Nvidia chips become the first GPUs to fall to Rowhammer bit-flip attacks

Nvidia has issued guidance for users of one of its GPU product lines, advising them of a necessary mitigation that could lead to a performance reduction of up to 10 percent. This preventive measure aims to shield customers from potential exploits that could compromise their work and data integrity. The recommendation follows a demonstration by a group of academic researchers who successfully executed an attack on Nvidia’s RTX A6000. This GPU, widely utilized for high-performance computing and available through numerous cloud platforms, was shown to be vulnerable to Rowhammer—a type of attack that exploits inherent weaknesses in DRAM chip modules. Rowhammer attacks manipulate data stored in memory by repeatedly accessing—effectively 'hammering'—specific rows of memory cells. This process can cause bit flips in adjacent rows, converting digital zeros to ones and vice versa. While Rowhammer had previously only been demonstrated against memory chips in CPUs, the recent research unveiled GPUhammer, marking the first successful Rowhammer exploit on a discrete GPU. Traditionally, GPUs have been leveraged for graphics rendering and password cracking. However, their role has evolved significantly, becoming crucial in high-performance computing, machine learning, and various AI applications. Nvidia, a key player in this AI and HPC surge, recently marked a historic milestone by achieving a $4 trillion valuation. Though the researchers tested their exploit only on the A6000, they suggested that other Nvidia GPUs could also be susceptible to this attack. Their proof-of-concept exploit was capable of interfering with deep neural network models that are vital in machine learning applications, including autonomous driving, healthcare diagnostics, and MRI image analysis. The GPUHammer attack can flip a single bit in a model weight's exponent, which could drastically alter its value—potentially by 128 times—leading to a significant drop in model accuracy from 80 percent to a mere 0.1 percent, as explained by Gururaj Saileshwar, an assistant professor at the University of Toronto and co-author of the research paper outlining the attack.