💻 computer science

ScaleDisturb: Exploiting Temporal Asymmetry to Amplify Read Disturbance in Modern DRAM Chips

The paper introduces ScaleDisturb, a novel DRAM access pattern that exploits temporal asymmetry to significantly amplify read disturbance effects across modern DDR4 and HBM2 chips, thereby exposing increased vulnerabilities as manufacturing nodes scale down and demonstrating the need for new mitigation strategies.

Original authors: Jikun Wang, Haocong Luo, Ataberk Olgun, İsmail Emir Yüksel, A. Giray Yağlıkçı, Yu Liang, F. Nisa Bostancı, Mohammad Sadrosadati, Onur Mutlu

Published 2026-06-09

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jikun Wang, Haocong Luo, Ataberk Olgun, İsmail Emir Yüksel, A. Giray Yağlıkçı, Yu Liang, F. Nisa Bostancı, Mohammad Sadrosadati, Onur Mutlu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your computer's memory (DRAM) as a massive, high-rise apartment building. Each apartment is a "row" of data. Normally, these apartments are quiet and stable. But, there's a weird glitch in the building's construction: if you bang on the walls of one apartment (the "aggressor") too hard or keep your door open for too long, the vibrations can shake the furniture in the next apartment over (the "victim"), causing things to break or flip over. This is called read disturbance.

For years, security experts knew about two ways to cause this shaking:

RowHammer: Rapidly opening and closing the door of the neighbor's apartment (banging on the wall).
RowPress: Keeping the neighbor's door wide open for a long time (vibrating the wall continuously).

The paper introduces a new, sneakier way to break things called ScaleDisturb.

The New Trick: "ScaleDisturb"

Think of the two neighbors on either side of the victim apartment.

The Old Way (Double-Sided RowPress): You keep both neighbors' doors open for the exact same amount of time. It's like two people leaning against the victim's walls with equal pressure.
The New Way (ScaleDisturb): You keep one neighbor's door open for a long time, and the other neighbor's door open for a short time. You do this repeatedly, but the timing is asymmetric.

The Analogy: Imagine trying to tip over a stack of Jenga blocks by pushing on the blocks next to it.

If you push both sides equally, the stack might hold.
But if you push one side hard and long, and the other side lightly and briefly, you create a weird "wobble" or imbalance. The paper found that this imbalance (temporal asymmetry) makes the victim blocks fall over (flip bits) much faster and with less effort than pushing both sides equally.

What They Found

The researchers tested this on 196 real memory chips (from Samsung, SK Hynix, and Micron) and even some high-speed HBM2 chips used in advanced computers. Here is what happened:

It Breaks Things Faster: Using this "uneven timing" trick, they could cause data errors (bitflips) with fewer door-banging attempts than any previous method. In some cases, they needed up to 63% fewer attempts to break the memory.
It Works Everywhere: This trick worked on almost every chip they tested, regardless of the manufacturer or the chip's age.
It Gets Worse Over Time: As memory chips get smaller and more advanced (like newer phone processors), they become more vulnerable to this specific trick.
It's Not Just "Bad Luck": They proved this isn't just random noise (which they call "Variable Read Disturbance"). The effect is stable and predictable. If you use the uneven timing, the memory will break in a specific way.
It Breaks Different Things: The specific data bits that flip are different from the ones that flip with the old methods. This means existing security guards might not be looking at the right windows.

The Real-World Test

The researchers wrote a simple program that a regular user could run on a real computer. Even though the computer had built-in safety features (designed to stop the old "RowHammer" attacks), the ScaleDisturb program still managed to break the memory. It caused errors in places where the old attacks couldn't reach, and it caused more errors than the old attacks when they did reach.

Why This Matters (The Security Problem)

Current security systems act like a guard who counts how many times a door is opened. If the count gets too high, the guard assumes the neighbor is dangerous and refreshes the victim's apartment to save it.

The Problem: The guard was trained on the "equal timing" attacks. Because ScaleDisturb breaks things with fewer attempts, the guard's counter is set too high. The victim gets broken before the guard realizes there is a problem.
The Fix: The paper suggests a new guard strategy called TeACUp. Instead of just counting door opens, this new guard looks at the timing. If one neighbor is leaning on the wall much longer than the other, the guard slows down the counter for the "heavy" neighbor so they don't get confused and trigger a false alarm, while still catching the real danger.

The Bottom Line

The paper shows that by simply changing the timing of how we access memory (making it uneven), we can break modern computer memory much more easily than we thought possible. This means current security measures might be weaker than we believe, and we need new ways to protect our data that account for these "uneven" attacks.

Technical Summary: ScaleDisturb

Problem Statement
Modern DRAM chips are vulnerable to read disturbance phenomena, specifically RowHammer and RowPress, where repeated access or prolonged opening of an "aggressor" row induces bitflips in physically adjacent "victim" rows. While prior work has characterized these vulnerabilities using specific access patterns (e.g., symmetric double-sided RowHammer or symmetric double-sided RowPress), these patterns may not represent the worst-case scenarios. Existing mitigation mechanisms rely on accurate profiling of the minimum number of aggressor activations required to induce a bitflip ( $AC_{min}$ ). If the true vulnerability is higher than characterized by existing patterns, these protections may fail. The paper posits that current access patterns do not fully exploit the temporal dynamics of DRAM row open times, potentially underestimating the susceptibility of modern DRAM to read disturbance.

