Altumptic
Contact

ALT-17 · Paper · 23 Oct 2026

Rowhammer: flipping bits without touching them

Reading one row of DRAM again and again can flip bits in its neighbours. A 2014 paper measured it; a year later it became a privilege escalation. The physics under the software.

Timeline
  1. Jun 2014Kim et al., “Flipping Bits in Memory Without Accessing Them”, ISCA 2014.
  2. Mar 2015Project Zero demonstrates sandbox escape and kernel privilege escalation.
  3. 2016–2020Attacks from JavaScript, over the network and against phones; vendor “TRR” defences are later bypassed (TRRespass, 2020).
DRAM modules tested that showed disturbance errors
110 / 129Kim et al., ISCA 2014
Earliest manufacturing year of an affected module
2010Kim et al., ISCA 2014

How it worked

DRAM cells are tiny capacitors packed ever closer. Activating one row many times between refreshes leaks charge in adjacent rows. A program that controls which addresses it reads can choose victims — for example a page-table entry — and flip the one bit that hands it more access.

Why it mattered

Software isolation assumes memory keeps what was written to it. Rowhammer broke that assumption from below, and every density improvement in DRAM has made it harder to contain.

Our reading

Analysis — Altumptic's interpretation of the sources below.

  • Every security boundary rests on physical assumptions; some of them are wrong.
  • Defences that vendors cannot describe publicly tend to be bypassed.
  • ECC memory raises the bar for servers but does not remove the problem.

What it means for you

  1. Prefer ECC memory for servers that handle secrets or run untrusted workloads.
  2. Keep firmware current; refresh-rate and mitigation changes ship there.
  3. Treat co-tenancy with untrusted code as a real threat when choosing hosting.

Sources

  1. Kim et al. — Flipping Bits in Memory Without Accessing Them, ISCA 2014 (PDF)
  2. Mutlu — Retrospective on the RowHammer paper (2023)
  3. Google Project Zero — Exploiting the DRAM rowhammer bug (Mar 2015)

Altumptic was not involved in this research. Figures are as published by the sources above.

Cite this entry

Altumptic Lab (2026). ALT-17 — Rowhammer: flipping bits without touching them. 23 Oct 2026. altumptic.com/research/rowhammer-2014