DRAM suffers from read disturbance phenomena (e.g., RowHammer and RowPress), where repeatedly accessing or continuously keeping open a DRAM row (aggressor row) induces bitflips in other physically nearby unaccessed rows (victim rows). The disturbance mechanism is practically exploitable from the software stack and worsens across generations with continued density scaling. DRAM read disturbance is highly sensitive to memory access patterns, yet prior work explores read disturbance under only a limited set of access patterns. We present ScaleDisturb, a new DRAM access pattern that can amplify DRAM read disturbance by asymmetrically extending the open time of two aggressor rows. Our rigorous experimental characterization of 196 DDR4 and 3 HBM2 DRAM chips shows that ScaleDisturb (1) leads to bitflips at significantly fewer row activations, compared to state-of-the-art memory access patterns, (2) makes read disturbance attacks easier across all tested DRAM chips, (3) increases DRAM vulnerability to read disturbance as DRAM manufacturing technology scales down to smaller node sizes. We showcase a proof-of-concept attack on a real system where a user-level program leveraging ScaleDisturb induces more bitflips than state-of-the-art RowHammer and RowPress memory access patterns. We describe and evaluate four solutions for mitigating read disturbance bitflips in the presence of ScaleDisturb and call for more research on the topic.

翻译：动态随机存取存储器（DRAM）存在读取干扰现象（如RowHammer和RowPress），即重复访问或持续保持打开某条DRAM行（攻击行）会在其他物理邻近且未被访问的行（受害者行）中诱发比特翻转。这种干扰机制可从软件层面实际利用，并随密度持续提升而在各代产品中加剧。DRAM读取干扰对内存访问模式高度敏感，但现有研究仅探索了有限访问模式下的读取干扰。我们提出ScaleDisturb，一种通过非对称延长两条攻击行打开时间来放大DRAM读取干扰的新型内存访问模式。对196颗DDR4和3颗HBM2 DRAM芯片的严格实验表征表明：与最先进的内存访问模式相比，ScaleDisturb（1）能在显著更少的行激活次数下引发比特翻转，（2）使所有受测DRAM芯片的读取干扰攻击更易实施，（3）随DRAM制造工艺缩小至更小节点尺寸时，增加DRAM对读取干扰的脆弱性。我们在真实系统上展示了概念验证攻击：相较于最先进的RowHammer和RowPress内存访问模式，利用ScaleDisturb的用户级程序可诱发更多比特翻转。我们针对ScaleDisturb存在下的读取干扰比特翻转问题，描述并评估了四种缓解方案，并呼吁对该主题开展更多研究。