Researchers from ETH Zürich and Google have uncovered a critical vulnerability in DDR5 memory chips that could allow attackers to gain complete system control in under two minutes.
## The Phoenix Attack Explained
The newly discovered attack, dubbed “Phoenix” (CVE-2025-6202), specifically targets DDR5 memory modules manufactured by SK Hynix between 2021 and 2024. This sophisticated exploit can bypass advanced security measures and achieve root-level access on standard desktop systems in just 109 seconds.
Phoenix represents a significant evolution of RowHammer attacks—a hardware vulnerability where repeatedly accessing memory rows causes data corruption in adjacent rows. What makes this attack particularly dangerous is its ability to circumvent modern protection mechanisms that were specifically designed to prevent such exploits.
## Why DDR5 Memory Is Vulnerable
RowHammer attacks have become increasingly effective as memory technology advances. The vulnerability stems from the physics of modern DRAM chips: as manufacturers pack more data into smaller spaces to increase capacity, the memory cells become more susceptible to interference from neighboring cells.
Research shows that newer memory chips require fewer activation attempts to trigger harmful bit flips, making them easier targets for attackers. Environmental factors like temperature and voltage, along with specific data patterns, can further increase vulnerability.
## Bypassing Modern Defenses
DDR5 memory includes several built-in protections against RowHammer attacks:
– **Error Correction Code (ECC)**: Detects and corrects memory errors
– **Target Row Refresh (TRR)**: Refreshes potentially vulnerable memory rows
However, Phoenix exploits gaps in these defenses by targeting specific refresh intervals that aren’t properly monitored by the protection systems. The attack successfully triggered bit flips across all 15 DDR5 chips tested by the researchers.
## Real-World Attack Scenarios
The researchers demonstrated two practical exploitation methods:
1. **SSH Authentication Bypass**: Targeting RSA-2048 encryption keys in virtual machines to break secure connections
2. **Privilege Escalation**: Manipulating the sudo binary to gain administrator-level access
## The Broader RowHammer Threat Landscape
Phoenix joins a growing family of advanced RowHammer attacks, including TRRespass, SMASH, Half-Double, and Blacksmith, all designed to overcome existing security measures. Recent research has also revealed:
– **OneFlip**: Targets artificial intelligence systems by altering neural network weights
– **ECC.fail**: The first successful RowHammer attack against ECC-protected server memory
## Protection and Mitigation
Since hardware vulnerabilities cannot be patched through software updates, affected DDR5 modules will remain vulnerable throughout their operational lifetime. The researchers recommend increasing memory refresh rates to three times the standard frequency, which successfully prevented Phoenix attacks in their testing.
This discovery highlights the ongoing challenge of securing modern computing hardware against increasingly sophisticated attacks that exploit the fundamental physics of memory technology.