Feasibility of long-term Jenga-state manipulation under memory throttling

Investigate whether an attacker can progressively manipulate different DRAM rows across multiple memory-throttling windows until a sufficiently adverse PRAC counter state is reached, while tracking or predicting state evolution during periods when the attacker is not executing, including the effects of genuine tasks and periodic REF commands.

Background

The Jenga attack relies on preparing an adverse internal state in the PRAC counters before a victim task executes. Memory-throttling mechanisms such as MemGuard can limit the attacker’s memory-access rate and thereby slow construction of the adversarial state, but the paper argues that they do not fundamentally prevent gradual manipulation across multiple time windows.

The unresolved issue is whether such a long-term attack remains practically feasible when the attacker must account for counter evolution caused by genuine tasks and periodic DRAM refreshes during intervals in which the attacker is not running.

References

Successfully carrying out such an attack would, however, require tracking or predicting the evolution of the memory state while the attacker is not executing, including the effects of genuine tasks and periodic REF commands. Investigating the feasibility of such long-term manipulations constitutes an interesting direction for future work.

— JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability  (2609.01077 - Abgrall et al., 1 Sep 2026) in Section “Mitigative Refresh Granularity and Memory Throttling”