ECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory

Nureddin Kamadan, Walter Wang, Stephan van Schaik, Christina Garman, Daniel Genkin, Yuval Yarom

34th USENIX Security Symposium · Day 1

The "ECC.fail" paper presents a groundbreaking study on the persistent hardware vulnerability known as **Rowhammer**, specifically targeting server platforms equipped with **DDR4 ECC memory**. Historically, Rowhammer attacks, which allow an attacker to flip bits in memory without directly accessing them by rapidly accessing adjacent memory rows, have been extensively demonstrated on client PCs and mobile devices. However, server-grade memory, fortified with Error Correcting Codes (ECC), was largely considered resilient to such exploits, with no successful end-to-end Rowhammer attack on DDR4 ECC servers having been publicly demonstrated prior to this work. This paper shatters that perception, revealing a sophisticated methodology to bypass these protections.

AI review

This is the real deal. First end-to-end Rowhammer on DDR4 ECC servers, with a full chain from TRR bypass through ECC exploitation to RSA key forgery. The reverse engineering of Intel's ECC implementation alone would be a solid paper; combining it with the timing side channel for blind flip detection and the 2-bit correctable bypass templates makes this genuinely novel work that changes what defenders need to assume about server memory integrity.