我们对Rowhammer敏感吗？面向云提供商的端到端方法
Are We Susceptible to Rowhammer? An End-to-End Methodology for Cloud Providers
摘要：
云提供商担心Rowhammer对其服务器构成潜在的严重威胁，但目前他们缺乏系统的方法来测试服务器中使用的DRAM是否容易受到Rowhammer攻击。本文提出了一种端到端的方法来确定云服务器是否容易受到这些攻击。通过我们的方法，云提供商可以为DRAM构建最坏情况的测试条件。我们将我们的方法应用于来自主要云提供商的三类服务器。我们的研究结果表明，在以前的工作中使用的CPU指令序列安装Rowhammer攻击创建最坏情况下的DRAM测试条件。为了解决这一限制，我们开发了一个指令序列，利用微架构的副作用，以接近最佳的速度在现代英特尔Skylake和Cascade Lake平台上的“锤子”DRAM。我们还设计了一个DDR4故障注入器，可以反向工程任何DDR4 DIMM的行相邻。当应用于我们的云提供商的DIRECT时，我们发现DRAM行并不总是遵循线性映射。
英文摘要：
Cloud providers are concerned that Rowhammer poses a potentially critical threat to their servers, yet today they lack a systematic way to test whether the DRAM used in their servers is vulnerable to Rowhammer attacks. This paper presents an end-to-end methodology to determine if cloud servers are susceptible to these attacks. With our methodology, a cloud provider can construct worst-case testing conditions for DRAM. We apply our methodology to three classes of servers from a major cloud provider. Our findings show that none of the CPU instruction sequences used in prior work to mount Rowhammer attacks create worst-case DRAM testing conditions. To address this limitation, we develop an instruction sequence that leverages microarchitectural side-effects to ``hammer'' DRAM at a near-optimal rate on modern Intel Skylake and Cascade Lake platforms. We also design a DDR4 fault injector that can reverse engineer row adjacency for any DDR4 DIMM. When applied to our cloud provider's DIMMs, we find that DRAM rows do not always follow a linear map.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
