A Deeper Look into RowHammer`s Sensitivities: Experimental Analysis of Real DRAM Chips and Implications on Future Attacks and Defenses

1 Introduction

• The study characterizes 248 DDR4 and 24 DDR3 chips from four manufacturers to examine these three properties, then describes three attack and six defense improvements.The experiments use double-sided RowHammer and a temperature-controlled environment with error of at most ±0.1 °C.Source: §1 · p. 2
• Each vulnerable cell flips only within a bounded temperature range, while longer aggressor active time and a small fraction of rows are associated with greater RowHammer vulnerability.In tested chips, the temperature range spans 5–40 °C; a 5× longer active time corresponds to 6.9× more cells flipping at a given hammer count and a 36% lower HCfirst on average, while 5%/1% of rows have 2.0×/1.6× lower HCfirst.Source: §1 · p. 2
• Temperature analysis finds that bit-error-rate trends differ by manufacturer, while RowHammer vulnerability measured by HCfirst tends to worsen as temperature rises.A vulnerable cell’s bit flips occur within a bounded temperature range, which can be as narrow as 5 °C or as wide as 40 °C.Source: §1 · p. 2
• Longer time between aggressor-row activation and precharge makes DRAM cells more vulnerable at a fixed hammer count.The experiment varies activation-to-precharge time from 34.5 ns to 154.5 ns in 30 ns steps.Source: §1 · p. 2
• Only a small fraction of DRAM rows have substantially lower HCfirst values than the remaining rows.Across four manufacturers, 5%/1% of rows have 2.0×/1.6× lower HCfirst values than the other 95%/99%.Source: §1 · p. 2

2.1 DRAM Organization

• A DRAM module contains ranks of chips, and each chip contains banks; banks contain rows and columns partitioned into subarrays with local row buffers.Channels connect the memory controller to modules, and ranks on a channel share its I/O bus.Source: §2.1 · pp. 2–3

2.2 DRAM Access Timings

• DRAM access activates a row, performs column reads or writes, and then precharges the bank to close the row.The controller must observe standardized timing intervals; tRAS allows charge restoration and tRP allows bitlines to precharge.Source: §2.2 · p. 3

2.3 The RowHammer Vulnerability

• RowHammer occurs when an aggressor row is repeatedly activated before neighboring victim rows are refreshed, causing bit flips in nearby rows.Smaller, more closely spaced cells exacerbate vulnerability as DRAM storage density increases.Source: §2.3 · p. 3
• Prior work attributes bit flips to capacitive coupling and trap-assisted leakage, while defenses such as TRR and RFM aim to prevent them; vulnerability remains.RFM has the memory controller count bank activations and issue a command at a threshold, giving on-die defenses time to refresh victim rows.Source: §2.3 · p. 3

Motivation

• Recent studies find modern chips, including chips marketed as RowHammer-free, flip at lower hammer counts than older chips, while many defenses can impose substantial performance, energy, or hardware costs.Examples include 9.6K activations for LPDDR4 with TRR disabled and 25K for DDR4 with TRR enabled, compared with 139K for 2014 DDR3 chips.Source: §3 · p. 3
• The literature lacks rigorous experimental observations of how RowHammer varies with chip temperature, aggressor-row active time, and victim-cell physical location.The authors identify understanding these sensitivities as relevant to improving attacks and defenses.Source: §3 · pp. 3–4

Goal

• The authors characterize 248 DDR4 and 24 DDR3 chips from four manufacturers to study how vulnerability changes across those three properties.They frame the work as informing future research on attack and defense effectiveness.Source: §3 · p. 4

4.1 Testing Infrastructure

• SoftMC FPGA setups control DRAM timings and coordinate host-driven tests with heater pads and a temperature controller.The setup measures temperature with at most ±0.1 °C error.Source: §4.1 · p. 4, Figure 2 · p. 4

4.2 Testing Methodology

• Tests disable DRAM self-regulation and known on-die RowHammer defenses, avoid retention errors, and use SoftMC for precise command control.The tested modules do not implement ECC, preventing ECC from altering observed bit flips.Source: §4.2 · p. 4
• Double-sided hammering alternates activations of the two physically adjacent aggressor rows, with up to 512K hammers for HCfirst tests and 150K for BER tests.One hammer is a pair of activations, one to each aggressor row.Source: §4.2 · p. 4

