Date of Award

6-2026

Document Type

Thesis

Publisher

Santa Clara : Santa Clara University, 2026

Degree Name

Master of Science (MS)

Department

Electrical and Computer Engineering

First Advisor

Hoeseok Yang

Abstract

Rowhammer is a hardware fault that began as a DRAM reliability concern and became a security vulnerability. Repeatedly activating one row corrupts data in its neighbors, so an attacker who can hammer rows next to sensitive memory can flip bits they could never directly access. The number of activations needed to do so is called the Rowhammer threshold. The Rowhammer threshold has fallen steadily with each generation. The defenses that ship in response, from in-DRAM target-row refresh to the counter-based mitigations now mandated by the DDR5 standard, all rest on a quiet assumption: that this threshold is a fixed property of the chip, measured once at the factory and trusted for the life of the module. This thesis sets out to test that assumption, and to fix the gap it leaves open.

I begin on real hardware. Using an FPGA-based memory controller to drive a DDR4 module through an accelerated-aging regimen of heat and sustained wordline stress, I track how its vulnerability evolves across a 43-hour soak rather than at a single snapshot. The picture that emerges is more subtle than “aging makes Rowhammer worse.” Retention degrades sharply and, tellingly, non-monotonically. Retention transiently improves during an early-life annealing phase before sustained degradation sets in, while the number of Rowhammer-vulnerable rows stays remarkably steady. What changes is which rows are vulnerable: the population turns over even as its size holds. And the cells that fail retention turn out to be different cells from the ones that flip under hammering, so a fast retention test cannot stand in for a Rowhammer scan. Vulnerability, in short, is not a fixed fingerprint but a moving target.

If the threshold moves, a defense pinned to a stale value drifts out of calibration — conservatively at first, dangerously later. The second part of the thesis closes that gap with a thin runtime layer that sits in front of an existing defense and keeps its threshold current. Once per epoch it reads the module’s temperature, recomputes an effective threshold, and writes it back through the defense’s own threshold parameter, guarded by a margin that absorbs the chip-to-chip variability the model cannot see. The layer never loosens a defense, only tightens it, and it costs a negligible sliver of memory bandwidth. Evaluated in a cycle-accurate simulator against three architecturally distinct defenses, it eliminates the staleness-induced bit flips that the static baselines leak when the module runs hot, while spending less mitigation effort than the conservative worst-case design — and, for one capacity-limited defense, it cleanly exposes a failure that no amount of threshold tuning can repair.

Finally, I bring the defense back to silicon. Realized as a host-side controller on the same FPGA platform, with a per-subarray adaptive mode informed by the aging study, it eliminates every Rowhammer bit flip a realistic attack workload would otherwise produce, and concentrates its protective work precisely on the subarrays the characterization flagged as weakest. Taken together, the characterization and the defense make a single argument: Rowhammer vulnerability is best understood as a non-stationary property of a DRAM module, and both how we measure it and how we defend against it should be built to follow it as it moves.

Download

Share

COinS