A team of researchers from the University of Toronto has demonstrated that Rohammer attacks against GPUs are possible and practical.
The attack method, dubbed GPUHammer, has been proven to work against a GPU from Nvidia, with the researchers using it to degrade the accuracy of machine learning models.
The Rowhammer attack method has been known for more than a decade. It involves repeatedly accessing — or hammering — a DRAM memory row, which can cause electrical interference that leads to bit flips in adjacent regions.
Researchers have demonstrated over the years that Rowhammer attacks can lead to privilege escalation, unauthorized access to data, data corruption, and breaking memory isolation (in virtualized environments).
However, until now, Rowhammer attacks have focused on CPUs and CPU-based memories. The University of Toronto researchers wanted to see if such attacks can be conducted against GPUs, particularly in light of their increasing use for artificial intelligence and machine learning.
The researchers managed to successfully conduct a Rowhammer attack against a GDDR6 memory in an NVIDIA A6000 GPU. They observed the impact of the GPUHammer attack on deep neural network (DNN) machine learning models, specifically ImageNet models used for visual object recognition.
Their tests showed that a single bit flip could result in the accuracy of the machine learning model dropping from 80% to 0.1%.
In an advisory published this week, Nvidia confirmed the findings and informed customers that System-level ECC (error correcting code) — a known Rowhammer mitigation — can prevent attacks. The GPU giant has shared specific instructions for different products.
However, the researchers pointed out that enabling ECC can reduce performance and memory capacity.
The researchers said their proof-of-concept (PoC) code is extensible to other GPUs based on Nvidia’s Ampere architecture.
As for why the attack hasn’t been tested against other GPUs, they argued that “unlike CPUs, where DRAM modules can be easily swapped out for testing, GPU DRAM is soldered in, making large-scale testing expensive (GPUs can cost thousands of dollars).”
The researchers have created a dedicated GPUHammer website and published a paper detailing their findings.
Related: ZenHammer Attack Targets DRAM on Systems With AMD CPUs
Related: Qualcomm Flags Exploitation of Adreno GPU Flaws, Urges OEMs to Patch Urgently
