The new Rowhammer attack paper against SK Hynix DDR5 modules is very impressive! LPE to root in over 100 seconds, or disclosing RSA keys for SSH from adjacent VM, among other vectors. If the SK Hynix brand doesn't ring a bell, some models of ADATA, G.SKILL, Corsair, Dell, Lenovo and even some Cisco OEM modules are based on Hynix chips. Finding exact list of affected OEM vendors and module modules is a bit tricky.
As part of the research effort Google has also partnered with Antmicro to build dedicated Rowhammer testing rig, which is also open-source!
github.com/antmicro/rowhamme…
Paper:
comsec.ethz.ch/research/dram…
Google blog:
security.googleblog.com/2025…
PoC:
github.com/comsec-group/phoe…
Today, we present with *Phoenix*: 🔥 two new Rowhammer patterns + ⏱️ self-correcting refresh sync + 🔨 PC bit flips on all tested SK Hynix DDR5 DIMMs. More information: comsec.ethz.ch/phoenix #Rowhammer #DDR5 #DRAM #HardwareSecurity #ETHZurich #COMSEC
Sep 16, 2025 · 8:56 AM UTC

