GPUHammer: Rowhammer Attacks on GPU Memories are Practical

TL;DR

This paper demonstrates the first practical Rowhammer attack on NVIDIA GPUs with GDDR6 memory, revealing vulnerabilities that can compromise machine learning models by inducing bit-flips.

Contribution

It introduces GPUHammer, a novel technique to perform Rowhammer attacks on GDDR6 GPU memory, including reverse-engineering memory mappings and bypassing mitigations.

Findings

Successful bit-flip injection on NVIDIA A6000 GPU

Up to 80% accuracy drop in ML models due to bit-flips

Novel techniques for reverse-engineering GDDR memory mappings

Abstract

Rowhammer is a read disturbance vulnerability in modern DRAM that causes bit-flips, compromising security and reliability. While extensively studied on Intel and AMD CPUs with DDR and LPDDR memories, its impact on GPUs using GDDR memories, critical for emerging machine learning applications, remains unexplored. Rowhammer attacks on GPUs face unique challenges: (1) proprietary mapping of physical memory to GDDR banks and rows, (2) high memory latency and faster refresh rates that hinder effective hammering, and (3) proprietary mitigations in GDDR memories, difficult to reverse-engineer without FPGA-based test platforms. We introduce GPUHammer, the first Rowhammer attack on NVIDIA GPUs with GDDR6 DRAM. GPUHammer proposes novel techniques to reverse-engineer GDDR DRAM row mappings, and employs GPU-specific memory access optimizations to amplify hammering intensity and bypass mitigations. Thus, we demonstrate the first successful Rowhammer attack on a discrete GPU, injecting up to 8 bit-flips across 4 DRAM banks on an NVIDIA A6000 with GDDR6 memory. We also show how an attacker can use these to tamper with ML models, causing significant accuracy drops (up to 80%).