DDR3 and DDR4 DRAM, including ECC modules; tracked by Intel as a partial-physical-address disclosure issue: Turns

Impact

Turns Rowhammer from a write primitive into a read primitive. The attacker does not corrupt the victim's data - they observe whether their own bits flip, which is data-dependent on the neighbouring row's contents, and read the victim's memory out that way. The published result was extraction of a 2048-bit OpenSSH RSA host key from another process at about 0.3 bits per second. Because it is read-only, ECC does not stop it and nothing in the victim's process ever misbehaves, so there is no detection surface at all. The low CVSS is misleading for a multi-tenant operator: the practical claim is cross-tenant key theft with no artefact.

Who can reach it

Unprivileged local code sharing DRAM with the victim - a container, a VM, or a co-scheduled batch job. The attacker needs to get their pages physically adjacent to the victim's, which memory-massaging techniques make reliable on a busy host.

What to do

No patch. ECC does not help - the attack never needs a flip to survive. Refresh-rate increases raise cost but do not close it. The controls that work: keep untrusted tenants off shared memory controllers, and at the application layer make the secrets worth less by rotating keys aggressively and using memory-hard or constantly-rekeyed representations for long-lived secrets on shared hosts. If you host customer inference on shared CPU memory, assume any long-lived key resident there is readable by a co-tenant given hours.

References

Related entries

• IBM Spectrum Scale file audit logging: A local user touches files without the access being recorded, so the audit trailCVE-2021-29671 · IBM Spectrum Scale file audit loggingLow
• Redis: Crafted Lua script triggers a NULL pointer dereferenceCVE-2022-24736 · RedisLow
• GitLab EE: pending members receive custom-role permissions before their membership is activeCVE-2025-9486 · GitLab EE (custom role assignment, pending membership state)Low
• Grafana: legacy correlation records can be read and permanently deleted across organizationsCVE-2026-21727 · Grafana (Correlations feature, legacy org_id = 0 records)Low
• RabbitMQ: Unsanitized username rendered in the management UICVE-2021-32718 · RabbitMQLow
• etcd: LeaseTimeToLive exposes key names to a user without read permission on those keysCVE-2023-32082 · etcdLow