4.3 Characterized DRAM Chips

• Experiments cover 248 DDR4 and 24 DDR3 chips from four manufacturers, spanning different densities, die revisions, and chip organizations.The study uses SoftMC-based infrastructure for both memory generations.Source: §4.1 · p. 4, §4.3 · p. 5

5.1 Impact of Temperature on DRAM Cells

• A DRAM cell flips with very high probability within a continuous, cell-specific vulnerable temperature range; 9.6%–29.8% of cells across four manufacturers were vulnerable throughout 50–90 °C.For manufacturers A, B, C, and D, respectively, 2.3%, 1.8%, 2.4%, and 1.6% of all tested cells experienced a RowHammer bit flip within a range as narrow as 5 °C.Source: §5.1 · pp. 5–6

5.2 Impact of Temperature on DRAM Rows

• Larger temperature changes produce larger HCfirst changes; the cumulative magnitude change from 50 °C to 90 °C is 4.2×, 3.9×, 3.8×, and 4.3× larger than from 50 °C to 55 °C for manufacturers A, B, C, and D.The dominant trend is for HCfirst to decrease as the temperature delta grows, though individual rows can differ.Source: §5.2 · pp. 6–7
• RowHammer vulnerability in DRAM rows generally worsens as temperature increases, although individual rows can show higher or lower HCfirst and BER responses.BER increases with temperature for manufacturers A, C, and D, but decreases for manufacturer B; HCfirst changes differ by row.Source: §5.2 · pp. 6–7

5.3 Circuit-level Justification

• Experiments with 272 DRAM chips show that temperature inflection points for RowHammer vulnerability are diverse across DRAM cells and chips.The authors hypothesize this diversity reflects nonmonotonic charge-trapping behavior.Source: §5.3 · p. 7

6 Aggressor Row Active Time Analysis

• The study varies aggressor on- and off-times around baseline timings and tests the first, middle, and last 1K bank rows in DDR4 chips at 50 °C.Prior work had suggested an active-time effect from preliminary data on only one selected row per manufacturer; this study examines a larger population of rows.Source: §6 · p. 7

6.1 Impact of Aggressor Row’s On-Time

• Increasing aggressor on-time from 34.5 ns to 154.5 ns raises BER by 10.2×, 3.1×, 4.4×, and 9.6× and lowers HCfirst by 40.0%, 28.3%, 32.7%, and 37.3% for manufacturers A–D, respectively.The authors report that vulnerability worsens consistently across all four manufacturers.Source: §6.1 · p. 7

6.2 Impact of Aggressor Row’s Off-Time

• Increasing aggressor off-time from 16.5 ns to 40.5 ns lowers BER by 6.3×, 2.9×, 4.9×, and 5.0× and raises HCfirst by 33.8%, 24.7%, 50.1%, and 33.7% for manufacturers A–D, respectively.Vulnerability consistently reduces across chips from all four manufacturers as off-time increases.Source: §6.2 · p. 8

6.3 Circuit-level Justification

• The authors hypothesize that longer on-time worsens vulnerability because increased electron injection outweighs reduced cross-talk from fewer activations, while longer off-time reduces cross-talk without changing electron injection.They leave detailed device-level analysis and explanation for future work.Source: §6.3 · pp. 8–9

7 Spatial Variation Analysis

• The study presents its row, column, and subarray findings as the first rigorous spatial variation analysis of RowHammer across these locations.Experiments in this section were conducted at 75 °C.Source: §7 · p. 9

7.1 Variation Across DRAM Rows

• For 5% of rows, average HCfirst is 2.0× lower than for the remaining 95%, and for 1% it is 1.6× lower than for the remaining 99%.Across all four manufacturers, 99%, 95%, and 90% of tested rows have HCfirst at least 1.6×, 2.0×, and 2.2× greater than the most vulnerable row, respectively.Source: §7.1 · p. 9

7.2 Variation Across Columns

• All chips show substantial BER variation across columns: maximum-to-minimum column bit-flip counts differ by more than 100, and some columns have no flips in modules from manufacturers A, C, and D.The authors attribute column variation to both design-induced and manufacturing-process-induced factors; for example, 50.9% of vulnerable columns for manufacturer B have CV=0 across chips.Source: §7.2 · pp. 9–10

