Rowhammer

securityprogramming

A hardware attack that flips memory bits by rapidly accessing neighboring rows.

Rowhammer exploits electrical interference in dense DRAM: hammering one row can flip bits in an adjacent row, corrupting memory and enabling privilege escalation. It blurs the line between software and hardware security.

Rowhammer is a physical attack expressed in software. Repeatedly accessing one row of memory cells at high speed can, through electrical interference, flip a bit in an adjacent row that the attacker has no permission to touch. It requires no software vulnerability at all.

The consequences are severe because a single flipped bit in the right place is enough. Researchers demonstrated privilege escalation by flipping bits in page table entries, escaping virtual machines, and defeating memory protections that were working exactly as designed. The security model assumed memory is reliable storage, and Rowhammer shows that at sufficient density it is a physical system with analogue failure modes.

Mitigations have been partial and repeatedly circumvented. Error correcting memory helps and does not eliminate it, refresh rate changes raise the cost, and targeted row refresh implementations have been shown vulnerable to newer patterns. It is a good illustration that abstractions leak downward as well as upward: software security reasoning rests on assumptions about hardware, and when the hardware stops satisfying them, no amount of correct software fixes it.

Also known as: Rowhammer

← All glossary entries