--- id: CP-088 slug: rowhammer-dram-bit-flips lang: en title: Rowhammer, the DRAM bit-flip attack description: Rowhammer alters a device's DRAM memory without touching it directly. What an employee sees, how it works and which habits help. canonical_url: https://startbrain.io/cyberpedia/en/articles/rowhammer-dram-bit-flips/ markdown_url: https://startbrain.io/cyberpedia/en/articles/rowhammer-dram-bit-flips.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Rowhammer, the DRAM bit-flip attack", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/rowhammer-dram-bit-flips/ (CC BY 4.0) wing: 1 theme: secure_devices reflex: cr-055 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/rowhammer-dram-bit-flips/ fr: https://startbrain.io/cyberpedia/fr/articles/rowhammer-inversion-bits-memoire-dram/ de: https://startbrain.io/cyberpedia/de/articles/rowhammer-bitflips-dram-speicher/ es: https://startbrain.io/cyberpedia/es/articles/rowhammer-inversion-bits-memoria-dram/ sources: - "n": 1 title: "Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript" publisher: arXiv url: https://arxiv.org/abs/1507.06955 published: "2015-07-24" accessed: "2026-11-03" - "n": 2 title: "Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript" publisher: arXiv url: https://arxiv.org/abs/1507.06955v2 published: "2015-08-27" accessed: "2026-11-03" - "n": 3 title: Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1068/ accessed: "2026-11-03" - "n": 4 title: Exploitation for Stealth, Technique T1211 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1211/ accessed: "2026-11-03" --- # Rowhammer, the DRAM bit-flip attack A basic rule of computer security is that a memory location can only be changed by programs allowed to write to it. Rowhammer gets around this rule: by reading certain areas of DRAM memory very often, a program can change the contents of neighbouring cells without accessing them [1]. For an employee, the point to remember is that a website running JavaScript is enough to carry out this attack [1]. It targets the hardware itself, and according to the authors, the countermeasures that existed in 2015 did not block it [1]. ## In 30 seconds - Where it happens: in the DRAM memory of computers and devices, including when a website runs JavaScript in the browser [1]. - What the attacker wants: to change bits that their program is not allowed to modify, for example to gain administrator rights [1][3]. - The reflex: keep the system, the browser and the software up to date, because regular software updates are a protective measure cited by MITRE ATT&CK against the exploitation of flaws [3][4]. - If it has already happened: report any unusual behaviour of the device to the security team, for example the sudden failure of an antivirus, which MITRE ATT&CK lists among the signs of a flaw being exploited [4]. ## Straight answers ### What is Rowhammer? It is a flaw in DRAM memory. The authors of Rowhammer.js explain that parasitic effects in DRAM can change the contents of a memory cell without accessing it, by accessing other locations at high frequency [1]. They state that this flaw appears in most memory modules in use at the date of their paper [1]. ### Why does this flaw exist? According to the second version of the paper, DRAM has become denser, and its cells are therefore less isolated from one another [2]. Repeated accesses to rows of DRAM can then cause random bit flips in an adjacent row [2]. ### Is a flipped bit really serious? Yes, according to the same authors. The flaw has already been used to gain root rights and to escape a sandbox [2]. A sandbox is an isolated space in which a program is supposed to stay confined. ### Does the attacker need access to the computer? Not necessarily. Rowhammer.js, according to its authors, is the first remote software-induced hardware-fault attack: it requires neither physical access to the machine, nor native code execution, nor special instructions [2]. A website containing JavaScript is enough to cause faults on remote hardware [1]. ### What does the victim see? The sources cited here describe no message or sign on screen. They indicate that these JavaScript-based attacks can target millions of users discreetly and simultaneously [2]. ## Inside the attacker's head The attacker starts from an obstacle: a program running with few rights cannot access certain system resources. MITRE ATT&CK describes this step as privilege escalation, which can take an attacker from user level to SYSTEM or root rights [3]. It can also allow escape from a virtualised environment, such as a virtual machine or a container, to reach the host machine [3]. Rowhammer offers a path to get there, since it makes it possible to alter memory without authorisation. The authors of Rowhammer.js mention privilege escalation attacks among the consequences [1]. They also indicate that a website is enough to obtain unrestricted access to the systems of its visitors [1]. MITRE ATT&CK describes another technique, exploiting a flaw to evade detection, which consists of acting so as to reduce visibility or to blend in with legitimate activity [4]. This article does not say that Rowhammer has been used in this way: the sources cited here do not mention it. ## What you see on screen The sources cited here give no description of what the user perceives. They say only that the attack through a browser can be carried out discreetly [2]. In the scenario described by the authors of Rowhammer.js, the victim visits a website that contains JavaScript [1]. Since Rowhammer has no visible sign of its own, the clues to watch for are those of any flaw exploitation. MITRE ATT&CK cites abnormal process behaviour, such as an antivirus or a detection tool that stops unexpectedly, or logs that have gaps [4]. ## Under the hood DRAM memory stores data in cells organised in rows. When density increases, the cells are less well isolated from one another [2]. Reading a row very often can then flip bits in the neighbouring row [2]. The first exploits written to take advantage of this flaw used native code and special instructions meant to flush data from the cache [2]. All studies and attacks prior to Rowhammer.js depended on the availability of a cache-flush instruction, in order to cause DRAM accesses at a sufficient frequency [1]. Rowhammer.js removed this limit. Its authors show that the cache can be forced to evict its data quickly and that the flaw can be triggered with ordinary memory accesses [1]. The attack then becomes possible in restricted environments, including scripting ones [1]. An eviction strategy found by a generic algorithm raises the eviction rate from 95.2 % to 99.99 % [2]. The authors state that the countermeasures existing at the time of their paper did not protect against this new attack [1]. In the second version, they propose countermeasures that can be applied immediately [2]. ## Case files ### Rowhammer.js, July 2015 On 24 July 2015, Daniel Gruss, Clémentine Maurice and Stefan Mangard submitted the Rowhammer.js paper to arXiv [1]. In it they present an implementation of the attack in JavaScript [2]. They describe a fully automated attack that requires nothing more than a website with JavaScript to cause faults on remote hardware [1]. According to them, the attack works on commodity systems and gives unrestricted access to the systems of the website's visitors [1]. A second version appeared on 27 August 2015, and the latest version dates from 5 April 2016 [1][2]. The paper was accepted at the 13th DIMVA conference in 2016 [1]. ## What you do The sources cited here give no step specific to Rowhammer, either on ECC memory or on recent DDR generations. They only allow the retention of the general measure given by MITRE ATT&CK: updating software regularly, with patch management for the company's workstations and servers [3][4]. For an employee, this means accepting the updates offered by the IT team and not putting them off without reason. MITRE ATT&CK also cites protections that detect exploitation behaviour, as well as application isolation through sandboxing, which makes it harder for an attacker to progress [4]. ## Sources 1. arXiv, "Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript", 24 July 2015. https://arxiv.org/abs/1507.06955 (accessed 3 November 2026) 2. arXiv, "Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript", 27 August 2015. https://arxiv.org/abs/1507.06955v2 (accessed 3 November 2026) 3. MITRE ATT&CK, "Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1068/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Exploitation for Stealth, Technique T1211 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1211/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/rowhammer-dram-bit-flips/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.