Phoenix: Rowhammer that works on DDR5 | Kaspersky official blog
Source Kaspersky Security Blog
Description
Phoenix, a new variant of the Rowhammer attack, makes it possible to attack DDR5 memory modules.
Impact
For European organizations, Phoenix poses a tangible threat to systems using DDR5 memory modules, particularly those with AMD Zen 2 or Zen 3 processors and SK Hynix memory. The ability to induce bit flips can compromise confidentiality by leaking sensitive data such as private encryption keys, integrity by corrupting critical memory structures, and availability by causing system crashes. Privilege escalation via sudo bypass can facilitate lateral movement and persistence within networks. Sectors relying on high-assurance computing, such as finance, government, and critical infrastructure, could face increased risk of data breaches or operational disruption. The attack's requirement for detailed system knowledge and local code execution limits its scope but does not eliminate risk, especially from insider threats or sophisticated attackers. The lack of known exploits in the wild currently reduces immediate risk but the demonstrated feasibility suggests attackers may develop exploits in the future. Organizations with large deployments of vulnerable hardware may face challenges in timely mitigation due to hardware replacement costs and complexity of patching firmware or BIOS-level protections.
Defensive guidance
European organizations should first inventory their hardware to identify systems with DDR5 memory modules, AMD Zen 2/3 CPUs, and SK Hynix memory, as these are confirmed vulnerable. Deploy ECC memory where possible to detect and correct bit flips, reducing attack success probability. Work with hardware vendors to obtain firmware or BIOS updates that improve TRR or implement Fine Granularity Refresh protections. Consider reducing memory refresh intervals if supported, balancing power and thermal impacts. Employ strict access controls and monitoring to prevent unauthorized local code execution, as the attack requires running malicious code on the target system. Harden Linux sudo configurations and audit privilege escalation vectors. Promote transparency by engaging with vendors about proprietary security mechanisms and encourage adoption of open, peer-reviewed mitigations. For critical systems, consider hardware isolation or virtualization-based security to limit attack surface. Finally, maintain up-to-date endpoint detection and response tools capable of identifying suspicious memory access patterns indicative of Rowhammer attacks.