Row hammer: Difference between revisions

'''Row hammer''' (also written as '''rowhammer''') is a computer security exploit that takes advantage of an unintended and undesirable side effect in [[dynamic random-access memory]] (DRAM) in which [[memory cell (computing)|memory cells]]m interact electrically between themselves by leaking their charges, possibly changing the contents of nearby [[memory row]]srows that were not [[memory address|addressed]] in the original memory access. This circumvention of the isolation between DRAM memory cells results from the high cell density in modern DRAM, and can be triggered by specially crafted [[memory access pattern]]spatterns that rapidly activate the same memory rows numerous times.<ref name="isca14-paperarstechnica">{{cite web |author=Goodin |first=Dan |date=March 10, 2015 |title=Cutting-edge hack gives super user status by exploiting DRAM weakness |url=https://arstechnica.com/security/2015/03/cutting-edge-hack-gives-super-user-status-by-exploiting-dram-weakness/ |access-date=March 10, 2015 |publisher=[[Ars Technica]]}}</ref>

The row hammer effect has been used in some [[privilege escalation]] computer security [[exploit (computer security)|exploits]],<ref name="arstechnica"/><ref name="googleprojectzero">{{cite web |last1=Seaborn |first1=Mark |last2=Dullien |first2=Thomas |date=March 9, 2015 |title=Exploiting the DRAM rowhammer bug to gain kernel privileges |url=http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html |access-date=March 10, 2015 |website=googleprojectzero.blogspot.com}}</ref><ref>{{cite news

Different hardware-based techniques exist to prevent the row hammer effect from occurring, including required support in some [[central processing unit|processors]] and types of DRAM [[memory module]]smodules.<ref name="intel-d2s2e4">{{cite web

Memory cells (blue squares in both illustrations) are further organized into [[matrix (mathematics)|matrices]] and addressed through rows and columns. A memory address applied to a matrix is broken into the row address and column address, which are processed by the row and column [[address decoder]]s (in both illustrations, vertical and horizontal green rectangles, respectively). After a row address selects the row for a read operation (the selection is also known as [[row activation]]), bits from all cells in the row are transferred into the [[sense amplifier]]s that form the row buffer (red squares in both illustrations), from which the exact bit is selected using the column address. Consequently, read operations are of a destructive nature because the design of DRAM requires memory cells to be rewritten after their values have been read by transferring the cell charges into the row buffer. Write operations decode the addresses in a similar way, but as a result of the design entire rows must be rewritten for the value of a single bit to be changed.<ref name="isca14-paper">{{cite web |author1=Yoongu Kim |author2=Ross Daly |author3=Jeremie Kim |author4=Chris Fallin |author5=Ji Hye Lee |author6=Donghyuk Lee |author7=Chris Wilkerson |author8=Konrad Lai |author9=Onur Mutlu |date=June 24, 2014 |title=Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors |url=http://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.pdf |access-date=March 10, 2015 |website=ece.cmu.edu |publisher=[[IEEE]]}}</ref>{{rp|2–3}}<ref name="cs7810"/><ref name="ece548"/><ref>{{cite web

Increased densities of [[dynamic random-access memory|DRAM]] [[integrated circuit]]s have led to physically smaller memory cells containing less charge, resulting in lower operational [[noise margin]]s, increased rates of electromagnetic interactions between memory cells, and greater possibility of data loss. As a result, ''disturbance errors'' have been observed, being caused by cells interfering with each other's operation and manifesting as random changes in the values of bits stored in affected memory cells. The awareness of disturbance errors dates back to the early 1970s and [[Intel&nbsp;1103]] as the first commercially available DRAM integrated circuits; since then, DRAM manufacturers have employed various [[vulnerability mitigation|mitigation]] techniques to counteract disturbance errors, such as improving the isolation between cells and performing production testing. However, researchers proved in a 2014 analysis that commercially available [[DDR3 SDRAM]] chips manufactured in 2012 and 2013 are susceptible to disturbance errors, while using the term ''row hammer'' to name the associated side effect that led to observed [[soft error|bit flips]].<ref name="isca14-paper"/><ref name="sophos">{{cite web |author=Ducklin |first=Paul |date=March 12, 2015 |title='Row hammering' – how to exploit a computer by overworking its memory |url=https://nakedsecurity.sophos.com/2015/03/12/row-hammering-how-to-exploit-a-computer-by-overworking-its-memory/ |access-date=March 14, 2015 |publisher=[[Sophos]]}}</ref><ref name="isca14-talk">{{cite web

A variant called ''double-sided hammering'' involves targeted activations of two DRAM rows surrounding a victim row: in the illustration provided in this section, this variant would be activating both yellow rows with the aim of inducing bit flips in the purple row, which in this case would be the victim row. Tests show that this approach may result in a significantly higher rate of disturbance errors, compared to the variant that activates only one of the victim row's neighboring DRAM rows.<ref name="googleprojectzero">{{cite web |last1=Seaborn |first1=Mark |last2=Dullien |first2=Thomas |date=March 9, 2015 |title=Exploiting the DRAM rowhammer bug to gain kernel privileges |url=http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html |access-date=March 10, 2015 |website=googleprojectzero.blogspot.com}}</ref><ref name="blackhat">{{cite web

Since the release of [[Ivy Bridge (microarchitecture)|Ivy Bridge]] [[microarchitecture]], [[Intel]] [[Xeon]] processors support the so-called ''pseudo target row refresh'' (pTRR) that can be used in combination with pTRR-compliant DDR3 [[dual in-line memory module]]s (DIMMs) to mitigate the row hammer effect by automatically refreshing possible victim rows, with no negative impact on performance or power consumption. When used with DIMMs that are not pTRR-compliant, these Xeon processors by default fall back on performing DRAM refreshes at twice the usual frequency, which results in slightly higher memory access latency and may reduce the memory bandwidth by up to 2–4%.<ref name="intel-d2s2e4">{{cite web |author=Marcin Kaczmarski |date=August 2014 |title=Thoughts on Intel Xeon E5-2600 v2 Product Family Performance Optimisation – Component selection guidelines |url=http://infobazy.gda.pl/2014/pliki/prezentacje/d2s2e4-Kaczmarski-Optymalna.pdf |access-date=March 11, 2015 |publisher=[[Intel]] |page=13}}</ref>

}}</ref> includes optional hardware support for the so-called ''target row refresh'' (TRR) that prevents the row hammer effect without negatively impacting performance or power consumption.<ref name="memcon-net105">{{cite web |author=Greenberg |first=Marc |date=October 15, 2014 |title=Reliability, Availability, and Serviceability (RAS) for DDR DRAM interfaces |url=http://www.memcon.com/pdfs/proceedings2014/NET105.pdf |url-status=dead |archive-url=https://web.archive.org/web/20160705220034/http://www.memcon.com/pdfs/proceedings2014/NET105.pdf |archive-date=July 5, 2016 |access-date=March 11, 2015 |website=memcon.com |pages=2, 7, 10, 20, 27}}</ref><ref>{{cite web