Researchers from several universities in the USA and Australia have developed two Rowhammer-class attacks — GDDRHammer and GeForge — that allow bit flipping in GDDR memory chips when executing an unprivileged CUDA kernel on NVIDIA GPUs. Unlike the GPUHammer method introduced last year, the new attacks are not limited to affecting data processed in GPU memory; they provide full access to all main memory related to the CPU's address space. The researchers have demonstrated exploits that provide root access to the main system while running an unprivileged CUDA kernel on the GPU.
Both attacks achieve premature charge loss in specific memory cells of the video memory to which attackers do not have direct access, leading to changes in the bits stored in those cells. The ability to read and write to memory related to the CPU's address space is implemented by interfering with the operation of the GPU memory allocator (cudaMalloc) to break the isolation of GPU memory and map GPU virtual addresses to arbitrary physical memory addresses of the GPU or CPU.
The interference is carried out by flipping bit values in the video memory, where the page tables for GPU memory are stored, which are responsible for translating virtual addresses to physical addresses. The differences between the GDDRHammer and GeForge attacks boil down to the fact that the GDDRHammer method modifies the last level page table (PT — Last Level Page Table), while the GeForge method modifies the last level page directory (PD0 — Last Level Page Directory).
Among other things, the specified address translation tables are used to organize direct access from the GPU to the CPU memory, so changing the address in the GPU page table to a physical address in the main RAM and setting the APERTURE flag, which enables CPU memory mapping mode, allows reading and writing data with access to main memory over the PCIe bus with IOMMU disabled (by default off).
Successful attacks have been demonstrated on high-performance professional NVIDIA RTX A6000 graphics cards based on the Ampere microarchitecture (new cards starting at $6850 and used ones at $4000) as well as consumer models like the NVIDIA RTX 3060 ($250-300). The developed bypass techniques for Rowhammer protection, combined with the utilization of parallel processing capabilities provided by the GPU, allowed for a 64-fold increase in the frequency of cell distortion compared to previous attacks. As a temporary measure to block attacks, the team can enable ECC (Error Correcting Codes) error correction mode using the command "nvidia-smi -e 1", although this incurs additional overhead and can potentially be circumvented using attack methods such as ECCploit and ECC.fail.
The RowHammer attack allows for the corruption of individual bits in DRAM memory by cyclically reading data from adjacent memory cells. Since DRAM memory is a two-dimensional array of cells, each comprising a capacitor and a transistor, continuous reading of the same memory region leads to voltage fluctuations and anomalies that cause slight charge loss in neighboring cells. If the reading intensity is high, an adjacent cell may lose a significant amount of charge, and the subsequent refresh cycle may not restore its original state, resulting in altered data stored in the cell.
The Rowhammer attack method was proposed in 2014, after which a game of 'cat and mouse' began between security researchers and hardware manufacturers — memory chip manufacturers attempted to block the vulnerability while researchers found new ways to exploit it. For instance, to protect against Rowhammer, chip manufacturers added a TRR (Target Row Refresh) mechanism, but it turned out that it only prevents cell distortion in specific cases and does not protect against all possible attack variants. Attack methods were developed for DDR3, DDR4, and DDR5 chips on systems with Intel, AMD, and ARM processors, as well as for GDDR memory in NVIDIA GPUs. Additionally, ways to bypass ECC error correction were discovered, along with options for executing network attacks and running JavaScript code in a browser.
Source: opennet.ru
