Ruh-roh. DDR5 memory vulnerable to new Rowhammer attack
(2025/09/17)
- Reference: 1758086108
- News link: https://www.theregister.co.uk/2025/09/17/ddr5_dram_rowhammer/
- Source link:
Researchers from Google and Swiss university ETH Zurich have found a new class of Rowhammer vulnerability that could allow attackers to access info stored in DDR5 memory.
As Google explains in its [1]post on the discovery, DRAM stores data as electrical charges in small “cells” of memory. Those charges leak over time, corrupting data. Computer scientists have known this for ages, and the controllers that manage memory therefore periodically refresh cells to ensure memory remains reliable.
Infosec types with friendly and/or adversarial inclinations noticed that behavior and wondered what would happen if they repeatedly accessed specific rows of memory cells. They learned that by “hammering” those rows of cells with many access requests it’s possible to corrupt data in adjacent cells, degrade system performance, or even achieve privilege escalation.
[2]
Rowhammer is a known problem and infosec researchers long ago developed defenses that system builders and memory-makers adopted. Last year, standards body the JEDEC Solid State Technology Association introduced a new DRAM data integrity measure called Per-Row Activation Counting (PRAC) that looks for the sort of activity involved in a Rowhammer attack and pauses traffic to stymie hostile action.
[3]
[4]
Google’s researchers, however, assert that systems that include DDR5 have not employed PRAC. The web giant also created a pair of tools to test DDR5 modules for susceptibility to Rowhammer.
[5]Spectre haunts CPUs again: VMSCAPE vulnerability leaks cloud secrets
[6]ZenHammer comes down on AMD Zen 2 and 3 systems
[7]Hot fuzz: Cascade finds dozens of RISC-V chip bugs using random data storm
[8]Nearly every AMD CPU since 2017 vulnerable to Inception data-leak attacks
Researchers at ETH Zurich put those tools to work and [9]found a new form of Rowhammer attack that works on DDR5 from SK Hynix, the world’s largest memory-maker.
The attack, called “Phoenix”, isn’t simple and is computationally expensive. But it works.
And that’s worrying because the [10]paper [PDF] that describes the joint Google/ETH research opens by observing “DDR5 has shown an increased resistance to Rowhammer attacks in production settings. Surprisingly, DDR5 achieves this without additional refresh management commands.”
[11]
Google and ETH Zurich found their Rowhammer variant using a machine powered by an AMD Zen 4 processor and SK Hynix DDR5 and will attempt to replicate their work on memory and CPUs from other vendors.
If the researchers succeed it’s not a disgrace for impacted manufacturers because Rowhammer-style attacks are hard to defeat, with recent victims including [12]Nvidia , [13]DDR4 and everyone’s privacy thanks to a Rowhammer [14]variant that makes it possible to fingerprint computing devices.
The attack discovered by Google and ETH Zurich is now known as [15]CVE-2025-6202 and earned a 7.1 CVSS rating.
[16]
ETH Zurich says it conducted responsible disclosure of Phoenix that saw it inform SK Hynix, CPU vendors, and major cloud providers on June 6, 2025. AMD told the researchers it made a BIOS update to protect systems that use its processors. More information, including the source code for all the experiments and the exploit, can be found [17]here . ®
Get our [18]Tech Resources
[1] https://security.googleblog.com/2025/09/supporting-rowhammer-research-to.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/09/11/vmscape_spectre_vulnerability/
[6] https://www.theregister.com/2024/03/25/zenhammer_comes_down_on_amd/
[7] https://www.theregister.com/2023/10/24/cascade_fuzzer_zurich/
[8] https://www.theregister.com/2023/08/09/amd_inception/
[9] https://comsec.ethz.ch/research/dram/phoenix/
[10] https://comsec-files.ethz.ch/papers/phoenix_sp26.pdf
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2025/07/13/infosec_in_brief/
[13] https://www.theregister.com/2024/03/25/zenhammer_comes_down_on_amd/
[14] https://www.theregister.com/2023/07/05/rowhammer_memory_identification/
[15] https://nvd.nist.gov/vuln/detail/CVE-2025-6202
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://github.com/comsec-group/phoenix
[18] https://whitepapers.theregister.com/
As Google explains in its [1]post on the discovery, DRAM stores data as electrical charges in small “cells” of memory. Those charges leak over time, corrupting data. Computer scientists have known this for ages, and the controllers that manage memory therefore periodically refresh cells to ensure memory remains reliable.
Infosec types with friendly and/or adversarial inclinations noticed that behavior and wondered what would happen if they repeatedly accessed specific rows of memory cells. They learned that by “hammering” those rows of cells with many access requests it’s possible to corrupt data in adjacent cells, degrade system performance, or even achieve privilege escalation.
