New Phoenix attack bypasses Rowhammer defenses in DDR5 memory

A newly discovered attack named "New Phoenix" has been found to bypass existing Rowhammer defenses in DDR5 memory modules. Rowhammer is a hardware vulnerability that allows attackers to manipulate memory cells by repeatedly accessing adjacent rows, potentially leading to data corruption or privilege escalation. DDR5 memory, the latest generation of DRAM, introduced new mitigation techniques to counteract Rowhammer attacks. However, the New Phoenix attack demonstrates that these defenses can be circumvented, posing a significant security risk to systems using DDR5 memory. This attack exploits specific weaknesses in the DDR5 Rowhammer mitigation mechanisms, enabling attackers to induce bit flips despite the enhanced protections. The implications are serious for both consumer and enterprise environments, as attackers could leverage this vulnerability to compromise system integrity, escalate privileges, or bypass security controls. The research behind New Phoenix highlights the evolving nature of hardware-based attacks and the need for continuous innovation in defense strategies. Security professionals and hardware manufacturers must take note of this development and work towards strengthening DDR5 memory protections. This may involve revising current mitigation techniques, improving hardware design, or implementing additional software-level safeguards. Awareness and proactive measures are crucial to prevent exploitation of the New Phoenix attack and to maintain the security of modern computing systems. In conclusion, the New Phoenix attack serves as a reminder that even advanced hardware defenses can be vulnerable. Ongoing research and collaboration between the cybersecurity community and hardware vendors are essential to address these challenges and protect against emerging threats in memory security.

This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 15 Sep 2025 18:05:31 +0000


Cyber News related to New Phoenix attack bypasses Rowhammer defenses in DDR5 memory

