Exploiting DRAM Bank and Row Conflicts for Timing Attacks in Mixed-Criticality Multicore Systems

Core Concepts

Malicious entities can exploit vulnerabilities in the shared DRAM architecture of multicore systems to create timing attacks that significantly increase the execution time of critical applications.

Abstract

The paper focuses on understanding the shared DRAM architecture in commercial-off-the-shelf multicore systems and demonstrates how it can be exploited to create a timing attack, named the "bank & row conflict bomb", that targets a victim task.
The authors first created a "navigate" algorithm to understand how the DRAM memory controller manages requests and exploits parallelism. Based on this understanding, they designed the "bank & row conflict bomb" algorithm that strategically contends for the same DRAM bank and row as the victim task, causing significant increases in the victim's execution time, up to 150%.
The experiments were conducted on a 2nd Gen Intel Xeon Processor with an 8GB DDR4-2666 DRAM module. The results highlight the need for proper countermeasures to ensure the safety and security of critical applications in mixed-criticality multicore systems.

Stats

The number of columns in a DRAM bank is 1KB. Upon surpassing this size, a new row will be opened, and the row buffer will become marked as dirty.
The 8GB DDR4-2666 ECC RDIMM (1Rx8) DRAM module has 16 DRAM banks organized into 4 bank groups, with 4 banks per group.

Quotes

"Malicious entities can purposefully exacerbate the shared resource contention to cause targeted attacks on the timing behavior of safety-critical applications, causing deadline misses."
"We focus on understanding commercial-of-the-shelf DDR4 DRAM dual in-line memory modules (DIMMs) and demonstrating how the DIMM architecture can be exploited to do a timing attack on a safety-critical application."

Key Insights Distilled From

Multicore DRAM Bank-& Row-Conflict Bomb for Timing Attacks in Mixed-Criticality Systems

by Antonio Savi... at arxiv.org 04-03-2024

https://arxiv.org/pdf/2404.01910.pdf

Deeper Inquiries

How can the proposed attack be mitigated through hardware or software-based techniques?

The proposed attack, known as the "DRAM Bank & Row-Conflict Bomb," can be mitigated through various hardware and software-based techniques. One hardware-based approach is to implement memory bandwidth allocation mechanisms, such as Intel's Resource Director Technology (RDT), which includes Cache Allocation Technology (CAT) and Memory Bandwidth Allocation (MBA). CAT allows for cache way-partitioning at the hardware level, while MBA delays requests going to the interconnect from a core's private context. By utilizing these technologies, it is possible to regulate contention in shared resources and prevent timing attacks on critical applications.
On the software side, techniques like memory bandwidth regulation and monitoring can be employed to control the number of memory accesses per application. Tools like Memguard can help regulate memory bandwidth allocation for individual cores, improving temporal isolation between cores. Additionally, implementing a memory allocator that is DRAM bank-aware, like PALLOC, can help in achieving performance isolation on multicore platforms. By combining hardware and software-based techniques, it is possible to enhance the security and safety of critical applications in mixed-criticality systems.

What other shared resources in multicore systems can be exploited for similar timing attacks, and how can they be addressed?

Apart from DRAM, other shared resources in multicore systems that can be exploited for similar timing attacks include shared caches, shared buses, and memory controllers. Shared caches, for example, can be targeted to create timing attacks by causing cache conflicts and impacting the performance of critical applications. To address such attacks, techniques like cache partitioning and cache coloring can be implemented to provide isolation between different cores and prevent interference in shared caches.
Shared buses can also be vulnerable to timing attacks, where malicious entities can create contention to disrupt the communication between cores. Techniques like bus arbitration and bandwidth allocation can help regulate access to shared buses and prevent timing attacks. Memory controllers, on the other hand, can be targeted to manipulate memory access patterns and create delays for critical applications. Implementing memory access regulation mechanisms and monitoring tools can help in controlling memory access and ensuring timing guarantees for critical tasks.

How can the insights from this work be applied to emerging memory technologies, such as DDR5, to ensure the security of future mixed-criticality systems?

The insights from this work can be applied to emerging memory technologies like DDR5 to ensure the security of future mixed-criticality systems. Understanding how shared resources like memory modules are managed and exploited for timing attacks can help in designing countermeasures for DDR5 memory architectures. By analyzing the architecture of DDR5 modules and identifying potential vulnerabilities, similar timing attacks can be prevented through proactive measures.
Techniques like the "navigate" algorithm can be adapted for DDR5 memory modules to understand how requests are managed and how parallelism is exploited. By creating targeted algorithms like the "DRAM Bank & Row-Conflict Bomb" for DDR5, it is possible to stress the memory hierarchy and identify vulnerabilities that could be exploited for timing attacks. Implementing hardware-based mechanisms like memory bandwidth allocation and software-based techniques for memory access regulation can help in securing DDR5 memory systems against timing attacks in future mixed-criticality environments.