Marionette: A RowHammer Attack via Row Coupling

In some DRAM chips two rows share a wordline, so activating one silently activates a partner tens of thousands of rows away — which means an attacker can hammer a page table by touching memory that no software defence associates with it.

Why this problem is worth solving

Those software defences come in two shapes and both share one assumption. Tracking defences watch how often rows are accessed and refresh the endangered neighbours once a count crosses a threshold. Isolation defences put sensitive data such as page tables inside a region the attacker cannot reach across, often relying on the fact that a bit flip cannot cross a

What people did before, and where it broke

• In-chip target row refresh. Manufacturers build a mitigation into the DRAM itself, refreshing rows it believes are under attack. It has been repeatedly bypassed by tailored access patterns, and one attack showed the mitigation’s own refreshes can themselves cause flips.
• Per-row activation counting in hardware. The strongest direction, counting every activation properly rather than sampling. It is envisioned for future parts and will take years of hardware upgrades to become universal.
• Tracking defences in software. Count accesses using performance counters or by hooking the page fault handler, then refresh the neighbours of anything hammered too often. Deployable on a running server today, which is their whole appeal.
• Isolation defences in software. Provision memory so that sensitive data sits in a region physically separated from attacker-controlled memory, using sense amplifiers or dummy rows as the barrier. The strongest such system provisions virtual machine memory at the granularity of a subarray group.
• Reverse-engineer the address mapping to attack more precisely. A body of work recovers the permutation from physical address to DRAM row using timing side channels, so an attacker can construct double-sided and many-sided patterns.
• The gap. All of it assumes a single model of the hardware: one row hammered, its immediate neighbours at risk. Prior work had noticed that some chips activate two rows at once and briefly raised the possibility of exploiting it. Nobody had measured whether it actually hammers as hard, or built an attack on it.

How a distant row becomes a puppet

The idea

A defence is only as good as its model of the hardware. The framing the authors open with is that hardware security failures come from the gap between what software believes and what silicon does, and this is a clean example. Software RowHammer defences already work hard to see through several layers of address remapping, and they end up holding a single invariant: after all the permutation, hammering a row endangers its physical neighbours and nothing else. Coupled rows break the invariant rather than complicating it. Two rows driven by the same wordline are both opened by one activation, so hammering row q also hammers row Q, whose victims are Q plus and minus one — and on the tested servers Q is separated from q by the most significant bit of the row address, meaning tens of thousands of rows and almost certainly a different operating system page. A defence watching q’s neighbours is watching the wrong place entirely. Finding that a mitigation is not merely weakened but structurally inapplicable, because the hardware behaviour it reasons about is not the behaviour that matters, is the same discovery made by work showing that timing defences guard a door the attacker need never use, covered elsewhere on this site.

The second activation is invisible above the DRAM. What makes this exploitable rather than merely surprising is where the coupling happens. The row decoder inside the chip drives both wordlines from a single activation command, so the memory controller issues one command, the operating system observes one access, and performance counters record one activation. The paper confirms this directly: the access latency and the counted activation and precharge commands for a coupled-row pair are indistinguishable from any two different rows in the same bank. Tracking defences are therefore not evaded by cleverness — they are counting something that does not include the attack. The measurements establish the other half of the threat, that coupled-row hammering is not a weaker cousin: across four memory modules, bit flip locations overlapped conventional hammering by 95.9% to 98.1% and relative error rates ran from 0.974 to 1.000, for single-sided and double-sided patterns alike, and the effect holds for the slow-access variant of the phenomenon too. Demonstrating that a counting-based defence fails when the count does not observe every activation is exactly the concern that motivates putting activation counters where they can see everything, covered elsewhere on this site.

Isolation fails differently, and worse. For isolation defences the consequence is not evasion but penetration. A system that provisions virtual machine memory at subarray-group granularity relies on the sense amplifier as a physical barrier that disturbance cannot cross. That remains true — but if an attacker controls a row coupled to a row inside the protected region, activating the one it owns activates the one it does not. The protected row becomes a puppet, hammering its own neighbours from within the region, which is where the attack gets its name. What was previously limited to a single-sided nibble at the border of a region becomes a full double-sided attack in the middle of it. The proposed fix is pleasingly modest: rather than redesign chips or inflate page sizes, expose the coupling relationship through the module’s presence-detect chip, which the operating system can already read, and let each defence adapt — merge subarray groups so a pair is never split, or track both halves of a pair with one counter. Making the hardware disclose a mapping the attacker can discover anyway, so defenders can reason about it too, is the mirror image of designs that randomise the mapping to deny the attacker that knowledge, covered elsewhere on this site.