7.4 Circuit-level Justification

• The analysis assumes subarrays contain 512 rows because their boundaries are not publicly available.The authors hypothesize that manufacturing-process variation and design-dependent physical location contribute to the observed row, column, and chip differences, and that similar access-latency characteristics underlie within-chip subarray similarity; these hypotheses need further validation.Source: §7.3 · p. 10, §7.4 · p. 11

7.3 Variation Across Subarrays

• The most vulnerable row in a subarray has a lower HCfirst than other rows; average HCfirst is about 2× the subarray minimum, and manufacturer C’s minimum can be estimated with a linear model (R2=0.93).HCfirst distributions are more similar between subarrays in the same module than between modules; for manufacturer C, normalized Bhattacharyya distance at the 5th percentile is 0.975 within-module versus 0.66 across modules.Source: §7.3 · pp. 10–11

8.1 Potential Attack Improvements

• Temperature-aware attacks could place sensitive data in cells vulnerable at the current temperature or heat or cool the chip to increase bit-flip likelihood and reduce the required hammer count.The paper also proposes using cells with narrow vulnerable temperature ranges as triggers for a separate attack when a target temperature is reached.Source: §8.1 · pp. 11–12
• Issuing 10 to 15 READ commands per aggressor activation can increase on-time about 5×, raising BER by 3.2×–10.2× or causing flips at a hammer count 36% below a defense’s configured HCfirst.The paper proposes this as a way to strengthen attacks that exploit the active-time finding.Source: §8.1 · p. 12

8.2 Potential Defense Improvements

• Row-specific HCfirst settings could use the worst-case value for 5% of rows and 2× HCfirst for the remaining 95%, reducing estimated BlockHammer and Graphene area costs by 33% and 80%, respectively.The paper also proposes using lower PARA probability thresholds for less vulnerable rows; it leaves comprehensive evaluation of these improvements to future work.Source: §8.2 · p. 12
• Profiling eight randomly chosen subarrays in a 128-subarray bank could reduce characterization time by at least an order of magnitude while providing approximate profiling data for the chip.The authors also propose using subarray averages and linear regression to estimate worst-case HCfirst values for less critical systems.Source: §8.2 · p. 12
• Other proposed defenses include retiring rows vulnerable at particular temperatures, improving cooling, and limiting row active times through memory-controller scheduling or row-buffer policies.The authors note that lightweight on-die defenses cannot feasibly track active times for all potential aggressor rows because of the required storage and logic.Source: §8.2 · p. 12
• ECC could be optimized for non-uniform bit-error probabilities across columns, and chipkill ECC could be modified to reduce dependence on the most vulnerable DRAM chip.Source: §8.2 · p. 13

• Prior work is grouped into attacks, defenses, real-chip characterization, and circuit-level simulation, with two surveys [99] [101] overviewing the literature.Source: §9 · p. 13
• Existing RowHammer attacks and defenses do not account for temperature, aggressor-row active time, or spatial variation, and improved attacks and defenses are left to future work.Source: §9 · p. 13
• Prior real-chip characterizations examine other aspects of RowHammer but omit these three sensitivities, which this work analyzes.Source: §9 · p. 13
• Earlier experimental models used only three or five DDR3 chips and lacked system-level analysis, unlike this study’s 272-chip characterization.Source: §9 · p. 13
• Circuit-level simulation studies examine capacitative-coupling and charge-trapping mechanisms without testing real DRAM chips, making them orthogonal to this study.Source: §9 · p. 13

• The study characterizes 248 DDR4 and 24 DDR3 chips from four manufacturers, reporting 16 observations and six key takeaways on RowHammer behavior.Source: §10 · p. 13
• Each vulnerable DRAM cell exhibits RowHammer bit flips within a bounded temperature range.Source: §10 · p. 13
• A DRAM row is more vulnerable when its aggressor row stays active longer, and a small fraction of rows are significantly more vulnerable than others in the module.Source: §10 · p. 13
• The authors describe how the characterization insights can be used to improve RowHammer attacks and defenses.Source: §10 · p. 13

• Table 4 presents characteristics of the tested DDR4 and DDR3 DRAM modules.Source: A Appendix · p. 17, Table 4 · p. 17
• Module dates are used because chip date information is unavailable.Source: A Appendix · p. 17
• Manufacturer and die-revision information is inferred from remaining chip-identifier text for some modules and extracted from SPD registers for others.Source: A Appendix · p. 17