM Leveraging Managed Refresh

Programming Strategy Optimization of RRAM Fabricated by 28 nm Standard CMOS Process

Mitigating WL-to-WL Disturbance in Dynamic Random-Access Memory (DRAM) through Adopted Spherical Shallow Trench Isolation with Silicon Nitride Layer in the Buried Channel Array Transistor (BCAT)

On the Use of Dram with Unrepaired Weak Cells in Computing Systems

X-ray: Discovering DRAM Internal Structure and Error Characteristics by Issuing Memory Commands