Phoenix RowHammer Attack Bypasses Advanced DDR5 Memory Protections in 109 Seconds

According to ETH Zürich and Google, a new RowHammer variant named Phoenix targets SK Hynix DDR5 memory and can bypass advanced protections designed to resist RowHammer. The attack is linked to CVE-2025-6202, with a CVSS score of 7.1, and researchers claim it enables a RowHammer privilege escalation on a standard DDR5 desktop system with default settings.

They say the exploit can reliably trigger bit flips across 15 DDR5 chips in a test pool produced between 2021 and 2024, leading to root access in as little as 109 seconds. The work also demonstrates that on-die ECC does not stop RowHammer, and that traditional mitigations such as TRR and ECC fail against more sophisticated variants. Mitigations suggested include increasing the refresh rate to three times, as tested by the researchers, though DRAM devices in the wild cannot be updated easily.

The findings underscore that defenses against RowHammer on DDR5 are not yet sufficient, and the secretive methods required to bypass protections raise concerns about future privilege-escalation exploits on consumer systems. Phoenix is described as the first-ever RowHammer privilege escalation on a production-grade DDR5 system, reinforcing the need for ongoing hardware-aware security research.