2018 – 2026
Between 2018 and 2026, I investigated the physical and architectural foundations of Rowhammer vulnerabilities in dynamic random-access memory (DRAM). As semiconductor manufacturing processes scaled down to nanoscale dimensions, DRAM capacitors became increasingly tightly packed, enabling electromagnetic coupling between adjacent memory rows. By repeatedly activating (hammering) aggressive rows of memory, adversaries can induce electrical disturbance and cause bits to flip in victim rows without ever accessing them. This undermines the hardware root of trust, breaking fundamental operating system abstractions, hypervisors, and cryptographic isolations.
My early work focused on uncovering microarchitectural primitives that dramatically enhance the feasibility and speed of Rowhammer attacks. In SPOILER (USENIX Security 2019, CVE-2019-0162), we discovered that speculative load-store forwarding logic in modern CPUs leaks information about physical memory layout to unprivileged user space. By exploiting this leakage, SPOILER enabled rapid discovery of contiguous physical pages, accelerating Rowhammer attacks by orders of magnitude—even from restricted sandboxes like JavaScript. Further expanding the attack surface beyond traditional CPUs, we introduced JackHammer (ACM TECS 2019), demonstrating that untrusted FPGA accelerators sharing the coherent memory bus with CPUs can trigger devastating Rowhammer bit flips while bypassing conventional CPU-side monitoring.
As memory manufacturers introduced hardware mitigations such as Target Row Refresh (TRR) and on-die error correction (ODECC), Rowhammer defenses often relied on security through obscurity. To address this, we developed SoothSayer (DRAMSec 2024), demonstrating how to bypass proposed hardware defenses like DSAC by predicting counter replacements. More recently, in Phoenix (IEEE S&P 2026), we demonstrated that DDR5 memory modules equipped with on-die ECC remain vulnerable to Rowhammer via self-correcting synchronization patterns. At Google, I actively advocate for open, verifiable hardware defenses and support Rowhammer research to protect the DRAM ecosystem through academic partnerships and vulnerability disclosure.