Phoenix (CVE-2025-6202): A New Rowhammer Attack Bypasses DDR5 Protections

Phoenix (CVE-2025-6202) is a new Rowhammer attack that bypasses in-DRAM mitigations on DDR5, with researchers reporting that it affects all tested SK Hynix DDR5 devices and can lead to memory corruption and privilege escalation. According to ETH Zurich, the team reverse-engineered SK Hynix’s Target Row Refresh protections and found blind spots where certain refresh intervals are not sampled, enabling two novel Rowhammer patterns.

The shorter pattern uses 128 tREFI intervals and proved 2.62x more effective, producing thousands of bit flips, while the longer pattern uses 2608 tREFI intervals to cover more refresh intervals. The researchers claim that the two patterns together bypass the mitigations of all 15 SK Hynix DDR5 devices in their test pool, and they introduced a self-correcting refresh synchronization method to align hammering with DRAM refresh cycles.

They demonstrated real-world weaponisation, including a Rowhammer privilege escalation exploit running in default PC settings in as little as 109 seconds, with exploits such as Page Table Entry corruption, RSA-2048 key extraction from co-located VMs, and sudo binary modification enabling root privileges in minutes. Phoenix was disclosed to SK Hynix and vendors in June 2025 and is tracked as CVE-2025-6202.