How Does Rowhammer Flip Bits in Adjacent DRAM Rows?

Rowhammer is a hardware vulnerability in dynamic random-access memory (DRAM) where repeatedly activating a single memory row causes electrical interference that flips bits in physically adjacent rows. By rapidly opening and closing an aggressor row within a single refresh interval, an attacker can drain or alter the charge stored in neighboring victim cells before the memory controller refreshes them. This phenomenon bypasses standard software memory isolation and allows unprivileged processes to corrupt data or gain elevated privileges.

DRAM Structure and Charge Storage

Modern DRAM chips organize memory cells into two-dimensional arrays of rows and columns. Each cell consists of a single capacitor and an access transistor. The capacitor holds a tiny electrical charge representing a binary value, while the transistor acts as a switch controlled by a horizontal wire called a wordline. Vertical wires called bitlines connect cells in a column to sense amplifiers at the edge of the array.

Because capacitors naturally leak charge over time, DRAM requires periodic refreshing. The memory controller must read and rewrite every row within a fixed refresh window, typically \(t_{REFI} = 64\text{ ms}\) (or \(32\text{ ms}\) in newer standards), to preserve data integrity.

The Mechanism of Row Activation

To read or write data in DRAM, the memory controller issues an ACTIVATE command for a target row. This raises the voltage on that row's wordline, turning on the access transistors and connecting the cell capacitors to their respective bitlines. The sense amplifiers then detect the small voltage differences and amplify them to full logic levels.

Before another row in the same bank can be accessed, the controller must issue a PRECHARGE command, which lowers the wordline voltage and resets the bitlines. In normal operation, a row is activated and precharged at a moderate rate. However, when software repeatedly accesses memory addresses that map to different rows in the same bank, it forces the controller to rapidly alternate between ACTIVATE and PRECHARGE commands.

How Repeated Activations Cause Bit Flips

When a wordline is toggled millions of times per second, the rapid voltage fluctuations on the aggressor wordline induce electrical disturbances in nearby wordlines. Several physical mechanisms contribute to this effect:

  • Capacitive Crosstalk: The close physical proximity of wordlines in high-density DRAM creates parasitic capacitance between them. Voltage swings on the aggressor wordline couple into adjacent victim wordlines, slightly raising their voltage and partially turning on their access transistors, which allows charge to leak from the victim capacitors.
  • Electromagnetic Coupling and Charge Injection: Repeatedly driving current through the aggressor wordline generates localized electric fields and hot-carrier effects that disturb the charge distribution in neighboring silicon structures.

If the accumulated charge loss \(\Delta Q\) in a victim cell exceeds the sense amplifier's noise margin before the next refresh cycle, the cell's stored voltage crosses the threshold \(V_{th}\) and is misread as the opposite binary value.

Single-Sided vs. Double-Sided Rowhammer

Attackers use two primary access patterns to trigger bit flips:

  • Single-Sided Rowhammer: Software repeatedly accesses a single aggressor row, disturbing the two rows immediately adjacent to it.
  • Double-Sided Rowhammer: Software alternates accesses between two aggressor rows that flank a single victim row (for example, rows \(N - 1\) and \(N + 1\) targeting row \(N\)). Because the victim row experiences disturbance from both sides simultaneously, double-sided Rowhammer requires fewer activations to induce bit flips.

Hardware and System Mitigations

To defend against Rowhammer, hardware manufacturers and system designers have implemented several countermeasures:

  • Target Row Refresh (TRR): Memory controllers and DRAM chips track frequently activated rows and proactively issue extra refresh commands to their neighbors.
  • Increased Refresh Rates: Shortening the refresh interval reduces the time available for charge leakage, though it increases power consumption and reduces memory bandwidth.
  • Error-Correcting Code (ECC) Memory: ECC detects and corrects single-bit errors, though multi-bit flips within the same word can still overwhelm standard ECC schemes.
  • Probabilistic Adjacent Row Activation (PARA): Upon closing a row, the memory controller refreshes adjacent rows with a small probability \(p\), ensuring that heavily hammered rows trigger neighbor refreshes without requiring complex tracking tables.