Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors

By Yoongu Kim, Ross Daly, Jeremie S. Kim, Chris Fallin, Ji-Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, Onur Mutlu. International Symposium on Computer Architecture, 2014

712 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Electrical and Electronic Engineering

View Paper: https://www.semanticscholar.org/paper/d70cb46884e4643372bb5edb5f122811d5196b13

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Electrical and Electronic Engineering

Citations in the corpus

TRRespass: Exploiting the Many Sides of Target Row Refresh (2020, methodology): “While there has been systematic research on the vulnerability on DDR3 systems [51], [88], relatively little is known about the extent of RowHammer on recent DDR4 systems.”
Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, neutral): “The supply voltage has been gradually reduced, resulting in smaller charges in the actual capacitors storing the single bits—this led to the well-known Rowhammer [41] effect.”
RowHammer: A Retrospective (2019, methodology): “In our ISCA 2014 paper [132], we introduce the RowHammer problem in DRAM, which is a prime (and perhaps the first) example of how a circuit-level failure mechanism can cause a practical and widespread system security vulnerability.”
Retrospective: Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors (2023, neutral): “We ran Code 1a within a customized Memtest86 + environment [1] to bypass address translation. using many di ﬀ erent address-pairs until every row in the 2GB module was opened / closed millions of times.”
Drammer: Deterministic Rowhammer Attacks on Mobile Platforms (2016, methodology): “Probabilistic Adjacent Row Activation (PARA) [23] refreshes neighboring rows on each activation with a low probability (and thus very likely during repeated activations in a Rowhammer attack), but requires modiﬁcations of the memory controller to do so.”
Intel SGX Explained (2016, background): “The rowhammer DRAM bit-flipping attack [72, 119, 166] is an example of a different class of software attacks that exploit design defects in the computer’s hardware.”
Error Characterization, Mitigation, and Recovery in Flash-Memory-Based Solid-State Drives (2017, neutral): “As DRAM scales to smaller technology nodes, its error rate continues to increase [94, 123, 135, 136, 139] and effects like read disturb [94], cell-to-cell interference [80–83, 112, 154], and variable retention time [80, 112, 154, 158] become more severe [94, 135, 136, 139].”
SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, methodology): “, launching a denial-of-service (DoS) attack) by intentionally triggering the defense mechanism of the MEE of SGX for physical attacks on memory integrity, through a software attack that utilizes the Rowhammer attack [21].”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, neutral): “Rowhammer is not a typical cache attack but a DRAM vulnerability that causes random bit flips by repeatedly accessing a DRAM row [20].”
Processing Data Where It Makes Sense: Enabling In-Memory Computation (2019, methodology): “If the memory controller is designed to be more intelligent and more programmable, it can, for example, incorporate flexible mechanisms to overcome various types of reliability issues (including RowHammer), manage latencies and power consumption better based on a deep understanding of the DRAM and a”
Another Flip in the Wall of Rowhammer Defenses (2017, methodology): “, using clflush [44], cache eviction [1, 6, 24], or uncached”
DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks (2015, methodology): “As data needs to be served from DRAM and not the cache, an attack needs to either flush data from the cache using the clflush instruction in native environments [13], or using cache eviction in other more restrictive environments, e.”
Sanctum: Minimal Hardware Extensions for Strong Software Isolation (2016, neutral): “We assume correct underlying hardware, so we do not protect against software attacks that exploit hardware bugs (fault-injection attacks), such as rowhammer [28, 47].”
Memory Errors in Modern Systems: The Good, The Bad, and The Ugly (2015, neutral): “The pattern of errors from this fault appears to be similar to a fault mode called DRAM disturbance faults or “rowhammer” faults [19] [26].”
Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript (2015, methodology): “[20] and Seaborn’s [36] root exploit made the scientific community aware of the security implications of a Rowhammer attack.”
Spectre Attacks: Exploiting Speculative Execution (2018, methodology): “Softwarebased techniques have also been used to mount fault attacks that alter physical memory [22] or internal CPU values [34].”