一句话：揭示DRAM耦合行对RowHammer攻击的影响，提出可绕过软件防御并提升利用成功率的Marionette攻击，并探索缓解方案。
论文研究DRAM中“耦合行对”带来的RowHammer安全风险。耦合行与攻击行共享字线但使用不同行缓冲，处理器侧不可见，却可引发位翻转。作者在FPGA基础设施与服务器系统上验证其攻击强度，提出Marionette攻击：通过静默锤击耦合行，绕过基于跟踪和基于隔离的软件防御；后者可打破DRAM子阵列级隔离，实现跨VM攻击。在原生服务器上，Marionette在跟踪防御下将现有RowHammer利用成功率最高提升1.66倍。最后提出将耦合行关系暴露给系统以实现轻量缓解。
A body of recent work has revealed that two different rows in a DRAM bank, from the perspective of a processor-memory interface, are connected to the same wordline but two separate row buffers (bitline sense amplifiers) in certain DRAM chips. Such a pair of rows is referred to as a ''coupled-row pair.'' Coupled-row pairs pose a substantial security threat as RowHammer bitflips can be caused not only by the conventional, adjacent aggressor rows but also by their coupled rows that are distant in physical address We investigate the impact of a coupled row on both FPGA-based infrastructure and server systems. In RowHammer attacks, coupled rows have hammering strength nearly identical to aggressor rows, with these attacks invisible to conventional, processor-side mitigation solutions. By exploiting these observations, we present Marionette, a new type of RowHammer attack that exploits coupled rows to extend the existing RowHammer attack surface. First, coupled rows enable an attacker to evade two types of existing software-based RowHammer defenses: tracking- and isolation-based defenses. We induce RowHammer bitflips successfully against tracking-based RowHammer defenses by silently hammering coupled rows. We also identify the feasibility of RowHammer bitflips in an isolation-based inter-VM RowHammer defense by breaking DRAM-subarray-level isolation. Second, we successfully conduct an existing RowHammer exploit in a server under the tracking-based RowHammer defense. In a native server system, Marionette enhances the success rate of the RowHammer exploit by up to 1.66x. Lastly, we explore lightweight mitigation schemes for Marionette by exposing the coupled-row relationship to systems.
@inproceedings{BaekWPNKKA25,
title = {Marionette: A RowHammer Attack via Row Coupling},
author = {Seungmin Baek and Minbok Wi and Seonyong Park and Hwayong Nam and Michael Jaemin Kim and Nam Sung Kim and Jung Ho Ahn},
booktitle = {ASPLOS},
year = {2025},
doi = {10.1145/3669940.3707242}
}