GPU Rowhammer Attacks on Nvidia Cards Can Lead to Full System Compromise

Researchers disclosed two GPU-based Rowhammer techniques, GDDRHammer and GeForge, that can induce bit flips in GDDR6 VRAM on certain Nvidia GPUs and break memory isolation. Tests showed the attacks against Ampere-era cards including the RTX 3060 and RTX A6000/RTX 6000, where corrupted GPU page tables or page directories allowed attackers to gain read/write access to protected VRAM regions and, in some cases, remap access into host memory. The researchers said this could escalate from GPU compromise to full control of the machine, including root-level access to system memory.

The reports said the attacks require an adversary to already run code on the target system, making shared GPU environments such as AI clusters a more plausible risk than a purely remote attack path. No in-the-wild exploitation has been reported, but the findings highlight a hardware security gap in systems where GPUs can directly access host memory. Recommended mitigations include enabling IOMMU in BIOS to restrict device DMA access to sensitive system memory and turning on ECC on supported GPUs, though both measures can impose performance or memory-capacity tradeoffs and ECC may not block every Rowhammer variant.