RowHammer: A Decade of Software-Induced Bit-Flips

First identified in 2014, RowHammer is a fault injection (FI) attack that exploits the architecture of dynamic random-access memory (DRAM). DRAM stores data in cells arranged in rows and columns, and these must be refreshed periodically to maintain data integrity. By rapidly accessing specific “aggressor” rows, an attacker can induce charge leakage in adjacent “victim” rows, ultimately flipping bits via software means.

This behavior violates fundamental assumptions about memory isolation and has serious implications, particularly for cloud computing environments, secure key storage, and virtualized systems. In response, memory manufacturers introduced countermeasures such as Targeted Row Refresh (TRR), which detects hammering patterns and refreshes neighboring rows proactively, and on-die error-correcting code (ECC) to address bit-flips at the hardware level.

However, RowHammer has continued to evolve. A 2022 variant known as RowHammer Blacksmith demonstrated that TRR mitigations could be bypassed using varied and unpredictable access patterns. Researchers tested 40 DDR4 modules and found them all vulnerable.

RowPress: A Quieter, Smarter Threat

In late 2023, ETH Zurich researchers introduced RowPress, a new software-based DRAM attack that builds upon RowHammer principles but uses drastically fewer memory accesses. Instead of rapidly toggling rows open and closed, RowPress keeps DRAM rows open for extended periods. This leverages the observation that prolonged activation of a row increases the risk of bit-flips in adjacent rows.

This approach is especially concerning because performance-oriented memory controllers often favor open rows to reduce latency. The attack undermines TRR protections because the access frequency is significantly lower, falling beneath detection thresholds. As with RowHammer, RowPress does not require physical access or hardware modification, making it a realistic threat vector once the attack conditions are met.

Known RowHammer Variants: A Timeline of Escalation

The term “RowHammer” generally refers to repeatedly activating (i.e., “hammering”) DRAM rows in a rapid sequence to induce electrical interference and flip bits in nearby “victim” rows. Over time, researchers have uncovered a range of variants:

Single-Sided Hammering

• Hammers one row repeatedly to flip bits in an adjacent row
• Demonstrated in early research and served as an initial proof-of-concept
• Generally less effective than other techniques

(source)

Double-Sided Hammering

• Activates two rows adjacent to a target row, greatly increasing bit-flip probability
• Yields higher disturbance error rates

(source)

Many-Sided / Frequency-Based Patterns (Blacksmith)

• Involves hammering multiple aggressor rows with varied frequency, phase, and amplitude
• Blacksmith is a fuzzing tool that systematically finds such patterns, defeating TRR

(source)

Rowhammer.js (JavaScript Exploit)

• Demonstrates that RowHammer can be triggered from a web browser using JavaScript
• Works without special CPU instructions like clflush

(source)

DRAMMER (Android Exploit)

• Achieves root privilege escalation on Android devices using RowHammer
• Highlights difficulties in securing mobile devices with constrained resources

(source)

TRRespass

• Introduced in 2020, bypasses TRR protections in DDR4 using many-sided hammering
• Demonstrates that built-in DRAM defenses are insufficient without pattern-aware analysis

(source)

Half-Double Attack

• Exploits long-range coupling effects, allowing bit-flips from rows two steps away
• Reported by Google in 2021 as DRAM density increased

(source)

ZenHammer / DDR5 Exploits

• Targets AMD Zen systems and demonstrates RowHammer feasibility on DDR5

(source)

RISC-H (RISC-V Platform)

• First known RowHammer attack targeting RISC-V CPUs, underscoring its cross-platform threat

(source)

The key takeaway—blocking a single instruction (like clflush) or simply refreshing memory more often is not sufficient. Modern attacks rely on nuanced physical effects and creative access patterns to defeat hardware-based protections.

How Practical Are These Attacks?

Because the attacks are software-based and require no physical tampering, they remain a top concern for:

• Cloud service providers
• Virtualized environments
• Secure enclave implementations
• Mobile devices

However, executing an attack still requires bypassing caching, resolving memory mappings, and carefully aligning rows—barriers that require significant reverse engineering. Once bypassed, though, these attacks are reproducible and potentially scalable.

Common Risk Mitigation Strategies

Hardware and System Configuration

• Use DRAM with verified TRR and ECC support, ensuring those protections can’t be disabled in production
• Favor configurations that isolate sensitive processes from untrusted code (e.g., tenant isolation in cloud infrastructure)

Operating System Protections

• Disable /dev/mem and restrict /proc/PID/pagemap access on Linux
• Prevent allocation of non-cacheable memory and disallow cache flush instructions in unprivileged processes

Memory Refresh Policies

• Increase DRAM refresh rates if possible via BIOS—only if the attacker cannot also control those settings

Independent Verification

• Countermeasures must be externally validated. Reliance on assumptions without verification often results in ineffective defenses, as shown by TRR's bypasses.

The RowHammer family of attacks continues to challenge the assumptions underlying modern computing. As systems grow more complex and DRAM becomes denser, new attack surfaces emerge.

Dive deeper in our webinar “RowHammer Attacks and Mitigations”, and gain insights into the current best practices for risk mitigation. Learn how to adapt to emerging RowHammer threats and test your solutions. Register to attend the webinar using this link.

Related Posts