Source-linked AI summary
The RowHammer Problem and Other Issues We May Face as Memory Becomes Denser
Onur Mutlu
TL;DR
As memory scaling reduces cell size and charge margins, failure mechanisms can threaten reliability and expose security vulnerabilities. The paper analyzes RowHammer, its exploitation, and solutions, while surveying risks in other memories and advocating principled reliability-security research. It shows that RowHammer is a practical, widespread security vulnerability and that future memory vulnerabilities warrant systematic prevention.
Problem
Memory scaling creates new failure mechanisms that can threaten correct operation and enable attacks, but their security implications require analysis across DRAM and other dense memories.
Method
The paper analyzes RowHammer’s DRAM behavior and security exploitation, examines countermeasures and potential vulnerabilities in other memories, and advocates system-memory co-design.
Results
RowHammer repeatedly accessing one DRAM row flips bits in adjacent rows and can breach memory protection, while other memory technologies may contain similarly threatening vulnerabilities.
Takeaways & Limitations
Reliability and security research should anticipate, model, mitigate, and prevent memory vulnerabilities as technology scaling increases density.
Abstract
from arXiv · showhide
As memory scales down to smaller technology nodes, new failure mechanisms emerge that threaten its correct operation. If such failure mechanisms are not anticipated and corrected, they can not only degrade system reliability and availability but also, perhaps even more importantly, open up security vulnerabilities: a malicious attacker can exploit the exposed failure mechanism to take over the entire system. As such, new failure mechanisms in memory can become practical and significant threats to system security. In this work, we discuss the RowHammer problem in DRAM, which is a prime (and perhaps the first) example of how a circuit-level failure mechanism in DRAM can cause a practical and widespread system security vulnerability. RowHammer, as it is popularly referred to, is the phenomenon that repeatedly accessing a row in a modern DRAM chip causes bit flips in physically-adjacent rows at consistently predictable bit locations. It is caused by a hardware failure mechanism called DRAM disturbance errors, which is a manifestation of circuit-level cell-to-cell interference in a scaled memory technology. We analyze the root causes of the RowHammer problem and examine various solutions. We also discuss what other vulnerabilities may be lurking in DRAM and other types of memories, e.g., NAND flash memory or Phase Change Memory, that can potentially threaten the foundations of secure systems, as the memory technologies scale to higher densities. We conclude by describing and advocating a principled approach to memory reliability and security research that can enable us to better anticipate and prevent such vulnerabilities.
I. INTRODUCTION
Technology scaling increases memory density and lowers cost, but smaller cells and lower charge margins reduce reliability. The paper examines how these failures can become system-security vulnerabilities, using RowHammer as a prime example and discussing broader memory risks and prevention.
- Scaling memory technologies increases density and lowers cost while making smaller, lower-charge cells more vulnerable to failures, noise, and interference.
- Unanticipated memory failure mechanisms can degrade reliability and availability while exposing security vulnerabilities that attackers may exploit to take over systems.
- The paper analyzes RowHammer in DRAM as a prime example of a circuit-level failure mechanism causing a practical and widespread security vulnerability.
- It also examines potential vulnerabilities in DRAM, NAND flash, and Phase Change Memory, then advocates principled research to anticipate and prevent them.
II. THE ROWHAMMER PROBLEM
RowHammer is a disturbance failure in commodity DRAM: repeatedly activating and precharging one row can flip bits in physically adjacent rows. The paper investigated this behavior across 129 modules using FPGA-based testing.
- RowHammer violates memory isolation because repeatedly opening and closing a DRAM row within one refresh interval can flip bits in adjacent rows.The affected bits are in physically adjacent rows rather than the repeatedly accessed row.
- The authors used an FPGA-based DRAM testing infrastructure to test 129 modules from three major manufacturers.
- The testing infrastructure was originally developed to study DRAM retention-time issues and later enabled broader studies of modern DRAM behavior.
