{"id":143523,"date":"2025-09-16T17:11:57","date_gmt":"2025-09-16T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati"},"modified":"2025-09-16T17:11:57","modified_gmt":"2025-09-16T15:11:59","slug":"phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/phoenix-ataka-na-chipy-ddr5-privodyashhaya-k-iskazheniyu-soderzhimogo-pamyati","title":{"rendered":"Phoenix \u2014 an attack on DDR5 chips leading to memory content corruption","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from the Swiss Federal Institute of Technology Zurich, together with engineers from Google, have developed a new Rowhammer attack technique called Phoenix (CVE-2025-6202). This technique allows them to circumvent the TRR (Target Row Refresh) protection mechanisms used in DDR5 chips, which prevent memory cell distortion due to charge loss. A prototype exploit has been published that allows for the modification of a specific bit in the RAM and assists in gaining higher privileges within the system. The attack demonstration was conducted on a PC with an AMD processor based on the Zen 4 microarchitecture and SK Hynix DDR5 memory, where typical desktop tasks were performed. <\/p>\n
The RowHammer attack allows for the corruption of individual bits in DRAM memory by cyclically reading data from adjacent memory cells. Since DRAM memory is a two-dimensional array of cells, each comprising a capacitor and a transistor, continuous reading of the same memory region leads to voltage fluctuations and anomalies that cause slight charge loss in neighboring cells. If the reading intensity is high, an adjacent cell may lose a significant amount of charge, and the subsequent refresh cycle may not restore its original state, resulting in altered data stored in the cell. <\/p>\n
The Rowhammer attack method was proposed in 2014, after which a game of 'cat and mouse' began between security researchers and hardware manufacturers. Chip makers attempted to block the vulnerability, while researchers found new ways to bypass these protections. For example, to defend against Rowhammer, memory manufacturers introduced the TRR (Target Row Refresh) mechanism, but it was found to only block cell distortion in specific cases, failing to protect against all possible attack variants. Attack methods have been developed for DDR3, DDR4, and DDR5 chips in systems with Intel, AMD, and ARM processors, as well as for video memory used in NVIDIA graphics cards. Moreover, ways to bypass ECC error correction have been discovered, and methods for conducting attacks over the network and through JavaScript execution in browsers have been proposed. <\/p>\n
A key factor in bypassing memory cell distortion protection in DRAM is understanding the logic of the TRR mechanism, which primarily relies on concealing implementation details and the principle of 'security through obscurity.' To elucidate the operational logic and conduct reverse engineering, researchers have created special boards based on FGPA Arty-A7 and ZCU104, allowing them to test DDR5 SO-DIMM and RDIMM memory modules, detect memory cell access patterns, determine which low-level DDR commands are sent after software operations with memory, and analyze the responses to them.
<\/center> <\/p>\n
It turned out that the protection in the analyzed DDR5 chips is implemented without additional memory refresh frequency control commands and relies on variable-frequency cell recharge circuits. To successfully conduct a Rowhammer attack under these conditions, precise tracking of thousands of memory refresh operations is required. In such a context, previously existing Rowhammer attack methods proved ineffective, leading researchers to develop a new method that self-corrects access patterns as it detects missed memory refresh operations during the attack. <\/p>\n
The method proved to be effective, achieving controlled memory bit distortion in all 15 tested DDR5 chips from SK Hynix (which holds 36% of the DRAM market), manufactured from late 2021 to late 2024. Distorting a single bit was sufficient to create an exploit allowing root access on a system with an AMD Ryzen 7 7700X CPU and SK Hynix DDR5 memory within 109 seconds. To block the proposed attack method, it's recommended to triple the memory refresh rate. <\/p>\n
![\"Phoenix](\"\/wp-content\/uploads\/2025\/09\/7b58de5bdc63fcd044d190aeba0bea1b.png\")
<\/center> <\/p>\n![\"Phoenix](\"\/wp-content\/uploads\/2025\/09\/f4a710c5a63b6e338eca1d660f5dacd6.png\")
<\/center> <\/p>\n![\"Play](\"https:\/\/img.youtube.com\/vi\/1emxVQ6__qg\/hqdefault.jpg\")
\r\n ![\"Phoenix](\"\/wp-content\/uploads\/2025\/09\/92abedeaf4228043571fed91335121f8.png\")
<\/center>