Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

RowPress Vulnerability in Modern DRAM Chips

Haocong Luo, Ataberk Olgun, A. Giray Yağlıkçı, Yahya Can Tuğrul, Steve Rhyner, Meryem Banu Cavlak, Joël Lindegger, Mohammad Sadrosadati, Onur Mutlu

TL;DR

RowPress identifies a new DRAM read-disturb mechanism caused by long aggressor-row open times ($t_{\text{AggON}}$) that can flip bits without thousands of activations, distinct from RowHammer. The authors perform large-scale real-device characterization across $164$ DDR4 chips, demonstrate a proof-of-concept RowPress attack on a system with RowHammer protections, and propose a mitigation framework that adapts RowHammer defenses to RowPress. Key findings show RowPress is widespread, temperature-sensitive, and largely operates via a different failure mechanism than RowHammer, with potential to be triggered by a single aggressor activation under long open times. The work has practical industry impact by prompting updates to mitigation strategies, memory-controller policies, and standards, and it provides open-source tools to enable replication and further study of read disturbance in DRAM.

Abstract

Memory isolation is a critical property for system reliability, security, and safety. We demonstrate RowPress, a DRAM read disturbance phenomenon different from the well-known RowHammer. RowPress induces bitflips by keeping a DRAM row open for a long period of time instead of repeatedly opening and closing the row. We experimentally characterize RowPress bitflips, showing their widespread existence in commodity off-the-shelf DDR4 DRAM chips. We demonstrate RowPress bitflips in a real system that already has RowHammer protection, and propose effective mitigation techniques that protect DRAM against both RowHammer and RowPress.

RowPress Vulnerability in Modern DRAM Chips

TL;DR

RowPress identifies a new DRAM read-disturb mechanism caused by long aggressor-row open times () that can flip bits without thousands of activations, distinct from RowHammer. The authors perform large-scale real-device characterization across DDR4 chips, demonstrate a proof-of-concept RowPress attack on a system with RowHammer protections, and propose a mitigation framework that adapts RowHammer defenses to RowPress. Key findings show RowPress is widespread, temperature-sensitive, and largely operates via a different failure mechanism than RowHammer, with potential to be triggered by a single aggressor activation under long open times. The work has practical industry impact by prompting updates to mitigation strategies, memory-controller policies, and standards, and it provides open-source tools to enable replication and further study of read disturbance in DRAM.

Abstract

Memory isolation is a critical property for system reliability, security, and safety. We demonstrate RowPress, a DRAM read disturbance phenomenon different from the well-known RowHammer. RowPress induces bitflips by keeping a DRAM row open for a long period of time instead of repeatedly opening and closing the row. We experimentally characterize RowPress bitflips, showing their widespread existence in commodity off-the-shelf DDR4 DRAM chips. We demonstrate RowPress bitflips in a real system that already has RowHammer protection, and propose effective mitigation techniques that protect DRAM against both RowHammer and RowPress.

Paper Structure

This paper contains 13 sections, 5 figures, 1 table.

Table of Contents

  1. Motivation
  2. RowPress
  3. Real DRAM Chip Characterization
  4. Characterization Methodology
  5. Key Characterization Results
  6. Proof-of-Concept Real System Demonstration
  7. Methodology
  8. Demonstration Program
  9. Mitigating RowPress
  10. Practical Industry Impact
  11. Research Impact
  12. Author Biography
  13. Sidebar: Related Works on DRAM Bitflips

Figures (5)

  • Figure 1: $AC_{min}$ distributions of conventional RowHammer (RH) and three representative cases of RowPress (RP) at $80^{\circ}C$ across 164 DDR4 chips from manufacturers S, H, and M.
  • Figure 2: Our DDR4 DRAM testing infrastructure.
  • Figure 3: How changes as tAggON increases.
  • Figure 4: Single-sided minus double-sided at $50^{\circ}C$ (first row) and $80^{\circ}C$ (second row).
  • Figure 5: Number of RowHammer vs. RowPress bitflips (left) and number of rows with bitflips (right) we observe after running our proof of concept test programs with Algorithm 1 (blue bars) and Algorithm 2 (purple bars) with four (top), three (middle), and two (bottom) activations per aggressor row per iteration.