- Figure 1 relates RowHammer error rate to manufacturing dates for the 129 tested DRAM modules.
A. User-Level RowHammer
A simple user-level program can reliably induce RowHammer errors on vulnerable commodity systems. These errors corrupt other programs’ pages, breach memory protection, and support attacks across multiple system settings.
- A simple user-level program reliably induced RowHammer errors on vulnerable DRAM modules in three commodity AMD and Intel systems.
- RowHammer breaks both read and write isolation: reads may modify other addresses, while writes can alter data outside their intended address.
- Because DRAM rows map to software pages, attackers can use induced bit flips to corrupt pages belonging to other programs and breach memory protection.
- Demonstrated attacks include kernel-privilege escalation, remote server takeover through JavaScript, virtual-machine attacks, mobile-device compromise, and browser read/write access.
- The paper focuses here on security vulnerabilities and prevention, referring readers elsewhere for detailed RowHammer characteristics and circuit-level causes.
C. Solutions to RowHammer
Immediate RowHammer mitigations are constrained by deployed-system mechanisms and can impose costs, while long-term alternatives have substantial overheads or implementation challenges. PARA offers a low-cost probabilistic approach, motivating closer system-memory co-design.
- C. Solutions to RowHammer: Immediate solutions target existing fielded systems, whereas long-term solutions aim to prevent RowHammer in future DRAM devices.
- C. Solutions to RowHammer: Increasing refresh rates reduces vulnerability but raises energy and power use, lowers performance, and degrades quality of service.
- C. Solutions to RowHammer: A 7X refresh-rate increase was required to eliminate all RowHammer-induced errors observed in the 129 tested DRAM modules.
- C. Solutions to RowHammer: Software detection and selective victim-row refreshing can be intrusive because they require system-software modifications.
- C. Solutions to RowHammer: Proposed long-term countermeasures include better DRAM, ECC, refresh, remapping or retiring vulnerable cells, and runtime hammered-row identification.
- C. Solutions to RowHammer: SECDED ECC cannot correct cache blocks with two or more bit flips, while stronger ECC and access tracking add energy, performance, area, cost, or capacity overheads.
- C. Solutions to RowHammer: PARA probabilistically refreshes adjacent rows when a row closes, eliminating the vulnerability with no storage cost and negligible performance and energy overheads.
- C. Solutions to RowHammer: PARA implementation requires controller or DRAM changes, illustrating why system-memory co-design can improve vulnerability discovery, mitigation, and prevention.
D. Putting RowHammer into Context
Disturbance errors are a broad reliability problem across scaled memory technologies, driven by cell-to-cell interference as cells become more densely packed. DRAM is especially exposed because error-correction mechanisms are not commonly employed.
- Disturbance errors occur across DRAM, SRAM, flash, and hard disk drives as memory technologies scale to higher densities.Although the bit-flip mechanisms differ, the high-level root cause is cell-to-cell interference caused by closely spaced memory cells.
- Cell-to-cell interference is a fundamental scaling issue expected to persist in future memory technologies.The paper argues that sufficiently small technology nodes make such problems likely in both current and emerging memories.
- Modern DRAM is particularly vulnerable because error-correction mechanisms are not commonly employed in the memory controller or chip.DRAM scaling has instead relied mainly on periodic refresh and an implicit assumption that the chips are error-free.
III. OTHER POTENTIAL VULNERABILITIES
As DRAM and NAND flash become less reliable with increasing density, other memory vulnerabilities may threaten secure systems. The paper briefly examines two examples and identifies further investigation as an opportunity for improving both security and scaling.
- DRAM and NAND flash are becoming less reliable according to large-scale field studies and detailed experimental analyses.
- The paper briefly examines two potential vulnerabilities in memory technologies.It presents these examples as targets for future work on fixing vulnerabilities and enabling effective memory scaling.
- Future research on these and other vulnerabilities could address security weaknesses while supporting continued memory technology scaling.
