RowHammer Attacks and Mitigations

The webinar, hosted by Product Manager Mafalda Cortez and led by Dr. Nicole Fern, Principal Security Analyst at Keysight, offered a comprehensive examination of RowHammer attacks and their implications across various industries. The session began by framing the problem: RowHammer is a fault injection attack that manipulates the physical properties of DRAM to induce bit flips, thereby corrupting data in adjacent memory cells without requiring physical access. This attack breaks conventional assumptions about memory and process isolation and is uniquely powerful because it can be executed entirely via software.

Dr. Fern detailed the technical mechanisms behind RowHammer, including the architecture of DRAM, the process of row activation and refresh, and how repeated access to specific memory rows—known as hammering—can lead to data corruption in neighboring rows. She explained the evolution from classic double-sided attacks to modern variants like RowPress, which subverts mitigation strategies by relying on different memory access patterns.

The presentation then explored real-world implications, citing successful proof-of-concept attacks that span user privilege escalation, virtual machine escape, cryptographic key extraction, and degradation of machine learning models. Although no public instances of in-the-wild exploitation have been reported, the research community has demonstrated the feasibility of these attacks across a range of systems, including x86, ARM, and RISC-V platforms.

The second part of the webinar focused on mitigation strategies, highlighting both industry and academic responses. DRAM-level protections like Targeted Row Refresh (TRR) and Error Correcting Codes (ECC) were discussed, with emphasis on their limitations—particularly in failing to prevent sophisticated access patterns and multi-row attack variants. Advanced academic proposals, such as the CSI RowHammer mitigation using cryptographic message authentication codes, were presented as more robust, albeit resource-intensive, solutions. Software-level mitigations and system-level strategies, including cache flush restrictions and DRAM process isolation, were also evaluated, though none offer complete protection.

Finally, Dr. Fern addressed testing methodologies. She distinguished between DRAM-level characterization—enabling fine-grained, controlled testing using tools like DRAM vendor FPGA setups—and system-level testing, which faces more complexity due to diverse operating environments. Tools like Flippy RAM offer OS-level characterization for broader system vulnerability assessment. She stressed the lack of standardized testing methodologies and emphasized the need for collaborative development of robust, scalable, and automated testing frameworks.

The webinar concluded with an interactive Q&A addressing practical challenges and future directions, such as the balance between cost-performance-security trade-offs, and the need for scalable fuzzing and validation tools. Ultimately, the session underscored RowHammer's persistent threat landscape, the evolving arms race between attackers and defenders, and Keysight’s commitment to supporting industry stakeholders in securing DRAM-equipped systems.