Rowhammer Attack Demonstrated Against DDR5

Researchers from ETH Zurich and Google have demonstrated a practical Rowhammer attack against DDR5, named Phoenix, which can achieve root on a commodity DDR5 system with default settings. The attack is tracked as CVE-2025-6202 and was shown to be effective on 15 DDR5 DIMMs from SK Hynix, the largest DRAM manufacturer.

Phoenix bypasses in-DRAM protections by precisely tracking thousands of refresh operations and resynchronising the pattern when misses are detected, enabling a privilege escalation exploit in as little as 109 seconds. The researchers note that DDR5 devices from other manufacturers should not be considered protected, and increasing the refresh rate tripling the protection incurs an 8.4% performance overhead.

Phoenix was disclosed to SK Hynix, CPU vendors, and major cloud providers in early June, and last week AMD released BIOS updates to address CVE-2025-6202 in client machines. The work highlights that despite TRR measures, DDR5 remains vulnerable to Rowhammer attacks and that more robust mitigations such as per-row activation counters may be required to prevent such exploits.