Rowhammer Attack Against NVIDIA Chips
Bruce Schneier · rss · 2026-04-01 source ↗ Reader 🖥️
GPU DRAM is now a proven rowhammer attack surface: two independent research teams demonstrated that inducing bitflips in GDDR6 memory on NVIDIA Ampere GPUs can escalate to arbitrary read/write over host CPU memory and full system compromise — and a third attack works even with IOMMU enabled, removing the last easy mitigation.
practical · news brief / security commentary — signal-boosting two academic papers with editorial framing — Short-form security news post characteristic of Schneier's blog: link curation plus block-quoted excerpts with minimal original commentary. Genre: practitioner-oriented threat intelligence.
Structure
| Part | Role |
|---|---|
| Opening statement and link | Announces the core news: a rowhammer attack gives complete control of NVIDIA CPUs (sic — the attack crosses from GPU to CPU domain). |
| GDDRHammer paper summary (Kwong et al.) | Presents the first paper's mechanism — bitflips in GDDR memory leading to arbitrary CPU memory access — and notes the IOMMU-disabled precondition. |
| Friday update — third attack bypasses IOMMU | Escalates the threat: a third team's attack achieves root shell even with IOMMU enabled, negating the obvious mitigation. |
| GeForge paper summary | Presents the second paper's variant — manipulating page directories rather than page tables — with concrete bitflip counts and proof-of-concept root shell. |
Key terms
- rowhammer
A hardware vulnerability exploiting electrical interference in DRAM: repeatedly activating one memory row causes bit flips in adjacent rows, enabling attackers to corrupt data they should not be able to write. - GDDR6 / GDDR memory
Graphics Double Data Rate memory — the DRAM used on GPUs, here shown to be susceptible to rowhammer despite its different architecture from standard DDR. - IOMMU
Input-Output Memory Management Unit — a hardware mechanism that restricts DMA access from peripherals (including GPUs) to host memory; its default-disabled state is the precondition for two of the three attacks, and its bypass is the key escalation of the third. - page table / page directory manipulation
The two concrete exploitation strategies: GDDRHammer corrupts last-level page tables while GeForge corrupts last-level page directories, both achieving the same outcome (arbitrary memory access) via different virtual memory structures.
Propositions
- explicitGPU DRAM (GDDR6) is vulnerable to rowhammer attacks, not just CPU DRAM.conf: high
- explicitBitflips induced in GPU memory can be escalated to arbitrary read/write access over the host CPU's entire memory space, resulting in complete system compromise.conf: high
- explicitTwo independent research teams demonstrated full system compromise on NVIDIA Ampere generation GPUs (RTX 3060, RTX A6000).conf: high
- explicitThe initial two attacks require IOMMU to be disabled, which is the default BIOS setting on most systems.conf: high
- explicitA third attack achieves privilege escalation to root shell even with IOMMU enabled, removing the obvious mitigation.conf: high
- implicitThe default-disabled state of IOMMU means the vast majority of deployed NVIDIA GPU systems are vulnerable without any user misconfiguration.conf: high
- implicitThe convergence of two independent teams on the same attack class suggests this is a structurally exploitable weakness, not a one-off curiosity.conf: high
- implicitGPU security has been under-scrutinized relative to CPU security despite GPUs having direct memory access to host systems.conf: medium
Arguments
Rowhammer is a serious threat on GPUs, not just CPUs. strength: high
Explicit premises:
- Two independent teams demonstrated bitflips in GDDR6 memory on NVIDIA Ampere GPUs.
- Those bitflips were escalated to arbitrary read/write over CPU memory.
- The attacks achieved full system compromise (root shell).
Implicit premises:
- If an attack independently discovered by multiple teams achieves full system compromise, it constitutes a serious rather than theoretical threat.
Inferences:
- GPU DRAM must now be treated as part of the system's attack surface for rowhammer-class vulnerabilities.
IOMMU is not a reliable mitigation against GPU rowhammer attacks. strength: high
Explicit premises:
- The first two attacks require IOMMU to be disabled.
- IOMMU is disabled by default in BIOS settings, so most systems are already exposed.
- A third attack demonstrated root shell escalation even with IOMMU enabled.
Implicit premises:
- A mitigation that is off by default and can be bypassed when on provides no reliable protection.
- Defenders cannot rely on a single hardware mechanism when multiple bypass paths exist.
Inferences:
- New mitigations beyond IOMMU are needed to address GPU rowhammer attacks.
Narratives
- Rowhammer expands from a CPU-memory curiosity (2014) to a GPU-to-CPU system compromise vector — each new paper widens the attack surface and removes a layer of assumed protection.
→ Frames the news within the longer arc of rowhammer research, signaling that hardware-level memory vulnerabilities keep finding new domains to exploit. - Two teams working independently arrive at the same attack class within the same disclosure window, then a third team ups the ante by bypassing IOMMU.
→ Creates a narrative of escalating threat: independent convergence validates the vulnerability, and the Friday update removes the safety net.
Questions addressed
- ✅ Can rowhammer attacks extend from CPU DRAM to GPU GDDR memory?
Yes — demonstrated empirically on NVIDIA Ampere GPUs by three independent research teams. - ✅ Can GPU-side memory corruption escalate to full host system compromise?
Yes — both GDDRHammer and GeForge achieve arbitrary CPU memory read/write and root shell. - ✅ Does IOMMU protect against GPU-originated rowhammer attacks?
No — IOMMU is off by default (exposing most systems), and the third attack bypasses it even when enabled. - ⭕ What mitigations exist against GPU rowhammer?
Not addressed — the post reports the attacks but does not discuss NVIDIA's response or available defenses.
Gaps
- missing evidenceNo discussion of whether NVIDIA has issued or plans mitigations (firmware, driver, or hardware). The post reports the vulnerability but not the vendor response.
Read next: NVIDIA security bulletins and the researchers' responsible disclosure timelines. - unasked questionNo analysis of which real-world threat scenarios make this exploitable in practice. Cloud multi-tenancy (shared GPUs), browser WebGPU, and ML inference services all have different exposure profiles, but none are discussed.
Read next: Research on GPU sharing in cloud environments (MIG, vGPU) and whether they partition DRAM sufficiently to prevent cross-tenant rowhammer. - scope limitationNo mention of whether non-NVIDIA GPUs (AMD, Intel Arc) share the vulnerability. GDDR6 is used across vendors, so the rowhammer physics may generalize.
Read next: The GDDRHammer and GeForge papers' discussion sections on vendor generalizability. - unasked questionThe post does not address whether newer NVIDIA architectures (Hopper, Blackwell) using HBM instead of GDDR6 are also affected, or whether HBM's different physical structure provides natural mitigation.
Read next: HBM rowhammer research and architecture comparisons between GDDR6 and HBM3. - missing evidenceNo discussion of detection: can a defender observe GPU rowhammer attempts in progress? CPU rowhammer has performance-counter-based detection methods; it is unknown whether analogous GPU telemetry exists.
Read next: GPU performance monitoring literature and existing rowhammer detection mechanisms on CPUs.