RowPress Under the Hood: How Long-Row DRAM Activation Leaks Data and Bit-Flips at 100x Lower Hammering Frequencies

For more than a decade, the semiconductor industry treated Rowhammer as the definitive physical-layer threat to modern Dynamic Random-Access Memory (DRAM). Hardware vendors engineered increasingly complex on-die mitigation schemes—most notably Target Row Refresh (TRR)—to detect and neutralize rapid, high-frequency wordline toggling. DRAM memory controllers were programmed to count activation edges, refreshing neighboring victim rows whenever an aggressor row was hammered beyond an empirical threshold. But in late 2023 and early 2024, researchers from ETH Zurich uncovered RowPress (CVE-2023-42465), a profound physical vulnerability that completely turns traditional DRAM security assumptions upside down. Rather than rapidly oscillating wordlines at peak bandwidth, RowPress keeps an aggressor wordline asserted for an extended duration. By exploiting the deep solid-state physics of pass-gate access transistor subthreshold conduction and trap-assisted thermal leakage, RowPress induces catastrophic bitflips at up to 100 times lower activation frequencies, effortlessly bypassing TRR defenses on state-of-the-art DDR4 and DDR5 modules.

1. DRAM Microarchitecture & Physical Cell Array Fundamentals

To understand how RowPress destabilizes silicon storage cells, one must first examine the microscopic anatomy of a modern Dynamic Random-Access Memory die. A contemporary DRAM chip is organized as a dense matrix of billions of memory cells arranged across banks, bank groups, subarrays, and mats.

At the core of every cell lies the classic One-Transistor One-Capacitor (1T1C) circuit:

• Storage Capacitor (\(C_s\)): A microscopic three-dimensional trench or cylinder capacitor holding an infinitesimal electric charge (typically only \(10 \text{ to } 20 \text{ femtofarads}\), corresponding to approximately \(50,000 \text{ to } 80,000 \text{ electrons}\)). A charged capacitor represents a logical state (typically ‘1’), while a discharged capacitor represents the opposite state (‘0’).
• Access Transistor (\(M_{\text{pass}}\)): An n-channel MOSFET (NMOS) acting as a bidirectional switch. The gate of the transistor is wired to a horizontal Wordline (WL), while the drain is connected to a vertical Bitline (BL).
• Sense Amplifier: A differential cross-coupled latch situated at the perimeter of the subarray that detects microscopic voltage perturbations (\(\Delta V \approx 50 \text{ to } 100 \text{ mV}\)) on the bitline during a read operation and restores full rail voltages.

The standard command sequence for accessing DRAM involves three strictly timed operations:

1. Activation (ACT): The memory controller asserts a high positive gate voltage (\(V_{PP} \approx 2.5 \text{ to } 3.0 \text{ V}\)) on the selected wordline. This turns on all access transistors along that row, dumping capacitor charge onto the bitlines for sensing and amplification. The row is now open in the row buffer.
2. Column Read/Write (RD/WR): Data is transferred between the row buffer sense amplifiers and the CPU memory controller across the high-speed data bus.
3. Precharge (PRE): The memory controller drops the wordline voltage below ground (\(V_{NWL} \approx -0.3 \text{ to } -0.5 \text{ V}\)) to cut off the access transistors, and equilibrates the bitlines back to the mid-rail reference voltage (\(V_{DD} / 2\)).

The Classical Rowhammer Paradigm: High-Frequency Capacitive Cross-Talk

In classic Rowhammer, an attacker rapidly and repeatedly issues alternating ACT and PRE commands to an aggressor row at the maximum frequency permitted by the memory timing parameters—specifically the Row Cycle Time (\(t_{RC} \approx 45 \text{ to } 55 \text{ ns}\)).

Each time the wordline switches between its negative idle voltage (\(V_{NWL}\)) and its positive activation voltage (\(V_{PP}\)), the rapid electrostatic transition (\(dV/dt\)) induces capacitive parasitic coupling into the access transistors and dielectric capacitors of adjacent physically adjacent victim rows (\(N \pm 1\)). Over tens of thousands of cycles within a standard refresh window (\(t_{REFW} = 32 \text{ or } 64 \text{ ms}\)), this capacitive pumping accelerates charge loss from the victim capacitor until the stored voltage drops below the sense amplifier threshold, flipping a bit from ‘1’ to ‘0’.

2. The Solid-State Physics of RowPress: Long-Row Activation Mechanics

RowPress departs fundamentally from the capacitive cross-talk paradigm of Rowhammer. Instead of maximizing the number of switching transitions, RowPress maximizes the duration of time a wordline remains asserted (the row active time, \(t_{RAS}\)).

