NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs): The first demonstrated Rowhammer bit flips in GPU
Impact
The first demonstrated Rowhammer bit flips in GPU memory. Researchers flipped bits in GDDR6 on an NVIDIA A6000 from a co-tenant GPU workload and used a single flip to degrade a victim's neural network accuracy from around 80% to near zero. The attack does not read the victim's data - it corrupts it - which makes it an integrity attack on a co-tenant's model or training run rather than a confidentiality one, and correspondingly hard to detect from inside the victim job.
Who can reach it
A co-tenant workload on the same physical GPU with the ability to allocate and hammer memory. No privileges, no driver bug. GPUs without ECC or with ECC disabled are the exposed population.
What to do
NVIDIA's published response is to enable System-Level ECC, which is available and on by default on datacenter parts (H100, A100, and the Hopper/Blackwell line) but is off or absent on workstation-class parts. Verify with nvidia-smi -q -d ECC across the fleet and turn it on with nvidia-smi -e 1, which requires a GPU reset - so a node drain. Cost is real: ECC on these parts costs roughly 6-10% inference throughput and around 6% of usable VRAM. HBM3/HBM3e parts with on-die ECC are considered less exposed. There is no firmware patch that removes the underlying DRAM weakness.
References
Related entries
- NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs): The first demonstrated Rowhammer bit flips in GPUNCVD-2025-014-nvidia-gddr6-gpu-memory-a6000-cl · NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs)Unscored
- NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000NCVD-2025-008-nvidia-gpus-with-gddr6-and-no-on · NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000. Not reproduced on A100 (HBM), H100 or RTX…Unscored
- NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000NCVD-2025-011-nvidia-gpus-with-gddr6-and-no-on · NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000. Not reproduced on A100 (HBM), H100 or RTX…Unscored
- NVIDIA GPU driver / GRID vGPU and vSGA - host memory mapping path: The host memory mapping path did not restrict accessCVE-2015-5053 · NVIDIA GPU driver / GRID vGPU and vSGA - host memory mapping pathCritical
- NVIDIA Windows GPU Display Driver, DirectX driver (shader compiler/runtime): A crafted shader reads out of bounds on anCVE-2019-5684 · NVIDIA Windows GPU Display Driver, DirectX driver (shader compiler/runtime)Critical
- DGX A100 BMC: Full BMC compromise (heap buffer overflow) — worst-case out-of-band takeoverCVE-2023-31029 · DGX A100 BMCCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.