AzureFeeds

As memory becomes central to cloud and AI infrastructure, so is the need to protect against memory-based vulnerabilities and attacks at cloud scale. With Azure Cobalt 200, Microsoft’s second-generation Arm-based compute processor, we took the opportunity to re-think how to deliver advanced memory security defenses through deep hardware-software codesign, leveraging all parts of the system design, including silicon, platform, firmware and telemetry.

Rowhammer and the Need for End-to-End Memory Security

Hardware security vulnerabilities raise unique challenges to a hyperscaler. Unlike software, hardware vulnerabilities cannot be patched. Since hyperscalers deploy the same hardware design at massive scale, a single vulnerability affects a huge portion of cloud infrastructure.

Rowhammer has been one of the most persistent hardware security vulnerabilities of the last decade. At its core, the problem is deceptively simple: a high rate of accesses to the same address in DRAM flips bits in data stored in nearby addresses. With Rowhammer, an attacker can corrupt memory outside their control, potentially undermining isolation mechanisms relied upon by cloud software. Even worse, Rowhammer could be leveraged as an attack vector by nation-state attack adversaries.

For years, the industry has relied on proprietary DRAM mitigations that are approximate and do not eliminate all forms of Rowhammer attacks. These mitigations cannot be fully inspected, reasoned about, or tuned. This creates a form of security by obscurity, where a defense’s effectiveness depends in part on hardware vendors not disclosing how it works.

With Azure Cobalt, Microsoft has an opportunity to re-think how to deliver advanced memory security defenses by leveraging all parts of the system design, from silicon to platform to firmware and telemetry.

With Cobalt 200, Microsoft is using its custom cloud silicon to help address a low-level memory security challenge that is becoming more important as AI infrastructure scales, and doing it in a way that helps protect customer workloads without imposing the usual performance penalty.

Selim Bilgin, Corporate Vice President, Silicon Engineering

Advanced Rowhammer Protection in Azure Cobalt 200

For the past few years, Microsoft has helped lead the industry response to Rowhammer: making the risk concrete, driving standards discussions, and developing new mechanisms that give cloud providers better visibility, control, and defenses against memory-based attacks.

With Azure Cobalt 200, Microsoft built Rowhammer protection directly into the SoC’s memory controller. The goal was not simply to add another mitigation, but to design one that meets the operational requirements of a cloud platform. We ended up with a new, hybrid-based design that did not show measurable performance overhead in internal testing of commodity workloads, when the system is not under attack. The security guarantees provided can be tuned and configured for various memory configurations and DRAM media quality.

We have described in depth the workings of this new Rowhammer protection in our research paper published at the International Symposium on Computer Architecture (ISCA) 2026 Industry Track. Our paper covers the design, implementation, software verification, configuration, related work, and evaluation of our new feature. To our knowledge, this is one of the more detailed publicly available descriptions of a production-oriented Rowhammer defense to date, based on our review of the literature. ISCA is widely regarded as a leading conference in computer architecture research. This work builds on multi-year research efforts within Microsoft Research on understanding and mitigating Rowhammer at cloud scale.

A New Hybrid-based Approach

During normal operation, the memory controller tracks frequently activated rows using small, efficient counter tables. These tables are intentionally lightweight: they are sized to minimize performance impact in common operating conditions. If the hardware detects that a portion of memory is seeing behavior that may overwhelm this lightweight tracking, only that portion transitions to a heavier form of protection.

This distinction is important. A pure tracking design can become too expensive in hardware if it tries to account for every possible worst-case pattern. In contrast, a heavier protection imposes constant overhead even when nothing malicious is happening. The hybrid design combines the best of both worlds. It keeps the common case fast, while still providing a fallback path for adversarial behavior.

At Azure scale, security features must be both strong and economical. A protection that creates overhead for every workload, all the time, is hard to justify in production.

Pat Stemen, Vice President, Azure Cobalt

The graph below shows the DRAM bandwidth overhead of our defense under two Rowhammer attacks: one that targets a small number of DRAM regions and can be handled by light mode, and a more aggressive attack that targets the entire system. In internal evaluations, bandwidth overhead remained below 8% for the targeted test scenarios, and below 23% for more intensive simulated attack scenarios. In the normal case, when the system is not under attack, no additional DRAM bandwidth usage was observed.

The defense also operates at fine granularity. Instead of forcing an entire memory bank or controller into a heavier mode, the transition happens independently for smaller regions. That means a suspicious access pattern in one region does not unnecessarily penalize unrelated traffic elsewhere. This is one of the practical design choices that makes the approach suitable for production hardware rather than only research evaluation.

An Unexpected Design Constraint: Telemetry and Confidential Computing

A surprising challenge we encountered was not in the Rowhammer mitigation itself, but in how to operate it at cloud scale.

Azure relies on telemetry to run services with high reliability and security across its fleet. This operational visibility helps us detect anomalies, understand emerging risks, and maintain the trusted, resilient platform customers expect from Azure. For a Rowhammer defense, we initially expected detailed telemetry about protection events and affected memory regions to be useful for fleet operations.

However, confidential computing guarantees introduce an important constraint: telemetry is designed to avoid exposing information about customer workloads or memory access patterns. As a result, we had to carefully balance operational visibility with privacy guarantees.

In practice, the Cobalt 200 Rowhammer defense uses a more constrained telemetry approach than we first expected. This gives us enough visibility to detect unusual fleet-wide behavior while aligning with the principles of confidentiality computing environments.

The experience highlights a broader lesson from building security features for Azure. Effective security is not only about detecting and mitigating threats. It is also about ensuring that the operational tooling around those protections respects the same privacy and security guarantees that customers rely on. This approach is enabled by Microsoft’s ability to design and operate across the full stack, from silicon and firmware to cloud services and fleet operations.

Looking Forward

Rowhammer is not a static problem. DRAM technology continues to evolve, and new disturbance mechanisms continue to appear. Standards-based mitigations such as Per-Row Activation Counting (PRAC) are an important direction for the industry, but adoption takes time, and early implementations may exhibit bugs. By building a configurable Rowhammer defense into Cobalt 200, Microsoft gains an additional layer of protection, an independent telemetry signal, and a way to help manage risk as DRAM devices and attacks continue to change.

The broader lesson is that Rowhammer defenses can and should move beyond opaqueness and toward mechanisms that can be understood, reasoned about, and not rely on security by obscurity. Cobalt 200’s Rowhammer defense reflects this philosophy.