Reliable DRAM Bank Addressing Function Recovery in Asymmetric Channel Setups

Abstract

Rowhammer attacks and DRAM side channel attacks require addresses that map to the same DRAM bank. Such addresses can be found using undocumented, reverse-engineered DRAM addressing functions. A recent large-scale Rowhammer study showed that existing reverse-engineering tools fail in about 50 % of real-world setups. These tools assume conventional setups with a power-of-two number of identical power-of-twosized DIMMs (PTID) but fail on asymmetric non-PTID setups.

In this paper, we discover that many non-PTID setups follow previously unknown conditional DRAM mappings, where different parts of memory obey different locally valid linear function sets. We present DREAMS, the first approach to recover DRAM bank addressing functions on non-PTID setups with such conditionally valid function sets. The key novelty is to model asymmetric mappings together with the conditions that select each function set, instead of assuming one globally valid linear function set. DREAMS detects bit-inconsistent behavior, i.e., cases where the influence of an address bit is not consistent across the address space, and uses this signal to infer whether the system is PTID or non-PTID. For non-PTID setups, DREAMS recovers the region- and channel-specific function sets and their selection conditions, and verifies the resulting conditional mapping entirely in software. For overlapping functions, DREAMS uses SAT constraints to model interactions between multiple candidate bits simultaneously, allowing the analytical recovery pipeline to handle functions that share bits. We evaluate DREAMS on 19 non-PTID DIMM configurations across 6 Intel and AMD DDR4/DDR5 systems, recovering mappings with up to 3 conditional function sets selected by address cutoffs and channel functions. We show that these reverse-engineered functions provide security-critical DRAM-bank information, e.g., for Rowhammer attacks, DRAM isolation mechanisms, and side-channel attacks. 

Mehr zum Titel