Loading story…
Researchers disclosed two GPU-based Rowhammer techniques, GDDRHammer and GeForge, that can induce bit flips in GDDR6 VRAM on certain Nvidia GPUs and break memory isolation. Tests showed the attacks against Ampere-era cards including the RTX 3060 and RTX A6000/RTX 6000, where corrupted GPU page tables or page directories allowed attackers to gain read/write access to protected VRAM regions and, in some cases, remap access into host memory. The researchers said this could escalate from GPU compromise to full control of the machine, including root-level access to system memory.
The reports said the attacks require an adversary to already run code on the target system, making shared GPU environments such as AI clusters a more plausible risk than a purely remote attack path. No in-the-wild exploitation has been reported, but the findings highlight a hardware security gap in systems where GPUs can directly access host memory. Recommended mitigations include enabling IOMMU in BIOS to restrict device DMA access to sensitive system memory and turning on ECC on supported GPUs, though both measures can impose performance or memory-capacity tradeoffs and ECC may not block every Rowhammer variant.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The researchers said enabling IOMMU in BIOS can mitigate host-memory compromise by restricting GPU access to sensitive system memory, and enabling GPU ECC can reduce risk though with performance and memory tradeoffs. They also noted no known in-the-wild exploitation and warned that newer GPUs could potentially be susceptible even though tested impact was limited to certain Ampere-generation GDDR6 cards.
Researchers reported two new GPU-based Rowhammer attacks, GDDRHammer and GeForge, that induce bit flips in GDDR6 VRAM to corrupt GPU memory-management structures. They showed this can break VRAM isolation on affected Nvidia GPUs, including RTX 3060 and RTX 6000/A6000 models, and in some cases enable read/write access to host system memory and full machine compromise.
University of Toronto researchers disclosed GPUBreach on November 11, 2025, to NVIDIA, Google, AWS, and Microsoft. The attack uses Rowhammer-induced GDDR6 bit flips plus NVIDIA driver memory-safety bugs to achieve arbitrary GPU memory access and CPU-side privilege escalation, reportedly bypassing IOMMU protections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcekaspersky.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcegddr.fail
Open sourcegpuhammer.com
Open sourcegddr.fail
Open sourcegddr.fail
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Rowhammer** remains a practical hardware security threat, with the newer **Phoenix** technique showing that **DDR5** memory can still be manipulated despite built-in protections. The attack revives a flaw first highlighted by Google Project Zero, which demonstrated that repeatedly accessing DRAM rows could trigger adjacent bit flips and be weaponized for **privilege escalation** on x86 systems, including a Linux kernel exploit that altered page table entries and a sandbox escape from **Google Native Client**. The newer findings indicate that DDR5 mitigations have not eliminated the underlying risk, extending concerns that began with widespread **DDR3** exposure across tested laptop models. Earlier research had already shown Rowhammer was more than a reliability issue, and the latest reports suggest modern memory modules remain susceptible to carefully engineered disturbance attacks that can undermine isolation boundaries and system integrity, renewing pressure on hardware vendors to disclose affected products and strengthen defenses.
Jun 29, 2026
NVIDIA DGX Spark GB10 systems are affected by two critical vulnerabilities, CVE-2025-33187 and CVE-2025-33188, which could allow attackers to escalate privileges and manipulate hardware controls. CVE-2025-33187 is a critical flaw in the SROOT component, enabling attackers with privileged access to gain entry to SoC protected areas, potentially resulting in code execution, information disclosure, data tampering, denial of service, or further privilege escalation. CVE-2025-33188 involves hardware resource manipulation, where successful exploitation could lead to information disclosure, data tampering, or denial of service. Both vulnerabilities are not remotely exploitable but pose significant risks if local access is obtained. NVIDIA has released critical patches to address these vulnerabilities, with CVE-2025-33187 carrying a CVSS score of 9.3 and CVE-2025-33188 rated at 8.0. Organizations using NVIDIA DGX Spark hardware are urged to apply the updates immediately to mitigate the risk of exploitation. The vulnerabilities highlight the importance of securing AI infrastructure, as exploitation could expose sensitive AI secrets and compromise system integrity. No affected product versions have been explicitly listed, but the advisories emphasize the urgency of remediation for all DGX Spark GB10 deployments.
Jun 29, 2026
A critical vulnerability, identified as CVE-2025-0033 and dubbed RMPocalypse, has been discovered in AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. This flaw allows attackers to bypass the core security guarantees of SEV-SNP, which is designed to protect the confidentiality and integrity of virtual machines (VMs) even in hostile environments. Researchers from ETH Zürich revealed that the vulnerability stems from incomplete protections in the initialization of the Reverse Map Paging (RMP) table, a key data structure that stores security metadata for all DRAM pages in the system. The RMP table, which maps system physical addresses to guest physical addresses, is only partially protected during VM startup, creating a window of opportunity for exploitation. By performing a single, carefully crafted 8-byte memory write to the RMP table, an attacker can corrupt its contents, undermining the isolation between VMs and the hypervisor. This attack vector enables adversaries with sufficient access to bypass SEV-SNP's hardware-enforced boundaries, potentially gaining full control over encrypted VMs. The implications are severe: attackers could access sensitive data, activate hidden debug functions, forge attestation checks, and even perform replay attacks by restoring previous VM states. AMD has acknowledged the issue and released firmware updates to address the vulnerability, urging customers to apply the patches promptly. The flaw highlights a fundamental challenge in confidential computing, where the security of the underlying mechanisms is as critical as the protections they provide. The vulnerability is particularly concerning for cloud service providers and enterprises relying on SEV-SNP for secure multi-tenant environments. Security experts recommend immediate patching and a review of VM isolation strategies in light of this disclosure. The RMPocalypse flaw demonstrates that even advanced hardware-based security features can be undermined by subtle implementation oversights. The research underscores the importance of rigorous security validation for all components involved in confidential computing. Organizations are advised to monitor for further advisories from AMD and to assess the potential exposure of their virtualized workloads. The incident serves as a reminder that attackers continue to seek and exploit weaknesses in foundational security technologies. The public disclosure of RMPocalypse has prompted renewed scrutiny of hardware-assisted virtualization security. The vulnerability's exploitation requires a high level of technical skill but poses a significant risk to environments where SEV-SNP is deployed. AMD's response includes not only patches but also updated guidance for secure deployment of SEV-SNP-enabled systems. The security community is closely watching for any signs of exploitation in the wild following the release of technical details. This event is expected to influence future designs of confidential computing architectures across the industry.
Jun 29, 2026