Phoenix Rowhammer Attack Bypasses DDR5 Protections, Enabling Privilege Escalation and Data Compromise

Researchers from ETH Zurich and Google have developed a new Rowhammer attack variant, Phoenix (CVE-2025-6202), that bypasses advanced DDR5 memory protections, including TRR and on-die ECC. The attack enables privilege escalation, arbitrary memory access, and cryptographic key extraction on all tested DDR5 modules from SK Hynix, with potential risk to other vendors. Mitigation is limited, with tripling DRAM refresh intervals as a temporary measure, though this may cause system instability.