SpyHammer: Understanding and Exploiting RowHammer under Fine-Grained Temperature Variations
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2022
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866929370196606976 |
|---|---|
| author | Orosa, Lois Rührmair, Ulrich Yaglikci, A. Giray Luo, Haocong Olgun, Ataberk Jattke, Patrick Patel, Minesh Kim, Jeremie Razavi, Kaveh Mutlu, Onur |
| author_facet | Orosa, Lois Rührmair, Ulrich Yaglikci, A. Giray Luo, Haocong Olgun, Ataberk Jattke, Patrick Patel, Minesh Kim, Jeremie Razavi, Kaveh Mutlu, Onur |
| contents | RowHammer is a DRAM vulnerability that can cause bit errors in a victim DRAM row solely by accessing its neighboring DRAM rows at a high-enough rate. Recent studies demonstrate that new DRAM devices are becoming increasingly vulnerable to RowHammer, and many works demonstrate system-level attacks for privilege escalation or information leakage. In this work, we perform the first rigorous fine-grained characterization and analysis of the correlation between RowHammer and temperature. We show that RowHammer is very sensitive to temperature variations, even if the variations are very small (e.g., $\pm 1$ °C). We leverage two key observations from our analysis to spy on DRAM temperature: 1) RowHammer-induced bit error rate consistently increases (or decreases) as the temperature increases, and 2) some DRAM cells that are vulnerable to RowHammer exhibit bit errors only at a particular temperature. Based on these observations, we propose a new RowHammer attack, called SpyHammer, that spies on the temperature of DRAM on critical systems such as industrial production lines, vehicles, and medical systems. SpyHammer is the first practical attack that can spy on DRAM temperature. Our evaluation in a controlled environment shows that SpyHammer can infer the temperature of the victim DRAM modules with an error of less than $\pm 2.5$ °C at the 90th percentile of all tested temperatures, for 12 real DRAM modules (120 DRAM chips) from four main manufacturers. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2210_04084 |
| institution | arXiv |
| publishDate | 2022 |
| record_format | arxiv |
| spellingShingle | SpyHammer: Understanding and Exploiting RowHammer under Fine-Grained Temperature Variations Orosa, Lois Rührmair, Ulrich Yaglikci, A. Giray Luo, Haocong Olgun, Ataberk Jattke, Patrick Patel, Minesh Kim, Jeremie Razavi, Kaveh Mutlu, Onur Cryptography and Security Hardware Architecture RowHammer is a DRAM vulnerability that can cause bit errors in a victim DRAM row solely by accessing its neighboring DRAM rows at a high-enough rate. Recent studies demonstrate that new DRAM devices are becoming increasingly vulnerable to RowHammer, and many works demonstrate system-level attacks for privilege escalation or information leakage. In this work, we perform the first rigorous fine-grained characterization and analysis of the correlation between RowHammer and temperature. We show that RowHammer is very sensitive to temperature variations, even if the variations are very small (e.g., $\pm 1$ °C). We leverage two key observations from our analysis to spy on DRAM temperature: 1) RowHammer-induced bit error rate consistently increases (or decreases) as the temperature increases, and 2) some DRAM cells that are vulnerable to RowHammer exhibit bit errors only at a particular temperature. Based on these observations, we propose a new RowHammer attack, called SpyHammer, that spies on the temperature of DRAM on critical systems such as industrial production lines, vehicles, and medical systems. SpyHammer is the first practical attack that can spy on DRAM temperature. Our evaluation in a controlled environment shows that SpyHammer can infer the temperature of the victim DRAM modules with an error of less than $\pm 2.5$ °C at the 90th percentile of all tested temperatures, for 12 real DRAM modules (120 DRAM chips) from four main manufacturers. |
| title | SpyHammer: Understanding and Exploiting RowHammer under Fine-Grained Temperature Variations |
| topic | Cryptography and Security Hardware Architecture |
| url | https://arxiv.org/abs/2210.04084 |