Researchers from the University of Toronto have presented the first Rowhammer-class attack applied to distort the contents of video memory. The ability to carry out an attack, leading to the substitution of up to 8 bits of data, has been demonstrated on the discrete NVIDIA A6000 GPU equipped with GDDR6 video memory. As a practical example, it was shown how such distortion can interfere with the execution of machine learning models and significantly (from 80% to 0.1%) reduce the accuracy of their results by changing just one bit.
Until now, creating Rowhammer-class attacks for video memory has been complicated by the difficulty of determining the physical layout of memory in GDDR chips, large memory access latencies (4 times slower), and higher memory refresh rates. Additionally, proprietary anti-tampering mechanisms in GDDR chips that lead to premature charge loss hindered research, requiring the creation of specialized hardware test benches based on FPGAs for analysis.
To study video memory, researchers developed a new reverse engineering technique for GDDR DRAM, and in the attack, optimizations for accessing memory used for parallel computing were employed as intensity amplifiers for accessing individual cells. Low-level CUDA code was used for the attack on the NVIDIA GPU.
In user CUDA code, physical memory addresses are not accessed, but the NVIDIA driver mirrored virtual memory onto the same physical memory, which the researchers took advantage of to compute the offset of virtual memory and determine the layout of memory banks. Recognition of accesses to different memory banks was achieved through analyzing delays that varied when accessing one or different memory banks.
In systems that share GPUs, such as servers To perform machine learning models, the attack allows one user to alter the video memory contents with data from another user. As a protective measure, NVIDIA recommends enabling error correction codes (ECC, Error Correction Codes) using the command "nvidia-smi -e 1" or utilizing graphics card series with OD-ECC (On-Die ECC) support, such as GeForce RTX 50, RTX PRO, GB200, B200, B100, H100, H200, H20, and GH200.
According to researchers, enabling ECC on A6000 GPU systems leads to approximately a 10% reduction in the performance of machine learning models and a 6.25% decrease in memory capacity. The toolkit for conducting the attack and performing reverse engineering of low-level video memory layout on systems with NVIDIA GPUs has been published on GitHub.
The RowHammer attack allows for the corruption of individual bits in DRAM memory by cyclically reading data from adjacent memory cells. Since DRAM memory is a two-dimensional array of cells, each comprising a capacitor and a transistor, continuous reading of the same memory region leads to voltage fluctuations and anomalies that cause slight charge loss in neighboring cells. If the reading intensity is high, an adjacent cell may lose a significant amount of charge, and the subsequent refresh cycle may not restore its original state, resulting in altered data stored in the cell.
The Rowhammer attack method was proposed in 2014, after which a game of 'cat and mouse' began between security researchers and hardware manufacturers — memory chip makers attempted to block the vulnerability while researchers discovered new ways to circumvent it. For example, to protect against Rowhammer, manufacturers added the TRR (Target Row Refresh) mechanism, but it turned out to block cell distortion only in specific cases and does not guard against all possible attack variants. Attack methods have been developed for DDR3, DDR4, and DDR5 chips on systems with Intel, AMD, and ARM processors. Ways to bypass ECC error correction have also been discovered, with suggested methods for conducting attacks over the network and via executing JavaScript code in the browser.
Source: opennet.ru
