row hammer row hammer written effect dynamic random access memory causes memory cells leak charges interact electrically possibly altering contents nearby memory rows addressed original memory access isolation memory cells results high cell density modern triggered specially crafted memory access patterns rapidly activate memory rows numerous times row hammer effect privilege computer security exploits different hardware based techniques exist prevent row hammer effect occurring including required support types memory background dynamic ram bit stored data occupies separate memory cell electrically implemented charge state charged discharged determines cell stores value huge numbers memory cells packed integrated circuits additional logic cells purposes reading writing refreshing data memory cells blue squares illustration provided section organized addressed rows columns memory address applied matrix broken row address column address processed row column address illustration vertical horizontal green respectively row address row read operation selection known row activation bits cells row transferred sense form row red squares illustration exact bit selected column address consequently read operations destructive nature design requires memory cells rewritten values read transferring cell charges row write operations addresses similar way result design entire rows rewritten value single bit changed result storing data bits natural discharge rate memory cells lose state time require periodic memory cells process known refreshing result design memory susceptible random changes stored data known soft memory errors attributed cosmic rays causes different techniques counteract soft memory errors improve reliability error code memory advanced variants memory commonly overview increased integrated circuits led physically smaller memory cells capable storing smaller charges resulting lower operational noise margins increased rates electromagnetic interactions memory cells greater possibility data loss result disturbance errors observed caused cells interfering operation random changes values bits stored affected memory cells awareness disturbance errors dates early 1970s commercially available manufacturers employed techniques counteract disturbance errors improving isolation cells performing production testing researchers proved analysis commercially available chips manufactured susceptible disturbance errors term row hammer associated effect led observed bit opportunity row hammer effect occur memory primarily attributed high density memory cells results associated interactions cells rapid row determined primary cause frequent row cause voltage fluctuations associated row selection lines observed induce higher natural discharge rates belonging nearby adjacent cases memory rows called victim rows affected memory cells lose charge disturbance errors occur tests disturbance error observed performing subsequent memory row memory cell cells susceptible tests rate disturbance errors substantially affected increased environment temperature depends actual contents certain bit patterns result significantly higher disturbance error rates variant called double sided involves targeted rows surrounding victim row illustration provided section variant yellow rows aim inducing bit purple row case victim row tests approach result significantly higher rate disturbance errors compared variant victim row neighbouring rows different methods exist successful detection prevention correction row hammer effect tests simple solutions providing single error correction double error detection capabilities able correct detect observed disturbance errors include flipped bits memory word effective solution introduce frequent memory refreshing intervals shorter usual technique results higher power consumption increased processing overhead vendors provide updates implement type complex prevention measures performs counter based identification frequently accessed memory rows neighboring rows method issues additional random memory rows neighboring accessed rows regardless access frequency research shows prevention measures cause performance impacts release ivy bridge support called pseudo target row combination dual line memory row hammer effect automatically refreshing possible victim rows negative impacts performance power consumption default fall performing twice usual frequency results slightly higher memory access reduce memory memory standard published includes optional hardware support called target row prevents row hammer effect negatively performance power consumption additionally manufacturers implement products memory standard published internally identifies possible victim rows counting number row comparing chip specific maximum activate count mac maximum activate window values rows prevent bit mac value maximum total number row encountered particular row time interval equal shorter time neighbouring rows identified victim rows flag row victim row sum row neighboring rows reaches mac limit time window necessity huge numbers rapidly performed row row hammer exploits issue large numbers memory cause misses detected monitoring rate misses unusual peaks hardware performance version memory software released february includes called hammer test checks computer hardware susceptible disturbance errors implications memory protection way preventing processes memory assigned concepts modern operating systems memory protection combination security related mechanisms protection rings possible achieve privilege separation processes programs computer systems general divided parts limited specific privileges require perform particular task privilege separation reduce extent potential damage caused computer security attacks restricting effects specific parts system disturbance errors explained section effectively defeat layers memory protection short low hardware level practically creating unique attack type allows processes alter contents arbitrary parts main memory directly manipulating underlying memory hardware comparison conventional attack aim protection mechanisms software level exploiting programming mistakes achieve alterations inaccessible main memory contents exploits initial research row hammer effect publicized group authors june described nature disturbance errors indicated potential constructing attack provide examples working security exploit research paper created group authors published october imply existence security related issues arising row hammer effect march google project zero revealed working privilege exploits based row hammer effect establishing nature architecture revealed exploits targets google native client mechanism running limited machine instructions exploiting row hammer effect escape gain ability issue system calls directly vulnerability tracked modifying allow execution line flush machine instruction found required constructing effective row hammer attack second exploit revealed runs process architecture exploiting row hammer effect gain access physical memory installed computer combining disturbance errors memory exploit capable altering page table entries virtual memory system mapping virtual addresses physical addresses results exploit gaining memory access nature inability architecture privileged machine instruction exploit hardly computers use hardware built row hammer prevention mechanisms testing viability exploits found half tested experienced disturbance errors occurring vulnerable minutes running row hammer inducing code tested manufactured non memory july group security researchers published paper describes instruction set independent way exploiting row hammer effect instead relying instruction perform approach memory causing high rate carefully selected memory access patterns replacement policies differ approach architectural differences employing strategy proof concept approach provided native code implementation pure implementation runs implementation called uses large relies internal allocation large pages result demonstrates high level exploit low level vulnerability
Row hammer