Read Disturbance in High Bandwidth Memory: A Detailed Experimental Study on HBM2 DRAM Chips

TL;DR

This paper provides a comprehensive experimental analysis of read disturbance effects in HBM2 DRAM chips, revealing vulnerabilities, undocumented defenses, and factors influencing bitflip susceptibility, with implications for future attacks and defenses.

Contribution

It offers the first detailed characterization of read disturbance in HBM2 DRAM, uncovering vulnerabilities and undocumented defense mechanisms through extensive experiments.

Findings

Read disturbance vulnerability varies across chips and components.

Rows at the ends and middle of a bank are more resilient.

Fewer activations cause more bitflips if the row is already vulnerable.

Abstract

We experimentally demonstrate the effects of read disturbance (RowHammer and RowPress) and uncover the inner workings of undocumented read disturbance defense mechanisms in High Bandwidth Memory (HBM). Detailed characterization of six real HBM2 DRAM chips in two different FPGA boards shows that (1) the read disturbance vulnerability significantly varies between different HBM2 chips and between different components (e.g., 3D-stacked channels) inside a chip, (2) DRAM rows at the end and in the middle of a bank are more resilient to read disturbance, (3) fewer additional activations are sufficient to induce more read disturbance bitflips in a DRAM row if the row exhibits the first bitflip at a relatively high activation count, (4) a modern HBM2 chip implements undocumented read disturbance defenses that track potential aggressor rows based on how many times they are activated. We describe how our findings could be leveraged to develop more powerful read disturbance attacks and more efficient defense mechanisms. We open source all our code and data to facilitate future research at https://github.com/CMU-SAFARI/HBM-Read-Disturbance.