A. Data Retention Failures
Data retention is a fundamental reliability problem and potential security vulnerability in charge-based memories. Scaling makes retention harder through more cells, smaller charge-storage units, and narrower voltage margins.
- Data retention failures arise because charge leaks from storage units such as DRAM capacitors and NAND flash floating gates over time.
- Three scaling trends worsen retention: more cells require more refreshes, storage units become smaller or structurally altered, and voltage margins shrink.
- DRAM retention-time determination and refresh-rate selection are becoming significantly more difficult.Data Pattern Dependence makes retention depend on stored and neighboring data, while Variable Retention Time causes drastic changes through a memoryless random process.
- Data Pattern Dependence and Variable Retention Time complicate accurate determination of the minimum DRAM retention time.
1) DRAM Data Retention Issues:
Retention failures matter for both DRAM and flash memory, but the supported discussion emphasizes different practical concerns: preserving security while improving performance and energy efficiency, and extending flash lifetime through refresh.
- Retention failures in DRAM are likely to receive substantial investigation because they affect performance and energy efficiency.
- Solutions for DRAM retention failures should be checked to ensure they do not introduce new vulnerabilities such as side channels.
- Data retention errors are the dominant source of errors in modern flash memory, and wearout progressively degrades charge retention.
- Adaptive refresh greatly improves the lifetime of modern MLC NAND flash memory with little energy and performance overhead.
2) NAND Flash Data Retention Issues:
Scaling NAND flash to smaller nodes and more bits per cell intensifies data-retention challenges while exposing recovery and security vulnerabilities. Cell-level variation can improve recovery from uncorrectable errors, but the same properties may enable data recovery or corruption attacks.
- Smaller nodes and more bits per cell make data retention a bigger problem in flash memory.
- Variation in cell leakiness enables probabilistic recovery of original values after an uncorrectable error.The mechanism identifies fast-leaking and slow-leaking cells before estimating their prior values.
- Retention Failure Recovery significantly reduces bit error rate in modern MLC NAND flash memory.
- Analyzing failed-device data and cell properties may recover original data, creating a potential security and privacy vulnerability.
- Two-step MLC programming exposes intermediate values to cell-to-cell interference and read disturbance before final programming completes.These vulnerabilities can alter partially programmed data on existing SSDs, causing malicious data corruption.
IV. PREVENTION
Preventing memory reliability failures from becoming security vulnerabilities requires coordinated modeling, architecture, design, automation, and testing. The paper advocates using experimental data and configurable system mechanisms to anticipate, tolerate, and correct failures.
- IV. PREVENTION: Reliability problems that are not anticipated, accounted for, and corrected may surface as security problems.
- IV. PREVENTION: Principled prevention begins with failure modeling and prediction based on experimental data from individual devices and field operation.Small- and large-scale measurements can enable accurate failure models for multiple purposes.
- IV. PREVENTION: System and memory should be co-architected so intelligent, flexible, and configurable memory controllers can avoid, tolerate, or prevent failure mechanisms.
- IV. PREVENTION: Electronic design, automation, and testing should provide high, predictable failure coverage and work with architectural and across-stack mechanisms.
V. CONCLUSION
As memory scales toward higher densities, declining reliability can expose serious security vulnerabilities that are difficult to defend against once discovered in the field. The paper therefore calls for principled approaches spanning failure analysis and system-level prevention.
- V. CONCLUSION: Memory reliability is reducing as technologies scale to smaller nodes for higher density.
- V. CONCLUSION: Unanticipated and uncorrected reliability problems can open serious security vulnerabilities that are difficult to defend against in the field.
- V. CONCLUSION: RowHammer exemplifies a hardware failure mechanism that causes a practical and widespread system security vulnerability.
- V. CONCLUSION: Future prevention requires principled methods for understanding, modeling, and predicting failures, alongside architectural, design, automation, and testing methods.