When a wordline is held continuously at the elevated \(V_{PP}\) bias voltage for microsecond-scale intervals (e.g., up to the maximum permitted specification limit \(t_{RAS,\max} \approx 70.2 \ \mu\text{s}\)), three distinct solid-state degradation mechanisms assault the neighboring cells:

• Subthreshold Conduction & Channel Inversion: Due to extreme physical proximity in sub-15nm DRAM nodes, the high electric field of the asserted aggressor wordline partially penetrates the thin gate dielectric and body of the neighboring victim transistor. This fringe field reduces the effective threshold voltage (\(V_{th}\)) of the victim’s access transistor, driving it into weak subthreshold inversion.
• Trap-Assisted Tunneling (TAT): High electric field stress generates localized defect states (electron traps) in the silicon-silicon dioxide interface. Electrons in the victim capacitor tunnel through these intermediate trap levels into the substrate or bitline, drastically shortening retention time.
• Localized Joule Heating: Holding sense amplifiers active and passing continuous leakage current across the silicon substrate generates localized hotspots. Because carrier diffusion and leakage current scale exponentially with temperature, this thermal dissipation further accelerates charge depletion.

Mathematical Formulation of Subthreshold Charge Decay

The subthreshold leakage current \(I_{\text{sub}}\) of the access transistor in a neighboring victim cell is mathematically governed by the classic MOSFET subthreshold conduction equation:

Where:

• \(q\) is the elementary electric charge (\(1.602 \times 10^{-19} \text{ C}\)).
• \(k_B\) is the Boltzmann constant and \(T\) is the absolute junction temperature in Kelvin.
• \(m = 1 + C_{\text{dep}} / C_{\text{ox}}\) is the subthreshold body-effect ideality factor.
• \(\eta\) is the capacitive coupling coefficient between the aggressor wordline and the victim transistor channel (\(\approx 0.08 \text{ to } 0.15\) in 1a/1b nm nodes).
• \(\Delta V_{\text{aggressor}} = V_{PP} – V_{NWL}\) is the total potential swing of the asserted wordline.

The instantaneous voltage \(V_c(t)\) across the victim storage capacitor decays according to:

Because \(I_{\text{sub}}\) depends exponentially on the coupled voltage perturbation \(\eta \Delta V_{\text{aggressor}}\), keeping the aggressor row open for hundreds of nanoseconds maintains this exponential leakage rate continuously. Consequently, a single long activation drains an equivalent amount of charge as hundreds of rapid micro-toggles!

3. Comprehensive Disturbance Matrix: RowPress vs. Existing DRAM Exploits

The discovery of RowPress fundamentally recalibrates the taxonomy of physical memory vulnerabilities. The following comparison table contrasts RowPress against historic DRAM disturbance phenomena:

4. Why Target Row Refresh (TRR) Completely Fails Against RowPress

To defend against Rowhammer, DRAM manufacturers implemented on-die Target Row Refresh (TRR) starting in late-generation DDR3 and standard in DDR4/DDR5. Because the JEDEC specification intentionally leaves TRR implementation proprietary, each major memory manufacturer (Samsung, SK Hynix, Micron) developed distinct proprietary variants.

However, virtually all TRR architectures share a single fatal architectural flaw:

Under RowPress, the attacker issues only a few hundred activations. To the TRR controller, an aggressor row activated 800 times appears completely harmless—well below the typical TRR detection threshold of \(10,000 \text{ to } 30,000\) activations. Yet, because each of those 800 activations is held open for dozens of microseconds, the cumulative charge leakage exceeds the critical bitflip threshold (\(\Delta Q_{\text{crit}}\)). The neighboring cell flips, and TRR never issues a single preventive refresh pulse!

Synchronizing RowPress With DRAM Timing Constraints

To execute RowPress on commercial commodity microprocessors (such as Intel Raptor Lake or AMD Zen 4), an unprivileged attacker cannot issue raw DRAM commands directly. Instead, they must coerce the memory controller into keeping a DRAM row open via user-space memory operations.

Modern memory controllers employ open-page policy heuristics. When a thread accesses a memory address, the controller activates the row and leaves it open in anticipation of spatial and temporal locality. By structuring memory reads to stream non-temporal or sequential cache lines within the same page while carefully timing subsequent evictions, the attacker keeps the row asserted for the exact duration of \(t_{RAS}\).

// RowPress User-Space Aggressor Loop Primitive (C99 / x86-64)
#include <x86intrin.h>
#include <stdint.h>

void execute_rowpress_aggressor(volatile uint8_t *aggressor_page, 
                               volatile uint8_t *dummy_page, 
                               uint32_t iterations, 
                               uint64_t hold_cycles) {
    for (uint32_t i = 0; i < iterations; i++) {
        // Step 1: Read aggressor page to trigger DRAM Row Activation (ACT)
        volatile uint8_t val = *aggressor_page;
        (void)val;

        // Step 2: Busy-wait loop keeping the DRAM row open in the Row Buffer (t_RAS hold)
        uint64_t start = __rdtsc();
        while ((__rdtsc() - start) < hold_cycles) {
            _mm_pause(); // Low-power hyperthread pause avoiding CPU core throttle
        }

        // Step 3: Access dummy page located in the same DRAM bank
        // Coerces the memory controller to Precharge (PRE) the aggressor row!
        volatile uint8_t dummy_val = *dummy_page;
        (void)dummy_val;

