Cybersecurity researchers have discovered a sophisticated new attack method that can compromise the latest DDR5 memory chips, potentially giving hackers complete control over computer systems.
## What is the Phoenix Attack?
The Phoenix attack is an advanced variant of Rowhammer attacks developed by researchers from ETH Zurich University and Google. Unlike traditional attacks, Phoenix can bypass the newest security protections built into DDR5 memory chips from major manufacturer SK Hynix.
Rowhammer attacks work by rapidly accessing specific memory locations thousands of times per second. This creates electrical interference that can flip individual bits from 1 to 0 or vice versa, potentially corrupting critical system data or security controls.
## Breaking Through Modern Defenses
DDR5 memory includes a protection mechanism called Target Row Refresh (TRR) that detects suspicious memory access patterns and prevents bit flipping. However, the research team reverse-engineered these protections and found critical weaknesses.
The Phoenix attack exploits gaps in the refresh monitoring system by:
– Timing attacks precisely during unmonitored refresh intervals
– Self-correcting when refresh operations are detected
– Using complex patterns spanning 128 to 2,608 refresh cycles
## Real-World Impact
During testing on 15 different DDR5 memory modules, researchers achieved alarming results:
– **100% success rate**: All tested memory chips were vulnerable to at least one attack pattern
– **Privilege escalation**: Gained administrator access in under two minutes on standard systems
– **SSH key theft**: Successfully extracted RSA-2048 encryption keys from 73% of tested modules
– **System compromise**: Modified critical system files on 33% of chips to maintain persistent access
## Who’s at Risk?
The vulnerability, tracked as CVE-2025-6202 with a high-severity rating, affects all DDR5 memory modules manufactured between January 2021 and December 2024. This includes systems from major manufacturers beyond just SK Hynix, as similar protection mechanisms are used industry-wide.
## Limited Protection Options
Unfortunately, there’s no simple fix for existing DDR5 memory. The only current mitigation involves tripling the memory refresh rate, but this can cause system instability and data corruption.
The researchers have published their findings and will present them at the IEEE Symposium on Security and Privacy, along with proof-of-concept code to help the industry develop better defenses.
This discovery highlights the ongoing challenge of securing hardware against increasingly sophisticated attacks, emphasizing the need for improved memory protection mechanisms in future chip designs.