NeRAM: Next-Generation Rowhammer Attacks and Mitigations

Modern computers have several gigabytes of DRAM memory that is used to store basically all data processed by the computer while it is running. DRAM memory itself consists of cells that store the 1`s and 0`s in capacitors - for example, charged for a 1 and discharged for a 0. Manufacturers are constantly increasing the density of chips and thus decreasing the capacitance of these capacitors in order to optimize storage capacity, performance and efficiency . The result is that parasitic effects can occur, such as the Rowhammer effect. With the Rowhammer effect, high-frequency accesses to two DRAM capacitors ensure that an adjacent capacitor loses so much charge that a stored 1 is read as a 0 the next time it is accessed. This seemingly small problem fundamentally undermines system security, since a single bit can decide whether a program has administrator rights or not. The aim of our research project "NeRAM" is to better understand the Rowhammer effect, to investigate countermeasures and to develop new effective countermeasures. To this end, we investigate the extent of the Rowhammer effect using automated frameworks. An important part is to describe yet unknown properties of the Rowhammer effect, especially those arising in different environments, such as the effects of temperature, EM radiation and aging. In addition, we also examine the Rowhammer effect on devices that have not yet been examined in the context of Rowhammer, namely graphics cards. Graphics cards have special GDDR DRAM memory, which we expect to be vulnerable to Rowhammer-based attacks. On this basis, we will finally propose countermeasures against Rowhammer that specifically protect data from the operating system. We will then use prototypes to demonstrate the effectiveness of the countermeasures. NeRAM is a research collaboration between Florian Adamsky (University of Applied Sciences Hof) and Daniel Gruss (Graz University of Technology).

Modern computers can fail in unexpected ways: simply accessing memory many times in a row can disturb nearby data and silently change it. This effect, known as Rowhammer, can be abused by attackers to bypass security mechanisms. Our project shows that this is not just a theoretical risk - it already affects real-world systems. Our most important result is FlippyRAM, a large-scale user study on Rowhammer in the wild. We developed an easy-to-use testing tool and invited volunteers from the public and the research community to run it on their own computers. In total, we collected more than 1000 datasets from over 800 different systems, making this one of the most comprehensive studies of its kind. The result is clear: about one in ten systems tested showed this dangerous behavior. This demonstrates that Rowhammer remains a real and relevant security risk in everyday devices. At the same time, our study explains why such attacks are not yet widespread in practice. Successfully triggering Rowhammer is difficult and depends strongly on the exact hardware and system configuration. In many cases, attacks fail because the internal structure of memory is hard to reconstruct automatically. Our follow-up research significantly improved these analysis techniques, making it much easier to detect vulnerable systems - even for modern memory technologies. Another key insight from our work is that scientific results in this field must be interpreted carefully. By systematically reviewing previous studies, we found that many experiments rely on small test sets or unrealistic assumptions. This can lead to misleading conclusions about real-world risks. Our work helps make future research more reliable and comparable. Finally, we explored practical defenses. We developed new protection mechanisms that can detect and stop harmful memory access patterns early. Our results show that effective protection is possible with only minor performance impact - if supported by future hardware designs. Overall, our project provides a realistic picture of how widespread this hidden hardware weakness is, explains why it is difficult to exploit, and shows how it can be mitigated. These insights contribute to improving the security of everyday devices, cloud services, and critical digital infrastructure.