arXiv: Demystifying DRAM Read Disturbance: Bridging the Gap Between Experimental Characterization and Device-Level Modeling of RowHammer and RowPress Phenomena

This publication is a technical research paper, not a regulatory change, but it has significant compliance implications for hardware security. The paper presents a new framework for understanding and modeling DRAM read disturbance phenomena, specifically RowHammer and the newer RowPress attack. It bridges the gap between experimental chip-level testing and device-level physics, offering a more accurate predictive model for when and how these memory corruption attacks occur. This is a major step forward because previous models were often imprecise, leading to either over-engineered mitigations or unaddressed vulnerabilities.

The primary affected organizations are cloud service providers, data center operators, and any enterprise relying on high-density DRAM, as well as hardware manufacturers and semiconductor designers. Sectors handling sensitive data, such as finance, healthcare, and critical infrastructure, are indirectly at risk because these attacks can bypass software security and compromise the integrity of the underlying memory. For compliance teams, this paper signals that the threat landscape for memory corruption is evolving beyond RowHammer to include RowPress, which is more efficient and harder to detect.

Compliance teams should not wait for a formal regulatory update. First, review current hardware security controls and vendor advisories to confirm whether your DRAM inventory is vulnerable to RowPress. Second, update your risk assessment and incident response playbooks to include memory disturbance attacks as a distinct threat vector. Finally, engage with your hardware vendors to understand their mitigation strategies and request evidence of testing against the new model described in this paper, ensuring your procurement standards reflect the latest scientific understanding.