Researchers from the University of Toronto presented the first attack of the Rowhammer class, used to distort the contents of the video memory. The possibility of an attack leading to a substitution of up to 8 bits of data, demonstrated on a discrete GPU NVIDIA A6000 with video memory GDDR6. As a practical example, it is shown how to use such a distortion for interference in the performance of machine learning models and a significant (from 80% to 0.1%) decrease in the accuracy of the results issued by them when the value of just one bit changes.
Until now, the creation of the Rowhammer class attacks for video memory was difficult due to the difficulty of determining the physical layout of memory in GDDR chips, large delays in access to memory (4 times slower) and a higher memory update. In addition, studies were interfering with the involvement of proprietary mechanisms of protection against manipulations in the chips of GDDR, leading to premature charge loss, for the analysis of which it was required to create special hardware test stands based on FPGA.
For the GPUHAMMER attack, the researchers created a new equipment of the GDDR DRAM reverse engineering technique, and in the attack itself, parallel calculations used to organize parallel computing are involved optimization access to the memory that were used as amplifiers of the access intensity of individual cells. To conduct an attack on the GPU NVIDIA, a low-level CUDA code is used.
In the user code of CUDA, there is no appeal to physical memory addresses, but the NVIDIA driver reflected virtual memory in the same physical memory, which the researchers used to calculate the displacement of virtual memory and determine the layout of memory banks. To recognize the appeal to different memory banks, the researchers took advantage of various delays in access to