McSee: Evaluating Advanced Rowhammer Attacks and Defenses via Automated...
summary
Builds an automated oscilloscope-based DDR bus decoder (McSee) that captures single-cycle DDR4 and multi-cycle DDR5 traffic and uses it to measure real controller behavior. Finds hammering benefits peak at ~six banks; sledgehammer beyond that reduces per-bank activations. Measures row open times and shows Rowpress yields only ~2x ACmin reduction on real DIMMs versus 17.6x claimed. Shows most DDR5 DIMs report RFM but only 1/30 requires it, Intel/AMD controllers do not emit RFM; Intel platforms use fine-granularity refresh and a 0.091% PTR refresh probability that delays but does not stop attacks, making bypass possible in hours–days–weeks depending on threshold.
AI-written summary · about
chapters (11)
- 0:00McSee and Rowhammer basics
- 1:17Rowhammer arms race with DDR5
- 2:22McSee platform design
- 3:46Optimizing McSee for DDR5
- 4:08Multibank hammering with Sledgehammer
- 5:10RowPress real-world impact
- 6:13RFM parameters and memory controller
- 7:19PTR mitigation on Intel/AMD
- 8:42Bypass time for PTR mitigation
- 9:02Future research with McSee
- 9:23Summary and conclusion
related talks
40mRowhammer Attacks: A Walkthrough Guide
25mDRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
38mCSI:Rowhammer: Closing the Case of Half-Double and Beyond
29mCAn’t Touch This...
28mComplexity Killed Security
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
18mSoftTRR: Protect Page Tables against Rowhammer Attacks using Software-only...