  DRAM read disturbance is a significant and worsening safety, security, and
reliability issue of modern DRAM chips that can be exploited to break memory
isolation. Two prominent examples of read-disturb phenomena are RowHammer and
RowPress. However, no prior work extensively studies read-disturb phenomena in
modern high-bandwidth memory (HBM) chips. In this work, we experimentally
demonstrate the effects of read disturbance and uncover the inner workings of
undocumented in-DRAM read disturbance mitigation mechanisms in HBM.
  Our characterization of six real HBM2 DRAM chips shows that (1) the number of
read disturbance bitflips and the number of row activations needed to induce
the first read disturbance bitflip significantly varies between different HBM2
chips and different 3D-stacked channels, pseudo channels, banks, and rows
inside an HBM2 chip. (2) The DRAM rows at the end and in the middle of a DRAM
bank exhibit significantly fewer read disturbance bitflips than the rest of the
rows. (3) It takes fewer additional activations to induce more read disturbance
bitflips in a DRAM row if the row exhibits the first bitflip already at a
relatively high activation count. (4) HBM2 chips exhibit read disturbance
bitflips with only two row activations when rows are kept active for an
extremely long time.
  We show that a modern HBM2 DRAM chip implements undocumented read disturbance
defenses that can track potential aggressor rows based on how many times they
are activated, and refresh their victim rows with every 17 periodic refresh
operations. We draw key takeaways from our observations and discuss their
implications for future read disturbance attacks and defenses. We explain how
our findings could be leveraged to develop both i) more powerful read
disturbance attacks and ii) more efficient read disturbance defense mechanisms.
