DRAM read disturbance is a significant and worsening safety, security, and reliability issue of modern DRAM chips that can be exploited to break memory isolation. Two prominent examples of read-disturb phenomena are RowHammer and RowPress. However, no prior work extensively studies read-disturb phenomena in modern high-bandwidth memory (HBM) chips. In this work, we experimentally demonstrate the effects of read disturbance and uncover the inner workings of undocumented in-DRAM read disturbance mitigation mechanisms in HBM. Our characterization of six real HBM2 DRAM chips shows that (1) the number of read disturbance bitflips and the number of row activations needed to induce the first read disturbance bitflip significantly varies between different HBM2 chips and different 3D-stacked channels, pseudo channels, banks, and rows inside an HBM2 chip. (2) The DRAM rows at the end and in the middle of a DRAM bank exhibit significantly fewer read disturbance bitflips than the rest of the rows. (3) It takes fewer additional activations to induce more read disturbance bitflips in a DRAM row if the row exhibits the first bitflip already at a relatively high activation count. (4) HBM2 chips exhibit read disturbance bitflips with only two row activations when rows are kept active for an extremely long time. We show that a modern HBM2 DRAM chip implements undocumented read disturbance defenses that can track potential aggressor rows based on how many times they are activated, and refresh their victim rows with every 17 periodic refresh operations. We draw key takeaways from our observations and discuss their implications for future read disturbance attacks and defenses. We explain how our findings could be leveraged to develop both i) more powerful read disturbance attacks and ii) more efficient read disturbance defense mechanisms.

翻译：DRAM读取干扰是现代DRAM芯片中一个严重且日益恶化的安全与可靠性问题，可被利用以破坏内存隔离。RowHammer和RowPress是两种典型的读取干扰现象。然而，此前尚无研究对现代高带宽内存（HBM）芯片中的读取干扰现象进行深入探讨。在本工作中，我们通过实验展示了HBM中读取干扰的影响，并揭示了未公开的片内读取干扰缓解机制的内部工作原理。我们对六块真实HBM2 DRAM芯片的表征表明：（1）不同HBM2芯片及其内部不同3D堆叠通道、伪通道、存储体和行之间的读取干扰位翻转次数及诱发首次读取干扰位翻转所需的行激活次数存在显著差异。（2）DRAM存储体末端和中间位置的行出现的读取干扰位翻转次数明显少于其他行。（3）若某行在相对较高的激活次数下已出现首次位翻转，则诱发更多读取干扰位翻转所需的额外激活次数更少。（4）当行被保持激活极长时间时，HBM2芯片仅需两次行激活即可出现读取干扰位翻转。我们发现现代HBM2 DRAM芯片实现了未公开的读取干扰防御机制，该机制可根据潜在攻击行的激活次数对其进行追踪，并在每17次周期性刷新操作中对其受害行进行刷新。我们从观察结果中提炼出关键启示，并讨论了其对未来读取干扰攻击与防御的影响。此外，我们阐释了如何利用这些发现分别开发：（i）更具威力的读取干扰攻击及（ii）更高效的读取干扰防御机制。