HW-ROWHAMMERPrivilege Escalation

Rowhammer Bit Flip

Hammer adjacent DRAM rows to flip bits in a target page — used to escape JavaScript sandboxes, escalate from user to root, defeat ECC.

§ Where this technique fits

HW-ROWHAMMER is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Rowhammer → bit flip → in-browser sandbox escape
JavaScript hammers adjacent DRAM rows for tens of seconds; an unlucky-for-defender bit flip in a page-table entry hands the attacker a write primitive into another mapping. RIDL-class chain to native code.
step 2 / 6

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Rowhammer → bit flip → in-browser sandbox escape

§ What commonly comes next