论文标题
我们容易受到Rowhammer的影响吗？云提供商的端到端方法论
Are We Susceptible to Rowhammer? An End-to-End Methodology for Cloud Providers
论文作者
论文摘要
云提供商担心Rowhammer对其服务器构成了潜在的关键威胁，但是今天他们缺乏一种系统的方法来测试服务器中使用的DRAM是否容易受到Rowhammer攻击的影响。本文提出了一种端到端方法，以确定云服务器是否容易受到这些攻击的影响。借助我们的方法，云提供商可以为DRAM构建最坏的测试条件。 我们将方法应用于主要云提供商的三类服务器。我们的发现表明，在先前工作中使用的CPU指令序列没有用于安装Rowhammer攻击的情况，会造成最坏的DRAM测试条件。为了解决这一限制，我们开发了一个指令序列，该序列利用微体系副作用，以``锤子''DRAM在现代的英特尔Skylake和Cascade Lake Plactomps上以几乎最佳的速度。我们还设计了一个DDR4故障喷射器，可以为任何DDR4 DIMM逆转工程行邻接。当应用于云提供商的DIMM时，我们发现DRAM行并不总是遵循线性映射。
Cloud providers are concerned that Rowhammer poses a potentially critical threat to their servers, yet today they lack a systematic way to test whether the DRAM used in their servers is vulnerable to Rowhammer attacks. This paper presents an end-to-end methodology to determine if cloud servers are susceptible to these attacks. With our methodology, a cloud provider can construct worst-case testing conditions for DRAM. We apply our methodology to three classes of servers from a major cloud provider. Our findings show that none of the CPU instruction sequences used in prior work to mount Rowhammer attacks create worst-case DRAM testing conditions. To address this limitation, we develop an instruction sequence that leverages microarchitectural side-effects to ``hammer'' DRAM at a near-optimal rate on modern Intel Skylake and Cascade Lake platforms. We also design a DDR4 fault injector that can reverse engineer row adjacency for any DDR4 DIMM. When applied to our cloud provider's DIMMs, we find that DRAM rows do not always follow a linear map.
