DRAM stores bits as charge on tiny capacitors. Every read or refresh cycle briefly activates a row's wordline, which couples capacitively to physically adjacent wordlines. Normally the disturbance is negligible — refresh (every 64ms) tops the cells back up before charge leaks past the sense-amp threshold. But if you hammer a single row tens of thousands of times within one refresh window, the accumulated coupling drains enough charge from neighbor cells to flip a bit before refresh saves them.

The physics: Each wordline activation pulses ~1V. Adjacent wordlines see maybe 10-50mV of coupled noise per activation. That noise slightly disturbs the storage capacitor via the pass-transistor's gate leakage and subthreshold conduction. One hammer is invisible; 100,000 hammers in 64ms shifts a "1" cell (~1V stored) below the sense amp's decision threshold (~0.5V).

The classic exploit pattern (double-sided hammer):

• Pick a victim row V
• Repeatedly activate rows V-1 and V+1 in an alternating loop
• Force cache flushes (CLFLUSH) so every access hits DRAM, not the L1 cache
• After ~10⁵ activations, check V for flipped bits

Rule of thumb: Vulnerable DDR3 modules (2012-era, ~30nm process) flipped bits after roughly 139,000 activations per refresh interval. Sub-20nm DDR4 is worse, not better — cell capacitance shrank faster than coupling isolation improved. Some DDR4 parts flip after only 10,000-20,000 activations.

Real-world case: Google's Project Zero (2015) turned Row Hammer into a privilege escalation on Linux. By hammering DRAM near a page table entry, they flipped a bit in a PTE, converting a read-only user page mapping into one pointing to attacker-controlled memory — game over. This wasn't a software bug; it was DRAM physics defeating memory protection.

Mitigations:

• TRR (Target Row Refresh): DRAM tracks activation counts; rows nearing the threshold trigger a proactive refresh of their neighbors. DDR4 implementations were repeatedly bypassed by "TRRespass" patterns hammering many rows simultaneously.
• RFM (Refresh Management) in DDR5: standardized command lets the controller force targeted refresh.
• ECC: single-bit correction helps, but coordinated attacks can flip multiple bits in the same word.
• Doubling the refresh rate (32ms) — halves attack window, doubles refresh power.

Row Hammer is the poster child for abstraction leaks: memory looked like a perfect array of bits, until you pounded it hard enough to see the transistors underneath.