Google revealed that researchers, in collaboration with ETH Zurich, developed customized attack patterns that bypass enhanced Target Row Refresh (TRR) defenses in DDR5 memory. The research enabled the first privilege-escalation exploit via Rowhammer on a standard production desktop system equipped with DDR5 memory, in an experiment that used a modern AMD Zen processor and SK Hynix DDR5 memory.
The findings were presented in a joint research paper titled “Phoenix: Rowhammer Attacks on DDR5 with Self-Correcting Synchronization,” while Google said it was still evaluating how applicable the findings were to other hardware configurations. The paper is scheduled to be presented at the IEEE Security & Privacy 2026 conference in San Francisco between May 18 and 21, 2026.
How does Rowhammer work?
Rowhammer exploits a weakness in DRAM memory cells, which store data as electrical charges that leak over time. The system periodically refreshes the cells to prevent data loss, but discharging a cell before a refresh cycle can change the bit stored in it.
By repeatedly accessing a row of memory, an attacker can cause bit changes in adjacent rows. These changes may be used to corrupt data, affect memory pages allocated to other applications or the operating system, target sensitive data for privilege escalation, or cause a denial of service. Protection against this type of attack is increasingly important in multi-tenant isolation environments, such as cloud infrastructure.
Existing but bypassable defenses
Memory systems use mechanisms such as ECC and TRR to reduce Rowhammer risks. TRR monitors accesses to a limited number of rows near a target row, then requests a refresh of the affected row when the number of accesses exceeds a certain threshold. This mechanism can be integrated into the DRAM chip or the host processor.
However, this protection is not conclusive. The TRRespass attack demonstrated the ability to bypass TRR by accessing multiple non-adjacent rows simultaneously, while subsequent attacks such as Half-Double and Blacksmith introduced more efficient access patterns. Current DDR5 systems also do not support PRAC or similarly strong protection mechanisms, and therefore rely on probabilistic techniques such as ECC and enhanced TRR.
Open-source testing platforms
To facilitate analysis of these defenses, Google collaborated with Antmicro to develop two specialized open-source FPGA-based platforms for testing DDR5 modules:
- DDR5 RDIMM platform: A test board that meets the requirements of registered RDIMM memory commonly used in computing servers.
- SO-DIMM platform: A version that supports the standard connector for DDR5 modules used in workstations and user devices.
Antmicro designed and manufactured the two platforms, after which Google worked with the company and researchers from ETH Zurich to test their ability to analyze commercially available memory modules in RDIMM and SO-DIMM formats. Studying internal TRR mechanisms requires reverse-engineering proprietary mechanisms that vary between companies and models, in addition to issuing precise DDR commands and analyzing responses—tasks that are difficult to perform on conventional commercial systems.
The road ahead
Google concludes that current protection mechanisms make attacks more difficult to execute, but do not prevent them, because an attacker needs a deep understanding of the architecture of the targeted memory subsystem. The company believes that ECC was not originally designed as a security mechanism, and that memory encryption without cryptographic integrity does not provide useful protection against Rowhammer.
Google supports the PRAC standard approved by JEDEC, which is scheduled to be supported in upcoming versions of DDR5 and LPDDR6. The standard relies on accurately counting DRAM word-line activation events and then alerting the system when an excessive number of activations is detected. Until this protection becomes available, Google continues to evaluate other measures and collaborate with academic and industry partners to improve testing platforms and analysis techniques.