SpyHammer：理解并利用细粒度温度变化下的 RowHammer
SpyHammer: Understanding and Exploiting RowHammer under Fine-Grained Temperature Variations
AI总结：
首次揭示 RowHammer 对细粒度温度变化高度敏感，并提出 SpyHammer 攻击，利用位错误率随温度变化的规律精准窥探关键系统 DRAM 温度。
摘要：
RowHammer 是一种 DRAM 漏洞，仅通过以足够高的速率访问受害 DRAM 行的相邻行，就能在受害 DRAM 行中引发位错误。最近的研究表明，新型 DRAM 设备越来越容易受到 RowHammer 攻击，并且许多研究展示了用于权限提升或信息泄露的系统级攻击。在这项工作中，我们首次对 RowHammer 与温度之间的相关性进行了严格的细粒度特征分析。我们表明 RowHammer 对温度变化非常敏感，即使变化非常小（例如 $\pm 1$ °C）。我们利用分析中的两个关键观察结果来窥探 DRAM 温度：1）RowHammer 引起的位错误率随着温度升高而持续增加（或减少），2）一些容易受到 RowHammer 攻击的 DRAM 单元仅在特定温度下才会出现位错误。基于这些观察结果，我们提出了一种名为 SpyHammer 的 RowHammer 攻击，用于窥探工业生产线、车辆和医疗系统等关键系统上 DRAM 的温度。SpyHammer 是首个能够窥探 DRAM 温度的实用攻击。我们在受控环境中的评估表明，对于来自四个主要制造商的 12 个真实 DRAM 模块（120 个 DRAM 芯片），在所有测试温度的第 90 百分位下，SpyHammer 能够以小于 $\pm 2.5$ °C 的误差推断受害 DRAM 模块的温度。
英文摘要：
RowHammer is a DRAM vulnerability that can cause bit errors in a victim DRAM row solely by accessing its neighboring DRAM rows at a high-enough rate. Recent studies demonstrate that new DRAM devices are becoming increasingly vulnerable to RowHammer, and many works demonstrate system-level attacks for privilege escalation or information leakage. In this work, we perform the first rigorous fine-grained characterization and analysis of the correlation between RowHammer and temperature. We show that RowHammer is very sensitive to temperature variations, even if the variations are very small (e.g., $\pm 1$ °C). We leverage two key observations from our analysis to spy on DRAM temperature: 1) RowHammer-induced bit error rate consistently increases (or decreases) as the temperature increases, and 2) some DRAM cells that are vulnerable to RowHammer exhibit bit errors only at a particular temperature. Based on these observations, we propose a new RowHammer attack, called SpyHammer, that spies on the temperature of DRAM on critical systems such as industrial production lines, vehicles, and medical systems. SpyHammer is the first practical attack that can spy on DRAM temperature. Our evaluation in a controlled environment shows that SpyHammer can infer the temperature of the victim DRAM modules with an error of less than $\pm 2.5$ °C at the 90th percentile of all tested temperatures, for 12 real DRAM modules (120 DRAM chips) from four main manufacturers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
