Database/Control plane, storage & DevOps
DDR4 / LPDDR4 DRAM - Target Row Refresh mitigation: Many-sided Rowhammer defeats the in-DRAM Target Row Refresh
Impact
Many-sided Rowhammer defeats the in-DRAM Target Row Refresh mitigation that vendors marketed as making Rowhammer solved. On a GPU host node this is the substrate under your host memory: bit flips in page tables or in a hypervisor's structures are a classic path to cross-VM compromise, and on a bare-metal GPU rental it is a path from tenant code to host.
Who can reach it
Local code on the node with the ability to allocate and access memory at a controlled rate. Any tenant container or VM qualifies; no privileges needed.
What to do
No universal fix. Practical controls, in order of value: use ECC DIMMs and actually monitor correctable-error rates (a Rowhammer campaign shows up as a correctable-error storm before it succeeds), enable the platform's refresh-rate and RFM settings in BIOS where offered, and prefer DDR5 modules with on-die ECC. Cost: a BIOS setting change is a drain and reboot; a DIMM refresh is a hardware refresh cycle. Effectively UNPATCHABLE in software.
References
Related entries
- Imagination PowerVR GPU driver - memory residue: An unprivileged application gets the GPU driver to hand backCVE-2021-0891 · Imagination PowerVR GPU driver - memory residueUnscored
- Linux HID/amd_sfh - shift out of bounds: A shift operation in the AMD Sensor Fusion Hub driver exceeds the maximumCVE-2023-53703 · Linux HID/amd_sfh - shift out of boundsUnscored
- Linux perf/x86/amd - general protection fault from a NULL event on enable: A subtle race lets cpucCVE-2025-68798 · Linux perf/x86/amd - general protection fault from a NULL event on enableUnscored
- Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor hostCVE-2026-47359 · Apache CloudStack NAS backup provider (addBackupRepository / updateBackupRepository)Unscored
- DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition): A specification-level defect rather thanCVE-2026-61810 · DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition)Unscored
- Linux x86/mm - broadcast TLB flush with PCID disabled: Booting with nopcid clears the PCID feature but broadcast TLBCVE-2026-64229 · Linux x86/mm - broadcast TLB flush with PCID disabledUnscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.