[2]
Rowhammer is a known problem and infosec researchers long ago developed defenses that system builders and memory-makers adopted. Last year, standards body the JEDEC Solid State Technology Association introduced a new DRAM data integrity measure called Per-Row Activation Counting (PRAC) that looks for the sort of activity involved in a Rowhammer attack and pauses traffic to stymie hostile action.
[3]
[4]
Google’s researchers, however, assert that systems that include DDR5 have not employed PRAC. The web giant also created a pair of tools to test DDR5 modules for susceptibility to Rowhammer.
[5]Spectre haunts CPUs again: VMSCAPE vulnerability leaks cloud secrets
[6]ZenHammer comes down on AMD Zen 2 and 3 systems
[7]Hot fuzz: Cascade finds dozens of RISC-V chip bugs using random data storm
[8]Nearly every AMD CPU since 2017 vulnerable to Inception data-leak attacks
Researchers at ETH Zurich put those tools to work and [9]found a new form of Rowhammer attack that works on DDR5 from SK Hynix, the world’s largest memory-maker.
The attack, called “Phoenix”, isn’t simple and is computationally expensive. But it works.
And that’s worrying because the [10]paper [PDF] that describes the joint Google/ETH research opens by observing “DDR5 has shown an increased resistance to Rowhammer attacks in production settings. Surprisingly, DDR5 achieves this without additional refresh management commands.”
[11]
Google and ETH Zurich found their Rowhammer variant using a machine powered by an AMD Zen 4 processor and SK Hynix DDR5 and will attempt to replicate their work on memory and CPUs from other vendors.
If the researchers succeed it’s not a disgrace for impacted manufacturers because Rowhammer-style attacks are hard to defeat, with recent victims including [12]Nvidia , [13]DDR4 and everyone’s privacy thanks to a Rowhammer [14]variant that makes it possible to fingerprint computing devices.
The attack discovered by Google and ETH Zurich is now known as [15]CVE-2025-6202 and earned a 7.1 CVSS rating.
[16]
ETH Zurich says it conducted responsible disclosure of Phoenix that saw it inform SK Hynix, CPU vendors, and major cloud providers on June 6, 2025. AMD told the researchers it made a BIOS update to protect systems that use its processors. More information, including the source code for all the experiments and the exploit, can be found [17]here . ®
Get our [18]Tech Resources
[1] https://security.googleblog.com/2025/09/supporting-rowhammer-research-to.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/09/11/vmscape_spectre_vulnerability/
[6] https://www.theregister.com/2024/03/25/zenhammer_comes_down_on_amd/
[7] https://www.theregister.com/2023/10/24/cascade_fuzzer_zurich/
[8] https://www.theregister.com/2023/08/09/amd_inception/
[9] https://comsec.ethz.ch/research/dram/phoenix/
[10] https://comsec-files.ethz.ch/papers/phoenix_sp26.pdf
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2025/07/13/infosec_in_brief/
[13] https://www.theregister.com/2024/03/25/zenhammer_comes_down_on_amd/
[14] https://www.theregister.com/2023/07/05/rowhammer_memory_identification/
[15] https://nvd.nist.gov/vuln/detail/CVE-2025-6202
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aMqGuWaeLneKnntZzk3NLgAAAwI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://github.com/comsec-group/phoenix
[18] https://whitepapers.theregister.com/
Re: Ah, the memories...
that one in the corner
Ok, I'll bite - who, aside from you, uses/used the phrase "alpha particle degeneration" (your comment was a Googlewhack - well, Duckduckwhack - for the phrase)?
And, aside from a bit of hyperbole (using "degeneration" implies something permanent or long-lasting, so one would think it referred to the physical structure of the memory degenerating, not just the stored charge, as we expect the charge to be a fleeting thing that'll be deliberately changing at a pace) what is inaccurate or misleading about that phrase to warrant using "so called"? Especially when you link to an article that actually describes how alpha particles from packaging cause data errors.
> marketing soon overcame the will of the greybeards
Marketing? Not Finance, looking at the BOM costs? Did Marketing really care about making sure the User knew you were using cheaper DRAM?
Yours, etc, Mr Grumpy-hasn't-his-cofee-yet
Ah, the memories...
... I have "fond" (for the most negative connotations of that word) memories of RAM issues back in the late '70s, from so-called " [1]alpha particle degeneration ."
I remember back then there being a strong push towards static RAM for critical implementations, but marketing soon overcame the will of the greybeards.
[1] https://en.m.wikipedia.org/wiki/Soft_error