Timing Channel Vulnerabilities Introduced by RowHammer Defenses - MICRO'25 Talk by Nisa Bostanci

Timing Channel Vulnerabilities Introduced by RowHammer Defenses - MICRO'25 Talk by Nisa Bostanci

by F. Nisa Bostanci · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 F. Nisa Bostanci 👥 65K 📅 September 14, 2026 ⏱ 18 min 👁 23 📄 original study 🧭 2026-09-14
Available in: English (current) Français

Keywords

RowHammerside-channel attackcovert channelDRAMPRAC

Summary

The talk presents LeakyHammer, a new class of timing attacks that exploit vulnerabilities introduced by RowHammer defenses in modern DRAM systems. The presenter, Nisa Bostanci, first explains why standard Rowhammer mitigations like PRAC (parallel activation counting) and RFM (refresh management) create timing side channels: these preventive actions impose high memory latencies and can be intentionally triggered by an attacker. The key observation is that an attacker can craft memory access patterns to cause backoff signals, which then affect the latency of concurrent requests. LeakyHammer leverages this to build covert channels and a website fingerprinting attack. The evaluation uses gem5 and Ramulator2 simulations to demonstrate two covert channels (Prime+Probe and All-Bank) achieving up to 39 Kbps, and a website fingerprinting attack that classifies 40 websites with up to 75% accuracy using simple machine learning models. The talk also proposes three countermeasures: Fixed-Rate RFM, randomly initialized activation counters, and bank-level PRAC. While Fixed-Rate RFM fully eliminates the timing channel with low performance overhead in near-future systems, the other two reduce capacity or limit attack scope. The presentation emphasizes that all code and data are open-sourced, and includes a thorough discussion of the security implications of Rowhammer defenses.

195 words

Critical Evaluation

Value of the Information & Strength of the Argument

The talk provides significant value by identifying previously unknown security implications of industry-standard Rowhammer defenses. The argumentation is solid: the presenter systematically defines the threat model, explains the fundamental features (high-latency preventive actions and attacker-controllable triggering), and supports the attacks with rigorous simulation-based experiments. The case studies are well-structured and credible, with detailed attack mechanisms and performance evaluations. The channel capacity analysis under varying noise levels shows realistic conditions, and the proposed countermeasures are evaluated across multiple workloads. However, the lack of real hardware validation (PRAC and RFM are not yet widely available) limits empirical confirmation, though the use of established simulators strengthens the methodological soundness.

Scientific Rigor, Source Quality, Title Accuracy

The talk adheres to high scientific rigor: it references the authors’ own paper (arxiv.org/pdf/2503.17891) and open-source code (github.com/CMU-SAFARI/LeakyHammer), and builds upon prior foundational work on RowHammer, TPR/DRFM, and memory-centric computing. The sources cited in the description are authoritative and directly relevant. The title accurately reflects the content: it focuses on timing channel vulnerabilities introduced by RowHammer defenses, and the talk delivers on that promise. No commercial sponsorship or advertising segments are present, and the presentation is purely technical. The audience appears specialized, but the talk is well-organized for those familiar with computer architecture.

214 words

Title / Content Match

The title accurately reflects the content: the talk systematically analyzes new timing channel vulnerabilities introduced by RowHammer defenses and presents mitigation strategies.

Quality & Reliability

8/10

Talk based on a peer-reviewed MICRO'25 paper, with detailed methodology, clear evaluation using validated simulators, and open-source code. The claims are well-supported by experiments, though the absence of real hardware validation (due to unavailability of PRAC/RFM in commercial chips) slightly limits practical verification.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

External References

Contribution & Novelties

This talk introduces LeakyHammer, a novel class of timing attacks that exploit the latency characteristics of RowHammer defenses (PRAC and RFM) to create covert channels and side channels. The key novelty is demonstrating that the very mechanisms designed to mitigate RowHammer introduce new vulnerabilities, a significant and previously unexplored security implication. The work establishes covert channels with up to 39 Kbps capacity and a website fingerprinting attack with 75% accuracy, both validated through cycle-accurate simulation. The proposed countermeasures, especially Fixed-Rate RFM, provide practical mitigation strategies. This contribution is original and impactful, extending the understanding of hardware security in DRAM systems.

Pour aller plus loin :

142 words

Radar Profile

The radar profile shows high technical level (9) and strong quality of information (8), with slightly lower but still solid quantity (8) and reliability (8). This indicates a technically deep and well-supported presentation, though the reliance on simulation rather than real hardware slightly reduces perceived reliability.

Reliability 8/10