Rowhammer: The DRAM Vulnerability That Flips Bits by Reading Memory

Rowhammer is a hardware vulnerability in DRAM (Dynamic Random-Access Memory) discovered in 2014 by Yoongu Kim and colleagues at Carnegie Mellon University. The paper "Flipping Bits in Memory Without Accessing Them" (ISCA 2014) demonstrated that repeatedly opening and closing (hammering) the same DRAM row causes electrical disturbance in physically adjacent rows, inducing bit flips — changing stored 0s to 1s or vice versa. ## How It Works DRAM stores each bit as charge on a tiny capacitor. Rows of capacitors share access circuitry. When a row is activated (opened for reading/writing) and then precharged (closed), the resulting electrical activity disturbs charge levels in neighboring rows. A single access causes negligible disturbance, but hundreds of thousands of rapid activations accumulate enough interference to flip bits in adjacent rows. ## Scale of Vulnerability Kim et al. tested 129 DRAM modules manufactured between 2008-2014 and found 110 (85%) exhibited Rowhammer errors. All modules manufactured in 2012-2013 were vulnerable. The vulnerability is a fundamental consequence of DRAM density — as cells shrink, the electrical interference between adjacent rows increases. ## Weaponization In 2015, Google Project Zero demonstrated that Rowhammer could be exploited for privilege escalation: an unprivileged user process, by carefully choosing which memory rows to hammer, could flip specific bits in page table entries to gain kernel-level access to the entire system. The attack required no software vulnerability — it exploited the physics of the hardware. ## Mitigations DRAM manufacturers implemented Target Row Refresh (TRR) in newer modules, which detects frequently accessed rows and preemptively refreshes their neighbors. However, researchers have repeatedly bypassed TRR implementations. The Rowhammer arms race continues: each new mitigation is followed by more sophisticated attack patterns (Half-Double, RowPress, etc.). Tail Slayer: Hedging DRAM Refresh Latency for Sub-Microsecond Reads