{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T13:48:49Z","timestamp":1784555329517,"version":"3.55.0"},"reference-count":84,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100006785","name":"Google","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100006785","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00083","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"489-507","source":"Crossref","is-referenced-by-count":4,"title":["Phoenix: Rowhammer Attacks on DDR5 with Self-Correcting Synchronization"],"prefix":"10.1109","author":[{"given":"Diego","family":"Meyer","sequence":"first","affiliation":[{"name":"ETH Zurich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Patrick","family":"Jattke","sequence":"additional","affiliation":[{"name":"ETH Zurich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michele","family":"Marazzi","sequence":"additional","affiliation":[{"name":"ETH Zurich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Salman","family":"Qazi","sequence":"additional","affiliation":[{"name":"Google"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Daniel","family":"Moghimi","sequence":"additional","affiliation":[{"name":"Google"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kaveh","family":"Razavi","sequence":"additional","affiliation":[{"name":"ETH Zurich"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"crossref","DOI":"10.46586\/uasc.2025.001","article-title":"REFault: A Fault Injection Platform for Rowhammer Research on DDR5 Memory","volume-title":"\u00b5ASC \u201925","author":"Gloor"},{"key":"ref2","article-title":"McSee: Evaluating Advanced Rowhammer Attacks and Defenses via Automated DRAM Traffic Analysis","volume-title":"USENIX Security \u201925","author":"Jattke"},{"key":"ref3","doi-asserted-by":"crossref","DOI":"10.1109\/SP46214.2022.9833772","article-title":"BLACKSMITH: Scalable Rowhammering in the Frequency Domain","volume-title":"IEEE S&P \u201922","author":"Jattke"},{"key":"ref4","first-page":"747","article-title":"TRRespass: Exploiting the Many Sides of Target Row Refresh","volume-title":"IEEE S&P \u201920","author":"Frigo"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3466752.3480110"},{"key":"ref6","article-title":"ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms","volume-title":"USENIX Security \u201924","author":"Jattke"},{"key":"ref7","volume-title":"SK Hynix Takes Top Spot For First Time","year":"2025"},{"key":"ref8","volume-title":"SK Hynix surpasses Samsung in global DRAM market share for first time","year":"2025"},{"key":"ref9","first-page":"41","article-title":"SPEC CPU2017: NextGeneration Compute Benchmark","volume-title":"ICPE","author":"Bucek"},{"key":"ref10","volume-title":"DDR5 SDRAM","year":"2020"},{"key":"ref11","first-page":"361","article-title":"Flipping Bits In Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors","volume-title":"ISCA \u201914","author":"Kim"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3152701.3152709"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978406"},{"key":"ref14","doi-asserted-by":"crossref","DOI":"10.1109\/EuroSP63326.2025.00031","article-title":"Rubicon: Precise Microarchitectural Attacks with Page-Granular Massaging","volume-title":"EuroS&P \u201925","author":"B\u00f6lcskei"},{"key":"ref15","first-page":"245","article-title":"Another Flip in the Wall of Rowhammer Defenses","volume-title":"IEEE S&P \u201918","author":"Gruss"},{"key":"ref16","volume-title":"Project Zero: Exploiting the DRAM Rowhammer Bug to Gain Kernel Privileges","author":"Seaborn","year":"2015"},{"key":"ref17","first-page":"28","article-title":"PThammer: Cross-User-Kernel-Boundary Rowhammer through Implicit Accesses","volume-title":"MICRO \u201920","author":"Zhang"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93411-2_5"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3669940.3707242"},{"key":"ref20","first-page":"695","article-title":"RAMBleed: Reading Bits in Memory Without Accessing Them","volume-title":"IEEE S&P \u201920","author":"Kwong"},{"issue":"9","key":"ref21","doi-asserted-by":"crossref","first-page":"3586","DOI":"10.3390\/s22093586","article-title":"Extracting the Secrets of OpenSSL with RAMBleed","volume":"22","author":"Tomita","year":"2022","journal-title":"Sensors"},{"key":"ref22","first-page":"602","article-title":"Curious Case of Rowhammer: Flipping Secret Exponent Bits Using Timing Analysis","volume-title":"CHES \u201916","author":"Bhattacharya","year":"2016"},{"key":"ref23","first-page":"1157","article-title":"DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories","volume-title":"IEEE S&P \u201922","author":"Rakin"},{"key":"ref24","first-page":"497","article-title":"Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks","volume-title":"USENIX Security \u201919","author":"Hong"},{"key":"ref25","first-page":"1463","article-title":"DeepHammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips","volume-title":"USENIX Security \u201920","author":"Yao"},{"key":"ref26","first-page":"7718","article-title":"Proflip: Targeted trojan attack with progressive bit flips","volume-title":"IEEE ICCV \u201921","author":"Chen"},{"key":"ref27","article-title":"Flip Feng Shui: Hammering a Needle in the Software Stack","volume-title":"USENIX Security","author":"Razavi"},{"key":"ref28","first-page":"19","article-title":"One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation","volume-title":"USENIX Security \u201916","author":"Xiao"},{"key":"ref29","article-title":"SMASH: Synchronized Many-sided Rowhammer Attacks From JavaScript","volume-title":"USENIX Security \u201921","author":"De Ridder"},{"key":"ref30","article-title":"Posthammer: Pervasive Browser-Based Rowhammer Attacks with Postponed Refresh Commands","volume-title":"USENIX Security \u201925","author":"Ridder"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_15"},{"key":"ref32","doi-asserted-by":"crossref","DOI":"10.1109\/SP.2016.63","article-title":"Dedup Est Machina: Memory Deduplication as an Advanced Exploitation Vector","volume-title":"IEEE S&P \u201916","author":"Bosman"},{"key":"ref33","doi-asserted-by":"crossref","DOI":"10.1109\/SP.2018.00022","article-title":"Grand Pwning Unit: Accelerating Microarchitectural Attacks with the GPU","volume-title":"IEEE S&P \u201918","author":"Frigo"},{"key":"ref34","article-title":"Throwhammer: Rowhammer Attacks over the Network and Defenses","volume-title":"USENIX ATC \u201918","author":"Tatar"},{"key":"ref35","first-page":"710","article-title":"Nethammer: Inducing Rowhammer Faults Through Network Requests","volume-title":"EuroS&PW","author":"Lipp"},{"key":"ref36","first-page":"638","article-title":"Revisiting RowHammer: An Experimental Analysis of Modern DRAM Devices and Mitigation Techniques","volume-title":"ISCA","author":"Kim"},{"key":"ref37","first-page":"18","volume-title":"Half-Double: Hammering From the Next Row Over","author":"Kogler"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-64171-8_24"},{"key":"ref39","article-title":"Blaster: Characterizing the blast radius of rowhammer","volume-title":"DRAMSec \u201923","author":"Lang"},{"key":"ref40","first-page":"735","article-title":"ProTRR: Principled yet Optimal In-DRAM Target Row Refresh","volume-title":"IEEE S&P \u201922","author":"Marazzi"},{"key":"ref41","first-page":"15","article-title":"ZebRAM: Comprehensive and Compatible Software Protection Against Rowhammer Attacks","volume-title":"USENIX OSDI \u201918","author":"Konoth"},{"key":"ref42","article-title":"CAn\u2019t Touch This: Software-Only Mitigation against Rowhammer Attacks targeting Kernel Memory","volume-title":"USENIX Security","author":"Brasser"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132781"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2954679.2872390"},{"key":"ref45","first-page":"399","article-title":"\\{SoftTRR\\}: Protect page tables against rowhammer attacks using software-only target row refresh","volume-title":"USENIX ATC \u201922","author":"Zhang"},{"key":"ref46","article-title":"Copy-onFlip: Hardening ECC Memory Against Rowhammer Attacks","volume-title":"NDSS \u201923","author":"Dio"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304039"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3470496.3527421"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507716"},{"key":"ref50","first-page":"345","article-title":"BlockHammer: Preventing RowHammer at Low Cost by Blacklisting Rapidly-Accessed DRAM Rows","volume-title":"HPCA \u201921","author":"Ya\u011flik\u00e7i"},{"key":"ref51","first-page":"915","article-title":"BreakHammer: Enhancing RowHammer Mitigations by Carefully Throttling Suspect Threads","volume-title":"2024 57th IEEE\/ACM International Symposium on Microarchitecture (MICRO)","author":"Canpolat"},{"key":"ref52","volume-title":"ABACuS: All-Bank Activation Counters for Scalable and Low Overhead RowHammer Mitigation","author":"Olgun","year":"2023"},{"key":"ref53","first-page":"578","article-title":"START: Scalable Tracking for any Rowhammer Threshold","volume-title":"HPCA \u201924","author":"Saxena"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3620665.3640404"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3631882.3631886"},{"key":"ref56","first-page":"13","article-title":"Graphene: Strong yet Lightweight Row Hammer Protection","volume-title":"MICRO \u201920","author":"Park"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3307650.3322232"},{"issue":"1","key":"ref58","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1109\/LCA.2016.2614497","article-title":"Counter-Based Tree Structure for Row Hammering Mitigation in DRAM","volume":"16","author":"Seyedzadeh","year":"2017","journal-title":"IEEE Computer Architecture Letters"},{"key":"ref59","first-page":"1684","article-title":"REGA: Scalable Rowhammer Mitigation with Refresh-Generating Activations","volume-title":"IEEE S&P \u201923","author":"Marazzi"},{"key":"ref60","first-page":"1156","article-title":"Mithril: Cooperative row hammer protection on commodity dram leveraging managed refresh","volume-title":"HPCA \u201922","author":"Kim"},{"key":"ref61","first-page":"899","article-title":"Mint: Securely Mitigating Rowhammer with a Minimalist in-DRAM Tracker","volume-title":"MICRO \u201924","author":"Qureshi"},{"key":"ref62","volume-title":"MOAT: Securely Mitigating Rowhammer with Per-Row Activation Counters","author":"Qureshi","year":"2024"},{"key":"ref63","first-page":"593","article-title":"CoMeT: Count-min-sketch-based row tracking to mitigate RowHammer at low cost","volume-title":"HPCA \u201924","author":"Bostanci"},{"key":"ref64","volume-title":"ImPress: Securing DRAM Against Data-Disturbance Errors via Implicit Row-Press Mitigation","author":"Qureshi","year":"2024"},{"key":"ref65","first-page":"1021","article-title":"Qprac: Towards secure and practical prac-based rowhammer mitigation using priority queues","volume-title":"HPCA \u201925","author":"Woo"},{"key":"ref66","first-page":"887","article-title":"Chronus: Understanding and securing the cutting-edge industry solutions to dram read disturbance","volume-title":"HPCA \u201925","author":"Canpolat"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3061639.3062281"},{"key":"ref68","volume-title":"DSAC: Low-Cost Rowhammer Mitigation Using In-DRAM Stochastic and Approximate Counting Algorithm","author":"Hong","year":"2023"},{"key":"ref69","volume-title":"Data Center RDIMM DDR5 Tester antmicro\/ddr5-tester@rev.1.0.1-production","year":"2022"},{"key":"ref70","article-title":"FT20X Supercapacitor Datasheet","volume-title":"technical Datasheet","year":"2020"},{"key":"ref71","article-title":"LiteX Rowhammer Tester","volume-title":"Antmicro","year":"2021"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_3"},{"key":"ref73","article-title":"Half-Double: Next-Row-Over Assisted Rowhammer","volume-title":"Google LLC, Tech. Rep.","year":"2021"},{"key":"ref74","doi-asserted-by":"crossref","DOI":"10.1109\/SP.2019.00089","article-title":"Exploiting Correcting Codes: On the Effectiveness of ECC Memory Against Rowhammer Attacks","volume-title":"IEEE S&P \u201919","author":"Cojocar"},{"key":"ref75","article-title":"ECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory","volume-title":"USENIX Security \u201925","author":"Kamadan"},{"key":"ref76","volume-title":"JESD79-5C: Double Data Rate 5 (DDR5) SDRAM","year":"2024"},{"key":"ref77","first-page":"7","article-title":"Panopticon: A Complete In-DRAM Rowhammer Mitigation","volume-title":"DRAMSec","author":"Bennett"},{"key":"ref78","first-page":"1597","article-title":"SledgeHammer: Amplifying Rowhammer via Bank-level Parallelism","volume-title":"USENIX Security \u201924","author":"Kang"},{"key":"ref79","article-title":"RISC-H: Rowhammer Attacks on RISC-V","volume-title":"DRAMSec \u201924","author":"Marazzi"},{"key":"ref80","first-page":"2615","article-title":"Branch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by Exploiting Branch Predictor Race Conditions","volume-title":"USENIX Security \u201925","author":"R\u00fcegge"},{"key":"ref81","first-page":"7179","article-title":"Downfall: Exploiting Speculative Data Gathering","volume-title":"USENIX Security \u201923","author":"Moghimi"},{"key":"ref82","first-page":"1491","article-title":"Augury: Using Data Memory-Dependent Prefetchers to Leak Data at Rest","volume-title":"IEEE S&P \u201922","author":"Vicarte"},{"key":"ref83","article-title":"FLOP: Breaking the Apple M3 CPU via False Load Output Predictions","volume-title":"USENIX Security \u201925","author":"Kim"},{"key":"ref84","first-page":"3549","article-title":"SLAP: Data Speculation Attacks via Load Address Prediction on Apple Silicon","volume-title":"IEEE S&P \u201925","author":"Kim"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573456.pdf?arnumber=11573456","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:27:38Z","timestamp":1782970058000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573456\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":84,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00083","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}