REFault: A Fault Injection Platform for Rowhammer Research on DDR5 Memory

DDR5 is showing increased resistance to Rowhammer attacks compared to previous generations. The minimum hammer count (HCmin) is a metric to assess the susceptibility of the DRAM substrate to Rowhammer. Due to the lack of a generic platform that allows disabling refresh commands, there is currently no way to determine the HCmin of DDR5 UDIMMs. We address this gap with REFault, a low-cost fault injection system that allows altering DDR5 commands on-the-fly. REFault is made from a configurable DRAM fault injection interposer and a custom-designed injection controller. We leverage REFault to temporarily disable refresh commands on a commodity system, and determine, for the first time, the HC min of two DDR5 devices from major DRAM manufacturers. We show that the HC min is as low as 16 k activations, which has not improved compared to DDR4 devices. We conclude that the increased resistance to Rowhammer in DDR5 devices comes from improved mitigations rather than the DRAM substrate itself.