  We experimentally demonstrate the effects of read disturbance (RowHammer and
RowPress) and uncover the inner workings of undocumented read disturbance
defense mechanisms in High Bandwidth Memory (HBM). Detailed characterization of
six real HBM2 DRAM chips in two different FPGA boards shows that (1) the read
disturbance vulnerability significantly varies between different HBM2 chips and
between different components (e.g., 3D-stacked channels) inside a chip, (2)
DRAM rows at the end and in the middle of a bank are more resilient to read
disturbance, (3) fewer additional activations are sufficient to induce more
read disturbance bitflips in a DRAM row if the row exhibits the first bitflip
at a relatively high activation count, (4) a modern HBM2 chip implements
undocumented read disturbance defenses that track potential aggressor rows
based on how many times they are activated. We describe how our findings could
be leveraged to develop more powerful read disturbance attacks and more
efficient defense mechanisms. We open source all our code and data to
facilitate future research at
https://github.com/CMU-SAFARI/HBM-Read-Disturbance.
