GPUThor：通过非均匀模式放大Rowhammer攻击以利用受ECC保护的GPU
GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs
浏览论文内容
中文总结 AI 辅助
GPUThor通过非均匀锤击模式逆向工程GPU内存访问合并行为，大幅提升比特翻转率，首次在ECC保护的NVIDIA GPU上实现Rowhammer攻击，使拒绝服务和权限提升攻击成为可能。
中文摘要 AI 辅助
GPU中的GDDR内存容易受到Rowhammer攻击，这种攻击通过快速内存访问在相邻单元中引发比特翻转，从而实现数据篡改和权限提升。然而，先前的GPU Rowhammer攻击仅触发数十到数百次比特翻转，比CPU攻击少几个数量级，严重限制了其实际影响。这一差距源于现有GPU Rowhammer攻击依赖于均匀锤击模式，该模式同等程度地激活攻击行和诱饵行，导致攻击行的锤击强度较低。我们提出了GPUThor，一种利用非均匀锤击对NVIDIA GPU进行的高强度Rowhammer攻击。GPUThor逆向工程了GPU内存访问合并行为，以在GPU上实现非均匀锤击模式，该模式比诱饵行更强烈地激活攻击行。此外，通过识别应用DRAM内缓解措施的刷新实例，它构建了更长的攻击模式，这些模式在刷新间隔内逃避缓解，进一步增加了锤击强度。综合这些技术，在多种NVIDIA GPU（A4000、A4500、A5000、A6000）上，GPUThor产生的比特翻转比先前的GPU Rowhammer攻击多500倍至23,500倍，达到接近最先进CPU Rowhammer攻击的比特翻转率。GPUThor还首次在受ECC保护的GPU上实现了Rowhammer利用，诱导不可纠正的双比特和三比特翻转，使得即使在启用ECC的GPU上，拒绝服务和权限提升攻击也变得切实可行。
英文摘要
GDDR memory in GPUs is vulnerable to Rowhammer attacks, where rapid memory accesses induce bit flips in adjacent cells, enabling data tampering and privilege escalation. However, prior GPU Rowhammer attacks trigger only tens to hundreds of bit flips, orders of magnitude fewer than CPU attacks, severely limiting their practical impact. This gap stems from the reliance of existing GPU Rowhammer attacks on uniform hammering patterns that activate aggressor and decoy rows equally, which results in low hammering intensity for aggressor rows. We present GPUThor, a high-intensity Rowhammer attack on NVIDIA GPUs leveraging non-uniform hammering. GPUThor reverse engineers GPU memory-access coalescing behavior to enable non-uniform hammering patterns on GPUs, that activate aggressor rows more intensely than decoy rows. Additionally, by identifying refresh instances when in-DRAM mitigations are applied, it constructs longer attack patterns that escape mitigation across refresh intervals, further increasing hammering intensity. Together, these techniques yield 500X to 23,500X more bit flips than prior GPU Rowhammer attacks, across several NVIDIA GPUs (A4000, A4500, A5000, A6000), reaching bit flip rates close to state-of-the-art CPU Rowhammer attacks. GPUThor also enables the first Rowhammer exploits on ECC-protected GPUs, inducing uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical even on GPUs with ECC enabled.
发表机构
- University of Toronto（多伦多大学）
机构由 AI 辅助整理，请以论文原文为准。