Methodology
The authors introduce ScaleDisturb, a novel DRAM access pattern that exploits temporal asymmetry. Unlike traditional double-sided patterns where two adjacent aggressor rows are kept open for equal durations, ScaleDisturb asymmetrically extends the open time of the two aggressor rows ($RN-1$ and $RN+1$) while maintaining a constant total "Open Time Budget" (OTB) per access loop.

The study employs a rigorous experimental methodology:

Infrastructure: Experiments were conducted using DRAMBender (an FPGA-based infrastructure) to precisely control DDR4 and HBM2 commands.
Scope: The authors characterized 196 commercial off-the-shelf (COTS) DDR4 chips (spanning 15 die revisions from Samsung, SK Hynix, and Micron) and 3 HBM2 chips.
Controls: To isolate circuit-level effects, the study disabled on-die mitigation (Target Row Refresh), ECC, and retention failures by completing experiments within a single refresh window.
Metrics: The primary metric is $AC_{min}$ , the minimum number of aggressor activations required to flip a bit in a victim row. The authors sweep the distribution of open times ( $t_{AggON1}$ vs. $t_{AggON2}$ ) across various OTB values (ranging from 48 ns to 7.8 µs).
Real-System Validation: A proof-of-concept attack was implemented on a real DDR4-based system (Intel i5-10400) running Linux, utilizing user-level programs to bypass memory controller scheduling and in-DRAM TRR mechanisms.

Key Contributions

Discovery of ScaleDisturb: The paper is the first to demonstrate that asymmetrically extending the open time of two aggressor rows induces bitflips with significantly fewer activations than symmetric patterns.
Extensive Characterization: The authors provide a comprehensive analysis across 199 real DRAM chips, showing that ScaleDisturb is a widespread phenomenon affecting all major manufacturers.
Differentiation from VRD: The study distinguishes ScaleDisturb from Variable Read Disturbance (VRD), showing that ScaleDisturb-induced $AC_{min}$ reductions are stable, reproducible, and distinct in magnitude and bitflip locations.
Real-System Demonstration: The authors successfully induced bitflips on a real system with active RowHammer mitigation (TRR), proving that user-level programs can leverage ScaleDisturb to bypass existing protections.
Mitigation Analysis and Proposal: The paper evaluates existing solutions (ECC, safety margins, adaptive counters) and proposes TeACUp (Temporal Asymmetry-aware Counter Update), a new mitigation mechanism designed to handle asymmetric access patterns with low overhead.

Results

Amplified Vulnerability: ScaleDisturb reduces the $AC_{min}$ by an average of 9.6% across all tested rows compared to double-sided RowPress, with reductions reaching up to 63% in specific cases. At the module level, the minimum $AC_{min}$ is reduced by an average of 16.1% (up to 52.4%).
Manufacturer and Technology Trends: The effect is observed across Samsung, SK Hynix, and Micron chips. Furthermore, the vulnerability worsens as DRAM technology scales to smaller node sizes (newer die revisions).
Pattern Diversity: The authors identify three reduction patterns (L-type, R-type, and Flat-type) based on how $AC_{min}$ changes with the asymmetry ratio. L-type and R-type patterns, which show significant $AC_{min}$ reduction, account for approximately 37.5% of victim rows on average.
Bitflip Locations: ScaleDisturb flips a distinct set of bits compared to double-sided RowPress. The overlap rate of the first flipped cell drops significantly as OTB increases, indicating different physical failure mechanisms.
Real-System Impact: On a real system with TRR, a user-level program using ScaleDisturb induced bitflips in scenarios where double-sided RowPress failed. In cases where both succeeded, ScaleDisturb induced significantly more bitflips (e.g., 289 vs. 8 bitflips in one test configuration).
Mitigation Overhead: Applying large safety margins to existing mitigations to account for ScaleDisturb incurs significant performance (up to 28.6%) and energy (up to 58.8%) overheads. Simple ECC is insufficient as ScaleDisturb can induce far more bitflips than SECDED or ChipKill can correct.
TeACUp Efficacy: The proposed TeACUp mechanism effectively mitigates ScaleDisturb by dynamically scaling counter increments for the "faster" (more open) aggressor row. This reduces unnecessary preventive refreshes, improving system performance by an average of 3.2% compared to the baseline ImPress mechanism.

Significance and Claims
The paper claims that ScaleDisturb fundamentally alters the understanding of DRAM read disturbance by revealing that temporal asymmetry is a critical factor in vulnerability. The authors assert that:

Current mitigation mechanisms, which rely on symmetric access patterns for profiling, are likely insecure against ScaleDisturb.
The vulnerability is not an anomaly but a widespread characteristic that intensifies with technology scaling.
Future research must move beyond symmetric patterns to understand the physical mechanisms (likely related to electric field interference and electron migration) driving this phenomenon.
Robust system security requires mitigation strategies, such as TeACUp, that explicitly account for temporal asymmetry rather than relying solely on static safety margins or existing counter-based approaches.

The authors conclude by calling for further device-level studies to understand the inner workings of ScaleDisturb and for the development of more comprehensive mitigation strategies for future DRAM generations.