New Rowhammer attacks give complete control of machines running Nvidia GPUs

The attacks exploit memory hardware’s increasing susceptibility to bit flips, in which 0s stored in memory switch to 1s and vice versa.

In 2014 , researchers first demonstrated that repeated, rapid access—or “hammering”—of memory hardware known as DRAM creates electrical disturbances that flip bits.

A year later , a different research team showed that by targeting specific DRAM rows storing sensitive data, an attacker could exploit the phenomenon to escalate an unprivileged user to root or evade security sandbox protections.

Both attacks targeted DDR3 generations of DRAM.

From CPU to GPU: Rowhammer’s decade-long journey
Over the past decade, dozens of newer Rowhammer attacks have evolved to, among other things:
The last feat proved that GDDR was susceptible to Rowhammer attacks, but the results were modest.

The researchers achieved only eight bitflips, a small fraction of what has been possible on CPU DRAM, and the damage was limited to degrading the output of a neural network running on the targeted GPU.