SPOILER

SPOILER：推测加载风险提升 Rowhammer 和缓存攻击 CVE-2019-0162 INTEL-SA-00238 https://www.usenix.org/system/files/sec19-islam.pdf @inproceedings 236252, author = Saad Islam and Ahmad Moghimi and Ida Bruhns and Moritz Krebbel and Berk Gulmezoglu and Thomas Eisenbarth and Berk Sunar, title = SPOILER: Speculative...

prism

灌铅骰子：解决可扩展概率性 RowHammer 防御中的非选择问题 将发表于 2026 年第 53 届国际计算机体系结构研讨会（ISCA）。 Jeonghyun Woo1, Junsu Kim1, Aamer Jaleel2, Prashant J. Nair1 1 不列颠哥伦比亚大学 2 NVIDIA 同等贡献 论文 PDF | arXiv 摘要 DRAM 的持续微缩加剧了 RowHammer 漏洞。为此，JEDEC 最近引入了按行激活计数（Per Row Activation Counting, PRAC）及 Alert Back-Off 协议，作为 DDR5...

RAMnesia-Attack

本研究对使用DDR5内存的现代计算机系统的硬件内存上的两类关键攻击进行了全面分析： Phoenix Rowhammer攻击（CVE-2025-6202） 和 RAMnesia攻击（CVE-2023-39910） 。这两种攻击都展示了加密材料处理与存储中的基本漏洞，为恢复比特币钱包私钥创造了前所未有的利用途径。该研究整合了对可信执行环境（TEE）攻击的分析结果，包括Intel SGX、AMD SEV-SNP和NVIDIA Confidential...

RowHammer-Exploit

RowHammer-Exploit 基于 RowHammer 的漏洞利用（使用 rowhammer 对 syssuid 植入后门） 仍需完善……查明为何无法正常运行…… Current stage... Denial fails with the following stack trace... UG: unable to handle kernel paging request at 0000000100000000 PGD 8000000006de3067 P4D 8000000006de3067 PUD 0 Oops: 0010 1 PTI CPU: 0 PID: 63 Comm:...

Phoenix-Rowhammer-Attack-CVE-2025-6202

Este artículo examina las amenazas sistémicas a la seguridad criptográfica que plantea el ataque Phoenix Rowhammer CVE-2025-6202, que puede extraer claves privadas de la memoria RAM DDR5 mediante la manipulación de bits a nivel de hardware. En los últimos años, el desarrollo dinámico de las...

JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability

Safety-critical real-time systems must satisfy multiple dependability requirements, notably time predictability and security. In such systems, tasks must complete within bounded and known execution times, typically characterised through Worst-Case Execution Time WCET analysis. At the same time,...

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

Academic researchers have disclosed a Rowhammer attack impacting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes ECC, the mitigation NVIDIA recommends against GPU Rowhammer, and enables denial-of-service DoS and privilege escalation to a root shell. Dubbed GPUThor ,...

JLSEC-2026-683 An issue was discovered in wolfSSL before 5.7.0

An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSLCHECKSIGFAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault...

JLSEC-2026-675

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

Model Poisoning against Federated Model Adaptation with Chain of Bit-Flips

Federated Learning FL allows a set of clients to collectively train a global model without sharing local training data. Giving the responsibility of the training to decentralized actors may lead to poisoning attacks: clients controlled by malicious third party potentially poison the training...

ARTA: Adaptive Reinforcement-Learning-Based Throttling Agent for RowHammer Vulnerabilities

RowHammer vulnerability continues to intensify with DRAM scaling, reducing the activation threshold needed to induce bitflips and rendering existing defenses such as TRR, ECC, and refresh-based mechanisms vulnerable to sophisticated multi-bank hammering patterns. This work presents ARTA, a...

ScaleDisturb: Exploiting Temporal Asymmetry to Amplify Read Disturbance in Modern DRAM Chips

DRAM suffers from read disturbance phenomena e.g., RowHammer and RowPress, where repeatedly accessing or continuously keeping open a DRAM row aggressor row induces bitflips in other physically nearby unaccessed rows victim rows. The disturbance mechanism is practically exploitable from the softwa...

HammerSim: A System-Level Tool to Model RowHammer

Modern architecture research relies on simulators to evaluate system security, yet analyzing emerging hardware vulnerabilities like RowHammer requires full-system visibility. As RowHammer vulnerabilities worsen with continuous technology scaling, existing simulators lack the system-level models...

Loaded Dice: Solving the Non-Selection Problem for Scalable Probabilistic RowHammer Defense

DRAM scaling has exacerbated the RowHammer vulnerability. To counter this, JEDEC recently introduced Per Row Activation Counting PRAC with the Alert Back-Off protocol as an optional DDR5 feature. While promising, PRAC requires per-row counter cells that incur area overhead, and updating them on...

Rowhammer Attack Against NVIDIA Chips

A new rowhammer attack gives complete control of NVIDIA CPUs. On Thursday, two research teams, working independently of each other, demonstrated attacks against two cards from Nvidia’s Ampere generation that take GPU rowhammering into new--­and potentially much more consequential--­territory: GDD...

GPUBreach: Privilege Escalation Attacks on GPUs Using Rowhammer

NVIDIA GPUs with GDDR memories have been shown susceptible to Rowhammer-based bit-flips, similar to CPUs. However, Rowhammer exploits on GPUs have been limited to injecting untargeted bit-flips in victim data like weights of machine learning models, to degrade model accuracy, unlike CPU exploits...

RowHammer Vulnerability Counter (RVC): Redefining RowHammer Detection with Victim-Centric Tracking

The Rowhammer vulnerability poses an increasing challenge with newer generations of DRAM and aggressive technology scaling. Existing mitigation techniques, such as Graphene, Twice, and Hydra, primarily rely on tracking activation counts for each row and issuing refreshes when a row reaches a...

PVAC: A RowHammer Mitigation Architecture Exploiting Per-Victim-Row Counting

As DRAM scaling exacerbates RowHammer, DDR5 introduces per-row activation counting PRAC to track aggressor activity. However, PRAC indiscriminately increments counters on every activation -- including benign refreshes -- while relying solely on explicit RFM operations for resets. Consequently,...

openssh: authentication bypass via row hammer attack

An authentication bypass vulnerability was found in a modified version of OpenSSH. When common types of DRAM memory are used, it might allow row hammer attacks because the integer value of authenticated authpassword does not resist flips of a single bit. Exploiting a Rowhammer-style attack to fli...

New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips

New academic research has identified multiple RowHammer attacks against high-performance graphics processing units GPUs that could be exploited to escalate privileges and, in some cases, even take full control of a host. The efforts have been codenamed GPUBreach , GDDRHammer, and GeForge. GPUBrea...