Citadel: Rethinking Memory Allocation to Safeguard Against Inter-Domain Rowhammer Exploits

Rowhammer is a hardware security vulnerability at the heart of every DRAM-based memory system.Despite its discovery a decade ago, comprehensive defenses in current systems remain elusive, while the probability of successful attacks grows with DRAM density.Hardware-based defenses have proven ineffective due to substantial cost, delays in commercial adoption, and repeated circumventions by attackers, while more flexible software-based solutions incur major performance and memory capacity overheads or offer only limited protection.Citadel is a new memory allocator design that prevents Rowhammer-initiated security exploits by addressing the vulnerability's root cause: physical adjacency of DRAM rows.It introduces flexible security domains and isolates them in physically disjoint memory regions, guaranteeing security by design.On a server system, Citadel supports thousands of security domains at a modest 7.2% average memory overhead and no performance loss, while remaining readily deployable across legacy, contemporary, and future platforms.In contrast, recent domain isolation schemes fail to support many workload scenarios due to excessive overhead and incur 4-6× higher overhead for supported scenarios.