# SoftTRR: Protect Page Tables Against RowHammer Attacks using Software-only Target Row Refresh

**Authors:** Zhi Zhang, Yueqiang Cheng, Minghua Wang, Wei He, Wenhao Wang, Nepal Surya, Yansong Gao, Kang Li, Zhe Wang, Chenggang Wu  
**arXiv:** [2102.10269](https://arxiv.org/abs/2102.10269)  
**Date:** 2021-02-20  
**Summary page:** https://www.summarizepaper.com/en/paper/2102.10269v1/

## Key points

- The paper addresses the issue of rowhammer attacks on level-1 page tables
- Existing software-only mitigations are not effective against these attacks
- SoftTRR is a software-only defense mechanism proposed by the authors
- SoftTRR refreshes rows occupied by page tables when suspicious rowhammer activity is detected
- SoftTRR overcomes limitations of ChipTRR, which can be bypassed by many-sided hammer attacks
- SoftTRR protects an unlimited number of page tables by monitoring memory accesses to nearby rows
- When access count exceeds a threshold, SoftTRR initiates a refresh for corresponding page-table rows
- Experimental results show that SoftTRR successfully safeguards page tables with minimal overhead and memory cost
- SoftTRR presents itself as a promising defense mechanism for protecting critical system components like level-1 page tables from unauthorized access and manipulation

## Summary

In this paper titled "SoftTRR: Protect Page Tables Against RowHammer Attacks using Software-only Target Row Refresh," the authors address the issue of rowhammer attacks that corrupt level-1 page tables to gain kernel privilege, which is highly detrimental to system security and difficult to mitigate. They highlight that existing software-only mitigations are not effective against these types of kernel privilege escalation attacks. To tackle this problem, the authors propose an effective and practical software-only defense mechanism called SoftTRR. The key idea behind SoftTRR is to refresh the rows occupied by page tables whenever a suspicious rowhammer activity is detected. This approach is inspired by DRAM-chip-based target row refresh (ChipTRR), but SoftTRR overcomes ChipTRR's main security limitation, which is its ability to track only a limited number of rows and can be bypassed by many-sided hammer attacks. SoftTRR protects an unlimited number of page tables by monitoring memory accesses to the rows that are in close proximity to page-table rows. Once the tracked access count exceeds a pre-defined threshold, SoftTRR initiates a refresh for the corresponding page-table rows. To evaluate its effectiveness, performance overhead, and memory consumption, the authors implement a prototype of SoftTRR as a loadable kernel module. Experimental results demonstrate that SoftTRR successfully safeguards page tables from real-world rowhammer attacks while incurring minimal performance overhead and memory cost. By effectively countering rowhammer attacks on x86 systems, SoftTRR presents itself as a promising defense mechanism for protecting critical system components such as level-1 page tables from unauthorized access and manipulation. Overall, this research contributes significantly to enhancing system security by proposing an innovative software-only defense strategy that effectively mitigates rowhammer attacks on page tables.