CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

Phoenix Rowhammer attack bypasses DDR5 Rowhammer defenses

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

A new Rowhammer attack variant, Phoenix, bypasses DDR5 Rowhammer defenses in SK Hynix memory chips. The attack exploits weaknesses in Target Row Refresh (TRR) mechanisms to flip bits, enabling privilege escalation, arbitrary memory access, and SSH authentication bypass. The vulnerability, tracked as CVE-2025-6202, affects all DDR5 DIMM RAM modules produced between January 2021 and December 2024. The attack works by exploiting specific refresh intervals not sampled by TRR and synchronizing with refresh operations to flip bits. Researchers demonstrated successful exploitation in under two minutes, achieving root-level access on tested systems. The vulnerability is industry-wide and cannot be corrected for existing memory modules. Mitigation involves tripling the DRAM refresh interval, which may cause system instability.

Timeline

  1. 15.09.2025 21:01 📰 1 articles · ⏱ 2h ago

    Phoenix Rowhammer attack bypasses DDR5 Rowhammer defenses

    Researchers at ETH Zurich University and Google developed the Phoenix Rowhammer attack, which bypasses DDR5 Rowhammer defenses in SK Hynix memory chips. The attack exploits weaknesses in TRR mechanisms to flip bits, enabling privilege escalation, arbitrary memory access, and SSH authentication bypass. The vulnerability affects all DDR5 DIMM RAM modules produced between January 2021 and December 2024. Researchers demonstrated successful exploitation in under two minutes, achieving root-level access on tested systems.

    Show sources
    Open in new tab

Information Snippets