NVIDIA is warning customers to activate System Stage Error-Correcting Code mitigation to guard towards Rowhammer assaults on graphical processors with GDDR6 reminiscence.
The corporate is reinforcing the advice as new analysis printed by the College of Toronto demonstrates the practicallity of Rowhammer assaults towards an NVIDIA A6000 GPU (graphical processing unit).
“We ran GPUHammer on an NVIDIA RTX A6000 (48 GB GDDR6) throughout 4 DRAM banks and noticed 8 distinct single-bit flips, and bit-flips throughout all examined banks,” describe the researchers.
“The minimal activation depend ( TRH) to induce a flip was ~12K, according to prior DDR4 findings.”
“Utilizing these flips, we carried out the primary ML accuracy degradation assault utilizing Rowhammer on a GPU.”
Rowhammer is a {hardware} fault that may be triggered via software program processes and stems from reminiscence cells being too shut to one another. The assault was demonstrated on DRAM cells however it will possibly have an effect on GPU reminiscence, too.
It really works by accessing a reminiscence row with sufficient read-write operations, which causes the worth of adjoining knowledge bits to flip from one to zero and vice-versa, inflicting the in-memory data to alter.
The impact might be a denial-of-service situation, knowledge corruption, and even privilege escalation.
System Stage Error-Correcting Codes (ECC) can protect the integrity of the information by including redundant bits and correcting single-bit errors to keep up knowledge reliability and accuracy.
In workstation and knowledge heart GPUs the place VRAM handles giant datasets and exact calculations associated to AI workloads, ECC have to be enabled to forestall essential errors of their operation.
NVIDIA’s safety discover notes that researchers on the College of Toronto confirmed “a possible Rowhammer assault towards an NVIDIA A6000 GPU with GDDR6 Reminiscence” the place System-Stage ECC was not enabled.
The educational researchers developed GPUHammer, an assault technique to flip bits on GPU reminiscences.
Though hammering is more durable on GDDR6 due to increased latency and quicker refresh in contrast with CPU-based DDR4, the researchers had been in a position to reveal that Rowhammer assaults on GPU reminiscence banks is feasible.
Researcher Gururaj Saileshwar highlighted to BleepingComputer that GPUHammer can degrade AI mannequin accuracy from 80% to under 1% with a single flip on an A6000 GPU.
Other than the RTX A6000, the GPU maker additionally recommends enabling System-Stage ECC for the next merchandise:
Knowledge Middle GPUs:
Ampere: A100, A40, A30, A16, A10, A2, A800
Ada: L40S, L40, L4
Hopper: H100, H200, GH200, H20, H800
Blackwell: GB200, B200, B100
Turing: T1000, T600, T400, T4
Volta: Tesla V100, Tesla V100S
Workstation GPUs:
Ampere RTX: A6000, A5000, A4500, A4000, A2000, A1000, A400
Ada RTX: 6000, 5000, 4500, 4000, 4000 SFF, 2000
Blackwell RTX PRO (latest workstation line)
Turing RTX: 8000, 6000, 5000, 4000
Volta: Quadro GV100
Embedded / Industrial:
Jetson AGX Industrial Orin IGX Honors
The GPU maker notes that newer GPUs like Blackwell RTX 50 Sequence (GeForce), Blackwell Knowledge Middle GB200, B200, B100, and Hopper Knowledge Middle H100, H200, H20, and GH200, include built-in on-die ECC safety, which doesn’t require an intervention from the person.
One technique to examine if System Stage ECC is enabled is to make use of an out-of-band technique that makes use of the system’s BMC (Baseboard Administration Controller) and {hardware} interface software program, just like the Redfish APIto examine the “ECCModeEnabled” standing.
Instruments like NSM Sort 3 and NVIDIA SMBPBI will also be used for configuration, although they require entry to the NVIDIA Companion Portal.
A second In-Band technique additionally exists, utilizing the nvidia-smi command-line utility from the system’s CPU to examine and allow ECC the place supported.
Sailshwar estimates that these suggestions incur as much as 10% slowdown for ML inference and 6.5% reminiscence capability loss throughout all workloads.
Rowhammer represents an actual safety concern that would trigger knowledge corruption or allow assaults in multi-tenant environments like cloud servers the place susceptible GPUs could also be deployed.
Nonetheless, the true danger is context-dependent, and exploiting Rowhammer reliably is sophisticated, requiring particular situations, excessive entry charges, and exact management, making it an assault tough to execute.
Replace 7/12 – Added hyperlinks to the analysis and particulars offered by the researchers.
Whereas cloud assaults could also be rising extra refined, attackers nonetheless succeed with surprisingly easy strategies.
Drawing from Wiz’s detections throughout 1000’s of organizations, this report reveals 8 key strategies utilized by cloud-fluent risk actors.