        // Step 4: Flush cache lines to ensure subsequent accesses hit physical DRAM
        _mm_clflushopt((void*)aggressor_page);
        _mm_clflushopt((void*)dummy_page);
        _mm_mfence();
    }
}

5. Real-World Exploitation: Kernel Page Table Flipping & Sandbox Escapes

Just as with classic Rowhammer, the ultimate hazard of RowPress is the deterministic corruption of security-critical operating system abstractions. Security researchers demonstrated that RowPress can reliably flip bits in:

• Linux Page Table Entries (PTEs): By spraying the kernel physical memory with page tables via memory-mapping primitives, the attacker induces a bitflip in a PTE’s physical page frame number (PFN). This redirects the user-space process’s virtual mapping to point directly at arbitrary kernel memory, granting full read/write root execution.
• Cryptographic Key Corruption: Bitflips inside RSA or ECC private key memory structures allow attackers to compute private keys from single-fault signatures via Fault Analysis attacks.
• Hypervisor Virtual Machine Isolation: In multi-tenant cloud environments (AWS, GCP, Azure), a guest VM running an unprivileged RowPress primitive can induce bitflips in sibling VMs or the host KVM/QEMU hypervisor, completely shattering hardware isolation boundaries.

6. Mitigation Strategies & Next-Generation Memory Defenses

Neutralizing RowPress requires abandoning simplistic activation-counting heuristics in favor of energy-aware and hold-time-aware memory management:

1. Time-Weighted Refresh (TWR): Instead of counting discrete ACT commands, future memory controllers and on-die TRR modules must integrate a “disturbance accumulator” that credits row disturbance proportionally to elapsed active hold time:
   \[
   D_{\text{row}} = \sum_{k} \left( \alpha \cdot \mathbf{1}_{\text{toggle}} + \beta \cdot \Delta t_{\text{active}, k} \right)
   \]
   When \(D_{\text{row}}\) crosses the safety threshold, adjacent rows are scheduled for proactive refresh.
2. Restricted Row Active Time (\(t_{RAS,\max}\) Clamping): BIOS and memory controller firmware can enforce aggressive closed-page policies or clamp maximum open-row durations to sub-microsecond intervals. However, this incurs a non-trivial performance penalty of 3% to 9% on memory-bound database workloads due to frequent page reopenings.
3. DDR5 Dual-Die Architecture & Enhanced Per-Row Refresh (PRAC): The JEDEC DDR5 committee is drafting Per-Row Activation Counting (PRAC), an architectural protocol providing fully hardware-tracked activation budgets directly inside the DRAM die, preventing row starvation and unbounded hold times.

Nanoscale Silicon Failure Modes: GIDL, High-Aspect Capacitors & Sub-15nm Nodes

As DRAM manufacturing nodes scaled down from 20nm planar processes to advanced sub-15nm nodes (known in the industry as 1\(\alpha\), 1\(\beta\), and 1\(\gamma\) nm), the physical volume of each individual storage capacitor plummeted below \(0.001 \ \mu\text{m}^3\). To maintain the minimum capacitance necessary for signal margin (\(\approx 12 \text{ fF}\)), capacitor aspect ratios were forced to exceed 50:1.

In these ultra-dense pillar arrays, keeping an aggressor wordline asserted at high positive potential (\(V_{PP}\)) induces severe secondary solid-state failure modes:

• Gate-Induced Drain Leakage (GIDL): The intense electric field across the gate-to-drain overlap region of adjacent victim access transistors thins the energy barrier between the valence band and the conduction band, allowing valence electrons to tunnel directly into the conduction band via band-to-band tunneling (BTBT). This creates a continuous parasitic leakage current from the storage node to the substrate.
• Mechanical Piezoelectric Stress: Repeated or prolonged high-voltage wordline assertion induces localized mechanical strain in the surrounding inter-layer dielectric (ILD). In high-density DRAM, this strain alters the silicon bandgap (\(\Delta E_g\)), causing localized shifts in carrier mobility and accelerating capacitor dielectric leakage.
• The Hybrid “PressHammer” Threat: Attackers can combine rapid toggle bursts with periodic long-hold assertions. In empirical lab testing, this hybrid pattern lowers the required activation count to fewer than 180 cycles—a threshold so low that no existing or proposed on-die hardware counter can distinguish an attack from standard benign burst memory traffic.

Operating System Buddy Allocator Defenses & Page Frame Isolation

To protect cloud virtual machines against RowPress while hardware mitigations are drafted, Linux kernel researchers have proposed memory allocator defenses at the OS layer:

The Linux kernel’s physical page allocator (the Buddy Allocator) inherently allocates contiguous physical pages to processes requesting multi-page buffers. Attackers exploit this deterministic allocation order to place their aggressor pages physically adjacent to victim kernel page tables. By introducing Physical Page Frame Randomization (PFR) and Guard Rows (allocating sacrificial unmapped pages between security boundaries), the OS breaks the physical adjacency required for deterministic RowPress bitflips, increasing the attacker’s search space by over five orders of magnitude.

7. Institutional FAQ: DRAM RowPress Physical Vulnerability