New Phoenix attack bypasses Rowhammer defenses in DDR5 memory - A newly discovered attack named "New Phoenix" has been found to bypass existing Rowhammer defenses in DDR5 memory modules. Rowhammer is a hardware vulnerability that allows attackers to manipulate memory cells by repeatedly accessing adjacent rows, ...
4 months ago Bleepingcomputer.com
NVIDIA issues guidance to defend GDDR6 GPUs against Rowhammer - NVIDIA is warning users to activate the System Level Error-Correcting Code  mitigation to protect against Rowhammer attacks on graphical processors with GDDR6 memory. Rowhammer represents a real security concern that could cause ...
6 months ago Bleepingcomputer.com
GPUHammer - First Rowhammer Attack Targeting NVIDIA GPUs - Cybersecurity researchers at the University of Toronto have achieved a breakthrough in hardware-level attacks by successfully demonstrating GPUHammer, the first Rowhammer attack specifically targeting discrete NVIDIA GPUs. The research, which focuses ...
6 months ago Cybersecuritynews.com Inception
CVE-2024-0762 - Potential buffer overflow ...
1 year ago
Online ransomware decryptor helps recover partially encrypted files - CyberArk has created an online version of 'White Phoenix,' an open-source ransomware decryptor targeting operations using intermittent encryption. The company announced today that although the tool was already freely available through GitHub as a ...
1 year ago Bleepingcomputer.com BianLian Qilin Cactus Black Basta
CVE-2021-42114 - Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel non-uniform Rowhammer access patterns, consisting of aggressors with different frequencies, ...
4 years ago
CVE-2025-6202 - Vulnerability in SK Hynix DDR5 on x86 allows a local attacker to trigger Rowhammer bit flips impacting the Hardware Integrity and the system's security. This issue affects DDR5: DIMMs produced from 2021-1 until 2024-12. ...
4 months ago
CVE-2020-10255 - Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attacks known as Target Row Refresh (TRR), aka the TRRespass issue. To exploit this vulnerability, the attacker ...
5 years ago
Attack Vector vs Attack Surface: The Subtle Difference - Cybersecurity discussions about "Attack vectors" and "Attack surfaces" sometimes use these two terms interchangeably. This article guides you through the distinctions between attack vectors and attack surfaces to help you better understand the two ...
2 years ago Trendmicro.com
Critical 'LogoFAIL' Bugs Offer Secure Boot Bypass for Millions of PCs - Researchers have uncovered "LogoFAIL," a set of critical vulnerabilities present in the Unified Extensible Firmware Interface ecosystem for PCs. Exploitation of the vulnerabilities nullify essential endpoint security measures and provide attackers ...
2 years ago Darkreading.com
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
2 years ago Esecurityplanet.com
CISA's Flags Memory-Unsafe Code in Major Open Source Projects - A comprehensive new study has unearthed fresh details on the extensive and troubling use of memory-unsafe code in major open source software projects. The chances that fresh insight on a long known issue will spur any immediate changes to the ...
1 year ago Darkreading.com
East Texas hospital network can't receive ambulances because of potential cybersecurity incident - GetTime();if(!(u<=a&&d<=l throw new RangeError("Invalid interval");return r.inclusive?u<=l&&d<=a:ut||isNaN(t. Step):1;if(s<1||isNaN(s throw new RangeError("`options. Step):1;if(l<1||isNaN(l throw new RangeError("`options. GetTime()<=n throw new ...
2 years ago Cnn.com
CVE-2020-12048 - Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the ...
5 years ago
CVE-2024-29980 - Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows ...
1 year ago Tenable.com
CVE-2024-29979 - Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows ...
1 year ago Tenable.com
CISA Report Finds Most Open-Source Projects Contain Memory-Unsafe Code - More than half of open-source projects contain code written in a memory-unsafe language, a report from the U.S.'s Cybersecurity and Infrastructure Security Agency has found. Memory-unsafe means the code allows for operations that can corrupt memory, ...
1 year ago Techrepublic.com
Exploiting Side-Channel Leakage Enable Successful Exploitations on The Latest Linux Kernel - Their findings revealed that three specific defenses – enforcing strict memory permissions or virtualizing the kernel heap or kernel stack – unintentionally create exploitable TLB contention patterns. The Linux kernel employs various ...
9 months ago Cybersecuritynews.com
Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure - Fortinet is warning of two new unpatched patch bypasses for a critical remote code execution vulnerability in FortiSIEM, Fortinet's SIEM solution. Fortinet added the two new vulnerabilities tracked as CVE-2024-23108 and CVE-2024-23109 to the original ...
1 year ago Bleepingcomputer.com CVE-2024-23108 CVE-2024-23109 CVE-2023-34992
Using Memory Forensics Tools To Enhance Advanced Incident Response - By combining proper tools, trained personnel, and well-defined procedures, organizations can leverage memory forensics to significantly enhance their incident response capabilities and improve their overall security posture against increasingly ...
9 months ago Cybersecuritynews.com
New York's cyber chief on keeping cities and states safe from cyberattacks | The Record from Recorded Future News - And so we think that that'll continue to evolve the security posture of New York State in a way that first and foremost provides the public good, which is, if a government service is not secure, it can't be considered reliable. We're ...
9 months ago Therecord.media
Iranian hackers targeted over 100 govt orgs with Phoenix backdoor - Iranian hacker groups have launched a widespread cyber espionage campaign targeting over 100 government organizations worldwide using the Phoenix backdoor malware. This sophisticated malware enables attackers to gain persistent access, steal ...
3 months ago Bleepingcomputer.com Iranian hackers
Understanding the New SEC Rules for Disclosing Cybersecurity Incidents - The U.S. Securities and Exchange Commission recently announced its new rules for public companies regarding cybersecurity risk management, strategy, governance, and incident exposure. "Currently, many public companies provide cybersecurity disclosure ...
2 years ago Feeds.dzone.com
New Stealthy Malware 'Waiting Thread Hijacking' Technique Bypasses Modern Defenses - Unlike traditional thread hijacking, which requires suspending and resuming threads using easily monitored APIs like SuspendThread and ResumeThread, WTH targets threads already in a waiting state, eliminating the need for suspicious thread ...
9 months ago Cybersecuritynews.com