Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a Rowhammer attack (on X86, ARM, via JavaScript or remote), I am curious to know whether, from a practical point of view, it is still more of a conceptual attack than being an attack vector that is actively exploited.

So far, my research did not come up with a single security incident that could be attributed to Rowhammer.

  • 7
    Remember that most attacks do not get publicity. In fact, many attacks aren't even noticed.
    – forest
    Commented Jan 2, 2019 at 13:15
  • 1
    +1 to Forest. Here is a whitepaper/presentation given on the topic at Blackhat in 2015. They even have github demo code. blackhat.com/docs/us-15/materials/…
    – thepip3r
    Commented Jan 2, 2019 at 20:46
  • Thanks thepip3r. I am aware of the PoC and all the work of other folks like Gruss et al. who are actively pushing things w.r.t Rowhammer issue. Given all the exploitable systems and different approaches to circumvent most mitigation techniques (including TRR, MAC, doubles refresh rate, etc.) this question arised, as I was expecting that somebody must have observed RH-attacks in the wild. Commented Jan 3, 2019 at 8:41
  • @user1192748 Would a totally anecdotal "yes, because I've used it in the wild" answer count, or does it need to involve a large-scale and highly publicized breach?
    – forest
    Commented Feb 21, 2019 at 6:59

1 Answer 1


It is not observed by us (or better said not widely reported) because it generally was considered impractical. But in several occasions, even recently, it has been demonstrated to be doable (at blackhat too).

So Row-hammer attacks are still a realistic threat even to modern systems, which is most disturbing. Since defenses get better, attackers will likely target more hardware bugs, even if the hardware must me more specific.

I think we will see something public if the attacked target will be large/important enough.

RH resources here

Also see DRAMMER

  • I always find it problematic to state that something is "not observed". Maybe there is a paper in Spanish, Japanese or Suaheli that you (and a lot of other people) did not read. I would suggest "not widely reported".
    – Tom K.
    Commented Jan 21, 2019 at 12:54
  • I agree. I meant not observed by us users.
    – Overmind
    Commented Jan 21, 2019 at 13:14
  • 2
    "Since defenses get better" Reference please :) Commented Jun 9, 2021 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .