Exploiting the DRAM rowhammer bug to gain kernel privileges
Summary: Google Project Zero's Mark Seaborn, with Thomas Dullien, built two working privilege escalation exploits from the DRAM rowhammer bug, in which repeatedly accessing a row of memory causes bit flips in adjacent rows. One exploit uses rowhammer-induced bit flips in page table entries to gain kernel privileges on x86-64 Linux as an unprivileged userland process, and the other escapes the Native Client sandbox; they mitigated the latter by disallowing CLFLUSH in NaCl's x86 validator (CVE-2015-0565).
What's compelling: The researchers do not know how many machines are vulnerable or how many existing vulnerable machines are fixable, and they observed 25+ bits flipped in one row on one particularly fragile machine - a hardware-level fault that no software patch fully closes.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026