Posthammer - Pervasive Browser-based Rowhammer Attacks with Postponed Refresh Commands

Explore a groundbreaking conference presentation that introduces Posthammer, a novel JavaScript-based Rowhammer attack technique that significantly enhances the effectiveness of browser-based memory exploitation. Learn how researchers from ETH Zurich developed a method to force CPU memory controllers to postpone refresh commands by creating strategic patterns of intense Rowhammer activity followed by calculated delay windows, enabling the memory controller to batch refresh commands and bypass in-DRAM mitigations. Discover the innovative "lane" abstraction that allows selective addressing within Rowhammer patterns, enabling more frequent access to specific memory addresses and supporting effective refresh-postponed non-uniform patterns in browser environments for the first time. Understand the comprehensive evaluation methodology that demonstrates Posthammer's superior performance, achieving 2.8× greater effectiveness than existing state-of-the-art techniques and successfully triggering bit flips on 86% of 28 tested DDR4 devices compared to the limited success rate of traditional browser-based Rowhammer attacks. Gain insights into the security implications of this research for client systems and the evolving landscape of browser-based memory corruption attacks, presented as part of the USENIX Security '25 technical program.