From Fleet to Lab: Revisiting the Security and Complexity of Industrial Rowhammer Mitigation
2026-08-26 • Cryptography and Security
Cryptography and SecurityHardware Architecture
AI summaryⓘ
The authors examine ways to stop a type of computer memory attack called Rowhammer using the memory controller. They find that a recent method from Microsoft called Sigries can be tricked easily and requires complicated hardware. To fix this, the authors propose FiRM, a simpler and safer approach that cleverly combines two tracking methods and works well even when switching between them. Their designs, FiRM-P and FiRM-D, reduce hardware needs and keep the system secure without slowing down normal use. Overall, they show that careful design can improve both security and efficiency compared to past solutions.
RowhammerMemory ControllerMisra-Gries TrackerPARASigriesCAMSRAMMemory SecurityMitigationRound-Robin Attack
Authors
Hritvik Taneja, Moinuddin Qureshi
Abstract
This paper studies efficient and secure Rowhammer mitigation at the Memory-Controller (MC). Rowhammer mitigation faces a fundamental tradeoff between tracking storage and mitigation rate: precise trackers (such as Misra-Gries) avoid unnecessary mitigations but require large CAM structures, whereas sampling-based schemes (such as PARA) require no storage but incur frequent mitigations even when not under attack. Microsoft recently deployed Sigries, an MC-side Rowhammer defense that combines an under-provisioned Misra-Gries tracker with a row-sampling fallback, in its Azure Cobalt 200 SoC. Sigries observed that the tracker-to-sampling transition can be insecure, and claimed the reverse transition is always safe. Our analysis shows that this transition is also vulnerable, and a Round-Robin Attack across sub-banks reduces the MTTF of Sigries to about 1 second, 8 orders of magnitude below the 13 years with PARA. Sigries also suffers from CAM complexity and high storage overheads. Our proposal, FiRM (Filtered Rowhammer Mitigation), is based on the insight that, for a secure design, the tracking-mode and sampling-mode should not be configured independently but co-designed to ensure the system remains secure not only in both modes but also during transitions. FiRM incurs zero slowdown for benign workloads, since they do not exceed the filtering threshold, and also replaces the complex CAM-based tracker with simple SRAM filters. To handle stressful patterns, we propose FiRM-P (probabilistic) and FiRM-D (deterministic). FiRM-P uses varying probabilities during transitions and steady state to ensure both security and low performance overhead. FiRM-D provides guaranteed deterministic security by modulating the rate of mitigation. Both FiRM-P and FiRM-D have less storage overhead than Sigries. Our paper shows that a principled approach can avoid both the insecurity and the complexity of Sigries.