There is a fairly new and exploitable bug happening in some DDR3 DRAMs called the "row hammer" in which it's possible to bit flip memory cells. I understand how the exploit works, but not the electrical problem that generates it. On Wikipedia and some other sources, it's mentioned that capacitors shouldn't be too close together because they interfere with each other. How is that? As far as I'm aware, a capacitor doesn't generate magnetic force such as the known problem of charges in magnetic disks. I thought maybe if they're too close a current can appear and make them act as if connected, but that's a shaky guess. Fact is I don't see the problem clearly.

Thanks in advance.

  • \$\begingroup\$ Adjacent cell crosstalk may be a combination of supply/ground shift, and coupled charge transfer to the closest cells that increases in level with slew rate of the voltage. (Ic=CdV/dt) for weak coupling capacitance that if it opposes the trapped charge of nearby cells sufficiently can alter the logic level. MEMTEST86 has a large suite of tests to verify RAM faults from a boot disk, such as this. UltraLow ESR distributed caps have been known to experience resonance and degrade voltage ripple suppression \$\endgroup\$ – Tony Stewart Sunnyskyguy EE75 Feb 26 '17 at 3:04
  • \$\begingroup\$ Murata has shown this potential flaw with one ceramic family that raises ESR intentionally to avoid this high Q 2nd order characteristic at self resonant frequencies. \$\endgroup\$ – Tony Stewart Sunnyskyguy EE75 Feb 26 '17 at 3:07

Its not the data storage capacitors interfering. The problem is capacitive coupling between the row select lines. When you read a DRAM row, you drive the appropriate row select line high, which turns on all of the transistors in that row, which dump their charge into the column lines. This is OK, because you then amplify the signal and drive the column lines, refreshing the capacitors.

The problem exploited by rowhammer is that each row select line capacitively couples to the adjacent row select lines, and turns their transistors very slightly on. Each time that happens, a tiny fraction of the charge stored in the capacitors leaks out through the slightly "on" transistor. If you do it enough times before a refresh, the row will lose its data.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.