← 研踪 PaperTrailarXiv:2611.16189 · v1
SBA: A Practical Memory Performance Denial-of-Service Attack
首次提交 2026-11-12 10:25
版本更新 2026-11-12 10:25
雷达观测 2026-11-13 14:16
摘要
Modern cloud platforms use memory bandwidth regulation to isolate co-located workloads, implicitly assuming that high aggregate bandwidth consumption implies high interference. We show that this assumption is fundamentally flawed. We present the Single-Bank Attack (SBA), a practical memory denial-of-service attack that induces extreme cross-core slowdowns---over three orders of magnitude on memory-intensive victims (e.g., LLM decode)---while consuming less than 1 GB/s of memory bandwidth. SBA exploits the gap between peak and worst-case DRAM throughput by concentrating memory write operations on a single bank, forcing persistent row conflicts and frequent write draining, thereby collapsing the memory service rate. Across Intel and AMD systems, including DDR5- and HBM2E-based platforms, SBA consistently causes orders-of-magnitude slowdowns under realistic multi-tenant settings, revealing a fundamental limitation of bandwidth-centric memory isolation. We further show that this localized contention propagates system-wide: single-bank congestion saturates memory controller queues and induces back-pressure into shared cache and coherence structures, ultimately throttling memory request injection across cores. Consequently, severe interference can arise even at low aggregate bandwidth, evading existing bandwidth-based QoS mechanisms such as Intel RDT MBA. To address this limitation, we propose IQ-MemGuard, a lightweight, software-based memory bandwidth regulator that detects sustained contention using microarchitectural signals and selectively throttles pathological request injection. Our implementation on an Intel platform effectively mitigates SBA, whereas Intel's hardware QoS mechanism fails completely.
作者备注：Accepted for publication at the 3rd Microarchitecture Security Conference (uASC 2027)
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-12 10:25 · 最新观测版本
SBA: A Practical Memory Performance Denial-of-Service Attack
Modern cloud platforms use memory bandwidth regulation to isolate co-located workloads, implicitly assuming that high aggregate bandwidth consumption implies high interference. We show that this assumption is fundamentally flawed. We present the Single-Bank Attack (SBA), a practical memory denial-of-service attack that induces extreme cross-core slowdowns---over three orders of magnitude on memory-intensive victims (e.g., LLM decode)---while consuming less than 1 GB/s of memory bandwidth. SBA exploits the gap between peak and worst-case DRAM throughput by concentrating memory write operations on a single bank, forcing persistent row conflicts and frequent write draining, thereby collapsing the memory service rate. Across Intel and AMD systems, including DDR5- and HBM2E-based platforms, SBA consistently causes orders-of-magnitude slowdowns under realistic multi-tenant settings, revealing a fundamental limitation of bandwidth-centric memory isolation. We further show that this localized contention propagates system-wide: single-bank congestion saturates memory controller queues and induces back-pressure into shared cache and coherence structures, ultimately throttling memory request injection across cores. Consequently, severe interference can arise even at low aggregate bandwidth, evading existing bandwidth-based QoS mechanisms such as Intel RDT MBA. To address this limitation, we propose IQ-MemGuard, a lightweight, software-based memory bandwidth regulator that detects sustained contention using microarchitectural signals and selectively throttles pathological request injection. Our implementation on an Intel platform effectively mitigates SBA, whereas Intel's hardware QoS mechanism fails completely.
查看此版本解读 →查看此版本原文 ↗