An Analysis of HMB-based SSD Rowhammer

• DOI: 10.46586/uasc.2025.003
• Publication Date: 2025-03-07T12:57:50Z
• Authors: Jonas Juffinger

Rowhammer has been shown to be an extensive attack vector. In the years since its discovery, numerous exploits have shown, attacking a wide range of targets from kernels, through web browsers machine learning models. These attacks were not always mounted code running on CPU system. Various devices peripheral CPU, like GPUs or networks cards can cause bit flips DMA accesses main memory. this work, we take look at solid state drives (SSDs) and if they exploited as confused deputies perform attacks. With introduction NVMe, standardized protocol that allows SSDs communicate directly over PCIe with reached performance numbers million input/output operations per second. also enables use for direct This lead host memory buffer (HMB) feature, small fraction DRAM. We are first reverse engineer how different utilize answer question SSD HMB potential vector flips. Our analysis three shows, in lock up, which results denial service or, even worse, data loss. show frequent all SSDs. On one SSD, reach 5000 DRAM refresh interval. measure impact these effectively hammering However, enough flips, modern, highly vulnerable