SPOILER

SPOILER: Опасности спекулятивной загрузки усиливают атаки Rowhammer и Cache CVE-2019-0162 INTEL-SA-00238 https://www.usenix.org/system/files/sec19-islam.pdf @inproceedings 236252, author = Saad Islam and Ahmad Moghimi and Ida Bruhns and Moritz Krebbel and Berk Gulmezoglu and Thomas Eisenbarth and...

prism

Loaded Dice: 확장 가능한 확률적 RowHammer 방어를 위한 비선택 문제 해결 제53회 국제 컴퓨터 아키텍처 심포지엄 ISCA, 2026년에 발표 예정. Jeonghyun Woo1, Junsu Kim1, Aamer Jaleel2, Prashant J. Nair1 1 브리티시 컬럼비아 대학교 2 NVIDIA 동등한 기여 논문 PDF | arXiv 초록 DRAM 스케일링은 RowHammer 취약성을 악화시켰습니다. 이에 대응하기 위해 JEDEC은 최근 DDR5의 선택적 기능으로 Alert Back-Off 프로토콜을 갖...

RAMnesia-Attack

이 연구는 DDR5 메모리를 사용하는 최신 컴퓨터 시스템의 하드웨어 메모리에 대한 두 가지 중요한 공격 클래스에 대한 포괄적인 분석을 제시합니다: Phoenix Rowhammer Attack CVE-2025-6202 및 RAMnesia Attack CVE-2023-39910 . 두 공격 모두 암호화 자재의 처리 및 저장에 있어 근본적인 취약점을 입증하며, 비트코인 지갑 개인 키를 복구할 수 있는 전례 없는 침해 벡터를 생성합니다. 이 연구는 2025년 10월에 공개된 WireTap 및 TEE.fail 공격에서 입증된 Intel...

RowHammer-Exploit

RowHammer-Exploit RowHammer 기반 익스플로잇rowhammer을 사용한 syssuid 백도어 아직 작업이 필요함... 왜 제대로 작동하지 않는지 알아내는 중... Current stage... Denial fails with the following stack trace... UG: unable to handle kernel paging request at 0000000100000000 PGD 8000000006de3067 P4D 8000000006de3067 PUD 0 Oops: 0010 1 PTI CPU...

Phoenix-Rowhammer-Attack-CVE-2025-6202

이 기사는 하드웨어 수준의 비트 조작을 통해 DDR5 RAM에서 개인 키를 추출할 수 있는 Phoenix Rowhammer 공격CVE-2025-6202이 제기하는 시스템적 암호화 보안 위협을 분석합니다. 최근 몇 년간 암호화폐 기술의 역동적인 발전으로 인해 디지털 자산 생태계는 암호화 데이터를 저장하고 처리하는 하드웨어 및 마이크로칩 구성 요소에 대한 의존도가 높아졌습니다. 이러한 배경 속에서 암호화폐 지갑의 개인 키를 직접적으로 손상시킬 수 있는 하드웨어 수준의 취약점은 점점 더 커지는 위험 요소가 되고 있습니다. 오늘날 가...

JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability

Safety-critical real-time systems must satisfy multiple dependability requirements, notably time predictability and security. In such systems, tasks must complete within bounded and known execution times, typically characterised through Worst-Case Execution Time WCET analysis. At the same time,...

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

Academic researchers have disclosed a Rowhammer attack impacting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes ECC, the mitigation NVIDIA recommends against GPU Rowhammer, and enables denial-of-service DoS and privilege escalation to a root shell. Dubbed GPUThor ,...

JLSEC-2026-683 An issue was discovered in wolfSSL before 5.7.0

An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSLCHECKSIGFAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault...

JLSEC-2026-675

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

Model Poisoning against Federated Model Adaptation with Chain of Bit-Flips

Federated Learning FL allows a set of clients to collectively train a global model without sharing local training data. Giving the responsibility of the training to decentralized actors may lead to poisoning attacks: clients controlled by malicious third party potentially poison the training...

ARTA: Adaptive Reinforcement-Learning-Based Throttling Agent for RowHammer Vulnerabilities

RowHammer vulnerability continues to intensify with DRAM scaling, reducing the activation threshold needed to induce bitflips and rendering existing defenses such as TRR, ECC, and refresh-based mechanisms vulnerable to sophisticated multi-bank hammering patterns. This work presents ARTA, a...

ScaleDisturb: Exploiting Temporal Asymmetry to Amplify Read Disturbance in Modern DRAM Chips

DRAM suffers from read disturbance phenomena e.g., RowHammer and RowPress, where repeatedly accessing or continuously keeping open a DRAM row aggressor row induces bitflips in other physically nearby unaccessed rows victim rows. The disturbance mechanism is practically exploitable from the softwa...

HammerSim: A System-Level Tool to Model RowHammer

Modern architecture research relies on simulators to evaluate system security, yet analyzing emerging hardware vulnerabilities like RowHammer requires full-system visibility. As RowHammer vulnerabilities worsen with continuous technology scaling, existing simulators lack the system-level models...

Loaded Dice: Solving the Non-Selection Problem for Scalable Probabilistic RowHammer Defense

DRAM scaling has exacerbated the RowHammer vulnerability. To counter this, JEDEC recently introduced Per Row Activation Counting PRAC with the Alert Back-Off protocol as an optional DDR5 feature. While promising, PRAC requires per-row counter cells that incur area overhead, and updating them on...

Rowhammer Attack Against NVIDIA Chips

A new rowhammer attack gives complete control of NVIDIA CPUs. On Thursday, two research teams, working independently of each other, demonstrated attacks against two cards from Nvidia’s Ampere generation that take GPU rowhammering into new--­and potentially much more consequential--­territory: GDD...

GPUBreach: Privilege Escalation Attacks on GPUs Using Rowhammer

NVIDIA GPUs with GDDR memories have been shown susceptible to Rowhammer-based bit-flips, similar to CPUs. However, Rowhammer exploits on GPUs have been limited to injecting untargeted bit-flips in victim data like weights of machine learning models, to degrade model accuracy, unlike CPU exploits...

RowHammer Vulnerability Counter (RVC): Redefining RowHammer Detection with Victim-Centric Tracking

The Rowhammer vulnerability poses an increasing challenge with newer generations of DRAM and aggressive technology scaling. Existing mitigation techniques, such as Graphene, Twice, and Hydra, primarily rely on tracking activation counts for each row and issuing refreshes when a row reaches a...

PVAC: A RowHammer Mitigation Architecture Exploiting Per-Victim-Row Counting

As DRAM scaling exacerbates RowHammer, DDR5 introduces per-row activation counting PRAC to track aggressor activity. However, PRAC indiscriminately increments counters on every activation -- including benign refreshes -- while relying solely on explicit RFM operations for resets. Consequently,...

openssh: authentication bypass via row hammer attack

An authentication bypass vulnerability was found in a modified version of OpenSSH. When common types of DRAM memory are used, it might allow row hammer attacks because the integer value of authenticated authpassword does not resist flips of a single bit. Exploiting a Rowhammer-style attack to fli...

New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips

New academic research has identified multiple RowHammer attacks against high-performance graphics processing units GPUs that could be exploited to escalate privileges and, in some cases, even take full control of a host. The efforts have been codenamed GPUBreach , GDDRHammer, and GeForge. GPUBrea...