CSI:Rowhammer: Closing the Case of Half-Double and Beyond
summary
Claims that TRR and ECC stop Rowhammer are false: Half-Double combines heavy distant hammers with a few near aggressors to force flips inside the 64 ms refresh (observed ~20 ms) and TRR counter limits actually help the attack. An end-to-end exploit targets Chromebook page tables, uses transient execution to verify flips, achieves full physical read/write in under an hour (average hammer-to-flip ~22–23 minutes), and is demonstrated on hardware plus a gem5 CSI-Rowhammer prototype. Proposed fix stores 256-bit MACs on ECC DIMMs, adds three CPU ops, costs ~1% mean (≤4% worst) and brute-force correction fixes up to 5 bits in seconds, 8 bits in hours.
AI-written summary · about
chapters (17)
- 0:00Introduction to Rowhammer
- 1:03DRAM and fault mechanism
- 2:55Rowhammer attack variants
- 3:28Existing mitigations
- 6:45Limitations of defenses
- 8:44Half double effect
- 11:18Exploiting Chromebooks
- 13:38Live attack demonstration
- 15:56Proposed solution: CSAR
- 17:56Implementing CSAR
- 21:05Performance and mechanics
- 23:07Best effort correction
- 25:26Evaluation of CSAR
- 27:09Security analysis
- 30:06Scalability and future work
- 32:35Context-aware correction
- 36:43Conclusion and Q&A
related talks
40mRowhammer Attacks: A Walkthrough Guide
15mPosthammer: Pervasive Browser-based Rowhammer Attacks with Postponed...
29mCAn’t Touch This...
16mECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory
14mGPUHammer: Rowhammer Attacks on GPU Memories are Practical
34mLeapFrog: The Rowhammer Instruction Skip Attack
10mMcSee: Evaluating Advanced Rowhammer Attacks and Defenses via Automated...
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...