GDDRHammer, GeForge and GPUBreach
After our earlier coverage of GDDRHammer and GeForge , we were contacted by Gururaj Saileshwar, Assistant Professor at the University of Toronto, who pointed us to a third paper in the same area. The new work, called GPUBreach , also targets NVIDIA GPUs with GDDR6 memory through Rowhammer, but it is a bit more sophisticated. According to the researchers, the attack can escalate all the way to a root shell on the host system even with IOMMU enabled, a protection the other recent works were either limited by or required to be turned off.
Like the other two papers, GPUBreach starts with GPU page-table corruption. Note that the actual paper was not published yet, so I don’t have any diagrams to share with you right now. What researchers say is that this gives an unprivileged CUDA kernel arbitrary GPU memory read and write access, which then opens the door to cross-process attacks and further escalation. The difference is that GPUBreach reportedly chains this with newly discovered memory-safety bugs in NVIDIA’s driver to move from GPU control to CPU-side kernel compromise.
Source: GPU Breach
That makes GPUBreach the most advanced of the three published attack paths so far, at least based on the authors’ own comparison. The project page says GDDRHammer can access CPU memory but does not reach CPU privilege escalation, while GeForge can get there only when IOMMU is disabled. GPUBreach, by contrast, is presented as an exploit path that still works with IOMMU left on, which is how such systems are normally configured.
Source: GPU Breach
The paper was evaluated on NVIDIA’s RTX A6000, a workstation GPU with GDDR6 and ECC support. As far as I can tell, they are not mentioning any other card, but this should also affect the RTX 3060, like in other papers.
NVIDIA still recommends enabling System-Level ECC where available, and the GPUBreach authors agree that ECC can help with some bit flips. They also say ECC is not a full fix, while consumer GeForce and laptop GPUs typically do not expose ECC at all.
Source: GPUBreach.ca
