JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability

• URL: http://arxiv.org/abs/2609.01077v1
• Date: Tue, 01 Sep 2026 11:08:10 GMT
• Title: JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability
• Abstract summary: We study the impact of RowHammer countermeasures on the timing behaviour of real-time systems.<n>We introduce JENGA, an attack in which an attacker-controlled task manipulates the internal state of the RowHammer countermeasure mechanism.<n>We show that such an attack can delay tasks up to 200% of their WCET, making the initial time-safety assumptions unsafe.
• Score: 35.57593915694623
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Safety-critical real-time systems must satisfy multiple dependability requirements, notably time predictability and security. In such systems, tasks must complete within bounded and known execution times, typically characterised through Worst-Case Execution Time (WCET) analysis. At the same time, DRAM-based platforms are increasingly sensitive to the RowHammer read-disturbance security vulnerability, which has motivated the development of numerous hardware and software countermeasures in both academia and industry. However, the impact of these defences is generally evaluated in terms of average-case performance, a metric that is insufficient for safetycritical real-time systems, where worst-case behaviour is the primary concern. In this paper, we study the impact of RowHammer countermeasures based on hardware counters on the timing behaviour of real-time systems. We use a Per-Row-Activation-Counter (PRAC) countermeasure as a case study, standardised for recent DDR5 memories, and show that it can introduce significant timing variations. Based on this observation, we introduce JENGA, an attack in which an attacker-controlled task manipulates the internal state of the RowHammer countermeasure mechanism to increase the execution time of a victim real-time task beyond its expected WCET. We implement JENGA in a gem5 and Ramulator 2.0 simulation environment and evaluate its impact on TACLeBench workloads. We show that such an attack can delay tasks up to 200% of their WCET, making the initial timesafety assumptions unsafe. To address this issue, we derive a safe analytical bound that accounts for mitigation-induced delays in WCET analysis for DRAM systems protected by hardware countermeasures, such as PRAC-N.

Related papers

• RobResilience: Implementing and Evaluating a Resilience Framework for Cyber-Physical Embodied Systems [15.203157475329201]
  In embodied cyber-physical systems, active cyberattacks pose an immediate threat not just to data, but to physical integrity and human safety.<n>Existing security approaches excel at detection, but lack the runtime mechanisms to determine whether a disruption is tolerable or if performance degradation remains within safe operational bounds.<n>This paper presents RobResilience, an implementation of a formal resilience framework for embodied cyber-physical systems in a Webots simulation environment.
  arXiv  Detail & Related papers  (2026-09-15T15:49:04Z)
• REPOSE: Quantifying the Price of Security in Weakly-Hard Real-Time Cyber-Physical Systems [2.589700903743416]
  This study introduces an analytical framework -- REPOSE -- for evaluating the security feasibility of real-time control systems at runtime.<n>In contrast to imposing additional (pessimistic) design-time overhead, REPOSE performs security operations in both textitproactive and textitreactive manners.<n>Our evaluations show that REPOSE can effectively add security operations to RT-CPS with a feasibility overhead of $0.06%$ at $80%$ utilization, compared to a $ 29%$ overhead observed in systems with hard constraints.
  arXiv  Detail & Related papers  (2026-06-12T12:29:11Z)
• Federated Stream-Processing and Latency-Gated Response for Cross-Sector Threat Detection and Collaborative Containment [0.0]
  Critical infrastructure defense is bottlenecked by the operational reality that preventive controls are frequently bypassed by sophisticated supply-chain compromises and stolen administrative credentials.<n>We present a novel, high- throughput stream-processing and correlation framework designed to detect coordinated cross-sector threat campaigns and orchestrate containment at machine speed.
  arXiv  Detail & Related papers  (2026-05-17T08:32:08Z)
• Detecting Object Tracking Failure via Sequential Hypothesis Testing [80.7891291021747]
  Real-time online object tracking in videos constitutes a core task in computer vision.<n>We propose interpreting object tracking as a sequential hypothesis test, wherein evidence for or against tracking failures is gradually accumulated over time.<n>We propose both supervised and unsupervised variants by leveraging either ground-truth or solely internal tracking information.
  arXiv  Detail & Related papers  (2026-02-13T14:57:15Z)
• RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic [56.38397499463889]
  Embodied agents powered by vision-language models (VLMs) are increasingly capable of executing complex real-world tasks.<n>However, they remain vulnerable to hazardous instructions that may trigger unsafe behaviors.<n>We propose RoboSafe, a runtime safeguard for embodied agents through executable predicate-based safety logic.
  arXiv  Detail & Related papers  (2025-12-24T15:01:26Z)
• CARE: Decoding Time Safety Alignment via Rollback and Introspection Intervention [68.95008546581339]
  Existing decoding-time interventions, such as Contrastive Decoding, often force a severe trade-off between safety and response quality.<n>We propose CARE, a novel framework for decoding-time safety alignment that integrates three key components.<n>The framework achieves a superior balance of safety, quality, and efficiency, attaining a low harmful response rate and minimal disruption to the user experience.
  arXiv  Detail & Related papers  (2025-09-01T04:50:02Z)
• Enhancing Attack Resilience in Real-Time Systems through Variable Control Task Sampling Rates [2.238622204691961]
  We propose a novel schedule vulnerability analysis methodology, enabling runtime switching between valid schedules for various control task sampling rates. We present the Multi-Rate Attack-Aware Randomized Scheduling (MAARS) framework for fixed-priority schedulers, designed to reduce the success rate of timing inference attacks on real-time systems.
  arXiv  Detail & Related papers  (2024-08-01T07:25:15Z)
• Safety Margins for Reinforcement Learning [53.10194953873209]
  We show how to leverage proxy criticality metrics to generate safety margins. We evaluate our approach on learned policies from APE-X and A3C within an Atari environment.
  arXiv  Detail & Related papers  (2023-07-25T16:49:54Z)
• On Borrowed Time -- Preventing Static Side-Channel Analysis [13.896152066919036]
  adversaries exploit leakage or response behaviour of integrated circuits in a static state.<n>Members of this class include Static Power Side-Channel Analysis (SCA), Laser Logic State Imaging (LLSI) and Impedance Analysis (IA)
  arXiv  Detail & Related papers  (2023-07-18T06:36:04Z)
• Forecasting Particle Accelerator Interruptions Using Logistic LASSO Regression [62.997667081978825]
  Unforeseen particle accelerator interruptions, also known as interlocks, lead to abrupt operational changes despite being necessary safety measures. We propose a simple yet powerful binary classification model aiming to forecast such interruptions. The model is formulated as logistic regression penalized by at least absolute shrinkage and selection operator.
  arXiv  Detail & Related papers  (2023-03-15T23:11:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.