ZebRAM: Comprehensive and Compatible Software Protection Against Rowhammer Attacks

The Rowhammer vulnerability common to many modern
DRAM chips allows attackers to trigger bit flips in a row
of memory cells by accessing the adjacent rows at high
frequencies. As a result, they are able to corrupt sensitive
data structures (such as page tables, cryptographic keys,
object pointers, or even instructions in a program), and
circumvent all existing defenses.
This paper introduces ZebRAM, a novel and compre-
hensive software-level protection against Rowhammer.
ZebRAM isolates every DRAM row that contains data
with guard rows that absorb any Rowhammer-induced bit
flips; the only known method to protect against all forms
of Rowhammer. Rather than leaving guard rows unused,
ZebRAM improves performance by using the guard rows
as efficient, integrity-checked and optionally compressed
swap space. ZebRAM requires no hardware modifications
and builds on virtualization extensions in commodity pro-
cessors to transparently control data placement in DRAM.
Our evaluation shows that ZebRAM provides strong se-
curity guarantees while utilizing all available memory.