New Phoenix Rowhammer Attack Bypasses DDR5 Chip Protections

A new variation of the Rowhammer attack, dubbed Phoenix, can bypass built-in DDR5 protections and compromise DRAM modules from the world’s largest memory maker, SK Hynix. Researchers reverse‑engineered the in‑DRAM protections and found blind spots that let them flip bits despite advanced safeguards, with fifteen SK Hynix DIMMs tested from 2021 to 2024 showing vulnerability to carefully designed hammering patterns.

SK Hynix added Target Row Refresh to mitigate Rowhammer by refreshing heavily used rows, but the researchers’ FPGA‑based tests revealed that the protection repeats every 128 refresh intervals, eight times longer than existing attacks assumed, creating entry points in the first and last 64 intervals.

They built two new hammering patterns—the shorter one spanning 128 refresh intervals and the longer one spanning 2,608 intervals—and, with a self‑correcting sync, achieved reliable hammering across thousands of intervals. In public demonstrations, Phoenix produced full root access in as little as 109 seconds on a default PC setup and allowed manipulation of page‑table entries to read/write arbitrary memory on every tested DDR5 module.

The study also found that most DIMMs (73 per cent) exposed RSA‑2048 keys in co‑located VMs, and a third allowed overwriting the sudo binary to escalate privileges, with exploitation times averaging just over five minutes.