Search papers, labs, and topics across Lattice.
This paper investigates the impact of RowHammer countermeasures on the timing behavior of safety-critical real-time systems, focusing on a specific countermeasure known as the Per-Row-Activation-Counter (PRAC). The authors introduce JENGA, an attack that exploits the timing variations introduced by PRAC to manipulate the execution times of victim tasks, demonstrating that these attacks can cause delays of up to 200% beyond the expected Worst-Case Execution Time (WCET). By deriving a safe analytical bound that incorporates these mitigation-induced delays, the study highlights the inadequacy of traditional WCET analysis in the presence of such countermeasures.
JENGA reveals that RowHammer countermeasures can inadvertently increase task execution times, undermining the safety assumptions of real-time systems.
Safety-critical real-time systems must satisfy multiple dependability requirements, notably time predictability and security. In such systems, tasks must complete within bounded and known execution times, typically characterised through Worst-Case Execution Time (WCET) analysis. At the same time, DRAM-based platforms are increasingly sensitive to the RowHammer read-disturbance security vulnerability, which has motivated the development of numerous hardware and software countermeasures in both academia and industry. However, the impact of these defences is generally evaluated in terms of average-case performance, a metric that is insufficient for safetycritical real-time systems, where worst-case behaviour is the primary concern. In this paper, we study the impact of RowHammer countermeasures based on hardware counters on the timing behaviour of real-time systems. We use a Per-Row-Activation-Counter (PRAC) countermeasure as a case study, standardised for recent DDR5 memories, and show that it can introduce significant timing variations. Based on this observation, we introduce JENGA, an attack in which an attacker-controlled task manipulates the internal state of the RowHammer countermeasure mechanism to increase the execution time of a victim real-time task beyond its expected WCET. We implement JENGA in a gem5 and Ramulator 2.0 simulation environment and evaluate its impact on TACLeBench workloads. We show that such an attack can delay tasks up to 200% of their WCET, making the initial timesafety assumptions unsafe. To address this issue, we derive a safe analytical bound that accounts for mitigation-induced delays in WCET analysis for DRAM systems protected by hardware countermeasures, such as PRAC-N.
