  RowHammer is a DRAM vulnerability that can cause bit errors in a victim DRAM
row solely by accessing its neighboring DRAM rows at a high-enough rate. Recent
studies demonstrate that new DRAM devices are becoming increasingly vulnerable
to RowHammer, and many works demonstrate system-level attacks for privilege
escalation or information leakage. In this work, we perform the first rigorous
fine-grained characterization and analysis of the correlation between RowHammer
and temperature. We show that RowHammer is very sensitive to temperature
variations, even if the variations are very small (e.g., $\pm 1$ {\deg}C). We
leverage two key observations from our analysis to spy on DRAM temperature: 1)
RowHammer-induced bit error rate consistently increases (or decreases) as the
temperature increases, and 2) some DRAM cells that are vulnerable to RowHammer
exhibit bit errors only at a particular temperature. Based on these
observations, we propose a new RowHammer attack, called SpyHammer, that spies
on the temperature of DRAM on critical systems such as industrial production
lines, vehicles, and medical systems. SpyHammer is the first practical attack
that can spy on DRAM temperature. Our evaluation in a controlled environment
shows that SpyHammer can infer the temperature of the victim DRAM modules with
an error of less than $\pm 2.5$ {\deg}C at the 90th percentile of all tested
temperatures, for 12 real DRAM modules (120 DRAM chips) from four main
manufacturers.