Following the exploit end to end

Each attempt takes tens of microseconds and succeeds almost always. Without huge pages an unprivileged process cannot see physical addresses, so this step is how the attacker gets a usable layout at all.

Why it works

• Coupled-row hammering is not a diluted version of the real thing. Bit flip locations overlap by more than 95% and error rates match within 3% → the attacker gets the same reliability and predictability as conventional hammering → so no extra attempts are needed to compensate.
• The coupling never leaves the chip. One activation command drives two wordlines inside the row decoder → latency and counted commands are indistinguishable from any unrelated row in the same bank → so defences that count accesses are counting an incomplete total by construction.
• The pair is separated by the top address bit. Tens of thousands of rows apart in physical address → the two halves land on different operating system pages at ordinary page sizes → so an attacker can own one half while the other sits in memory it could never touch.
• A puppet row makes double-sided attacks possible inside a protected region. Isolation guarantees only that disturbance cannot cross the barrier → it does not prevent a row inside from being activated → so the attacker escalates from nibbling at a border to hammering from within.
• On unprotected systems it simply doubles the target area. One access pattern now endangers victims beside both rows of a pair → more chances for the desired bit to flip in the same time → raising the final step’s success rate from 6.7% to 11.1%.

What it costs (trade-offs and scope)

• Only chips manufactured before 2020 are affected. The authors state this plainly. Coupled rows appear to come from a manufacturer-specific circuit optimisation, and their measurements find them only in older parts — so the paper functions partly as a warning against reintroducing the optimisation, and the exposed population is legacy hardware.
• The isolation attack is potential, not demonstrated. The end-to-end exploit targets a tracking defence. For the isolation case the paper explains the mechanism and proposes a fix but does not build a working cross-virtual-machine attack.
• The in-chip mitigation is not made worse. The authors reverse-engineer how it handles coupled rows and conclude it offers the same guarantee as against conventional hammering. The attack depends on the separately established fact that this mitigation can be bypassed, not on coupled rows weakening it.
• The demonstration needs error correction disabled. Only one of the tested servers permits disabling it; on the others a double-bit error shuts the machine down. That is a real constraint on where the end-to-end exploit runs.
• The attacker must do reconnaissance first. The address mapping has to be recovered by timing side channel and the coupled-row organisation determined empirically, and the pairing rule differs by memory type — a distance of one row in one mobile standard, over eight thousand in a stacked memory, and tens of thousands in the modules tested here.
• The improvement on unprotected systems is one step of many. The 1.66-fold figure applies to the hammering step’s success rate. The dominant cost of the whole attack is the page table spraying step at over twelve minutes per attempt, which coupled rows do not accelerate.

The evaluation

Check yourself

Sources

The paper is “Marionette: A RowHammer Attack via Row Coupling” by Seungmin Baek, Minbok Wi, Seonyong Park, Hwayong Nam, Michael Jaemin Kim, Nam Sung Kim and Jung Ho Ahn, published at ASPLOS 2025 Volume 1, pages 637-652, DOI 10.1145/3669940.3707242. The authors are at Seoul National University and the University of Illinois Urbana-Champaign, and the paper is licensed CC BY.

This explainer is written from the full text of the open-access ACM version. All figures above come from the paper’s own sections 4 through 10: the bit flip location overlap ratios of 95.9% to 98.1% and relative bit error rates of 0.974 to 1.000 across four memory modules, the finding that in-chip target row refresh offers the same guarantee against coupled-row activation as against conventional hammering, the identification of the most significant row address bit as the pairing rule on the tested servers with observed distances of 32,768 and 65,536 rows, the step timings and success rates of the privilege escalation exploit including the increase from 6.7% to 11.1%, the activation count gap of at least 130 thousand between useful and unwanted bit flips, and the proposed modifications to the two representative defences. The authors also state that coupled rows were found only in DRAM manufactured before 2020, and that pairing distances differ by memory type, being one row in the mobile standard and roughly eight thousand in stacked memory.