Nvidia Ampere GPUs Vulnerable to Rowhammer Exploit
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- GDDRHammer induced an average of 129 bitflips per memory bank on Nvidia RTX 6000 Ampere GPUs, a 64‑fold increase over the prior GPURow attack, and allowed manipulation of GPU page tables to read/write GPU memory.
- GeForge achieved 1,171 bitflips on an RTX 3060 and 202 bitflips on an RTX 6000, corrupting the last‑level page directory to gain arbitrary read/write access to GPU memory and subsequently to host CPU memory, opening a root shell.
- GPUBreach exploited memory‑safety bugs in the Nvidia driver to corrupt metadata in permitted buffers, bypassing IOMMU protection and escalating privileges to a root shell even when IOMMU is enabled.
- IOMMU must be disabled for GDDRHammer and GeForge to succeed, as they rely on moving GPU page tables into unprotected memory regions, whereas GPUBreach works without disabling it.
- Nvidia’s Ampere‑generation GPUs (RTX 6000, RTX 3060) are vulnerable, while newer Ada‑generation RTX 6000 models using a different GDDR variant were not affected by the attacks.
Why it matters: Cloud providers and enterprises sharing expensive Nvidia GPUs face a new attack vector that lets unprivileged users hijack the host system, undermining isolation guarantees and forcing a rethink of GPU‑centric security mitigations. The attacks also demonstrate that existing CPU‑focused Rowhammer defenses are insufficient, compelling hardware vendors and OS developers to extend protections to GPU memory and driver code.
