GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer

• URL: http://arxiv.org/abs/2605.03812v1
• Date: Tue, 05 May 2026 14:40:06 GMT
• Title: GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer
• Abstract summary: Rowhammer exploits have been limited to injecting untargeted bit-flips in victim data.<n>We demonstrate that GPU Rowhammer exploits can be as potent as CPU Rowhammer attacks.
• Score: 4.757465470743026
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: NVIDIA GPUs with GDDR memories have been shown susceptible to Rowhammer-based bit-flips, similar to CPUs. However, Rowhammer exploits on GPUs have been limited to injecting untargeted bit-flips in victim data like weights of machine learning models, to degrade model accuracy, unlike CPU exploits shown capable of privilege escalation. In this paper, we demonstrate that GPU Rowhammer exploits can be as potent as CPU Rowhammer attacks. By exploiting the GPU page table management to identify when and where new page tables are allocated, we enable an unprivileged user CUDA kernel of one process to use RowHammer bit-flips to gain access to the GPU memory of other processes or co-tenants via targeted tampering of such page-tables resident on the GPU memory. Using this newly found primitive, we demonstrate the first GPU-side privilege escalation attacks, leaking secret data such as cryptographic keys from cuPQC libraries, and even tampering with the model's GPU assembly code to degrade models more stealthily than previous attacks. We further demonstrate that GPU-side privilege escalation can lead to CPU-side privilege escalation, defeating the protections provided by the IOMMU, enabling a malicious user-level program with GPU access to gain root shell and system-wide control, even in a non-multi-tenant setting.

Related papers

• GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs [2.823228784044236]
  GPUThor is a high-intensity Rowhammer attack on NVIDIA GPU leveraging non-uniform hammering.<n>We present GPUThor, a high-intensity Rowhammer attack on NVIDIA GPU leveraging non-uniform hammering.
  arXiv  Detail & Related papers  (2026-09-15T02:46:02Z)
• SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon [8.388281067288181]
  heterogeneous System-on-Chip designs integrate CPU cores and a GPU that share a last-level cache (LLC) or system-level cache (SLC)<n>This sharing exposes a new cross-domain attack surface, and existing attacks on integrated platforms either exploit coarse-grained cache-occupancy contention or require the adversary to co-reside on the GPU with the victim to obtain accurate timing measurements.<n>In this work, we target Apple Silicon heterogeneous SOCs and discover that GPU memory accesses leave set-level footprints in the shared SLC, observable to an unprivileged CPU process.<n>This keen observation enables the first fine-grained
  arXiv  Detail & Related papers  (2026-08-10T03:25:16Z)
• A Few GPUs, A Whole Lotta Scale: Faithful LLM Training Emulation with PrismLLM [47.09947710347623]
  PrismLLM decouples large-scale execution from the need to access large clusters.<n>Experiments on large-scale LLM training workloads show that PrismLLM accurately reproduces performance and memory behavior.
  arXiv  Detail & Related papers  (2026-05-15T04:58:20Z)
• Kraken: Higher-order EM Side-Channel Attacks on DNNs in Near and Far Field [26.561261723476687]
  Large machine learning models are a prime target for model stealing.<n>Our work demonstrates parameter extraction on the specialized GPU's Core units.<n>Our method is tailored to the GPU architecture to accurately estimate energy consumption and efficient attacks.
  arXiv  Detail & Related papers  (2026-03-03T11:40:13Z)
• TriMoE: Augmenting GPU with AMX-Enabled CPU and DIMM-NDP for High-Throughput MoE Inference via Offloading [38.243293392367086]
  TriMoE is a novel GPU- CPU-NDP architecture that exploits AMX-enabled CPU to map hot, warm, and cold experts onto their optimal compute units.<n> Experiments demonstrate that TriMoE achieves up to 2.83x speedup over state-of-the-art solutions.
  arXiv  Detail & Related papers  (2026-03-01T11:27:37Z)
• HipKittens: Fast and Furious AMD Kernels [36.63732085611713]
  We study the programming primitives that lead to performant AMD AI kernels.<n>We provide the first detailed study of the programming primitives that lead to performant AMD AI kernels.<n>These findings help pave the way for a single, tile-based software layer for high-performance AI kernels.
  arXiv  Detail & Related papers  (2025-11-11T10:36:18Z)
• CLM: Removing the GPU Memory Barrier for 3D Gaussian Splatting [34.933663925174635]
  CLM is a system that allows 3DGS to render large scenes using a single consumer-grade GPU.<n>It does so by offloading Gaussians to CPU memory, and loading them into GPU memory only when necessary.<n>To reduce performance and communication overheads, CLM uses a novel offloading strategy.
  arXiv  Detail & Related papers  (2025-11-07T03:30:28Z)
• Scalable GPU-Based Integrity Verification for Large Machine Learning Models [4.301162531343759]
  We present a security framework that strengthens distributed machine learning by standardizing integrity protections across CPU and GPU platforms.<n>Our approach co-locates integrity verification directly with large ML model execution on GPU accelerators.<n>We provide a hardware-agnostic foundation that enterprise teams can deploy regardless of their underlying CPU and GPU infrastructures.
  arXiv  Detail & Related papers  (2025-10-27T23:45:21Z)
• OpenGL GPU-Based Rowhammer Attack (Work in Progress) [0.0]
  This paper presents an adaptive, many-sided Rowhammer attack utilizing GPU compute shaders.<n>Our approach employs statistical distributions to optimize row targeting and avoid current mitigations.<n> Experimental results on a Raspberry Pi 4 demonstrate that the GPU-based approach attains a high rate of bit flips compared to traditional CPU-based hammering.
  arXiv  Detail & Related papers  (2025-09-24T10:11:05Z)
• GPUHammer: Rowhammer Attacks on GPU Memories are Practical [3.3625059118072107]
  We demonstrate the first successful Rowhammer attack on a discrete GPU.<n>We show how an attacker can use these to tamper with ML models, causing significant accuracy drops (up to 80%)<n>We also show how an attacker can use these to tamper with ML models, causing significant accuracy drops (up to 80%)
  arXiv  Detail & Related papers  (2025-07-10T20:57:47Z)
• ThunderKittens: Simple, Fast, and Adorable AI Kernels [43.32681787348603]
  We present ThunderKittens (TK), a framework for writing performant AI kernels while remaining easy to use and maintain. We show the value of TK by providing kernels that match or outperform prior kernels for a range of AI operations.
  arXiv  Detail & Related papers  (2024-10-27T10:07:16Z)
• MEFT: Memory-Efficient Fine-Tuning through Sparse Adapter [40.616849959987555]
  We introduce a novel mechanism that fine-tunes Large Language Models (LLMs) with adapters of larger size yet memory-efficient. This is achieved by leveraging the inherent activation sparsity in the Feed-Forward Networks (FFNs) of LLMs. We employ a Mixture of Experts (MoE)-like architecture to mitigate unnecessary CPU computations and reduce the communication volume between the GPU and CPU.
  arXiv  Detail & Related papers  (2024-06-07T14:49:22Z)
• GME: GPU-based Microarchitectural Extensions to Accelerate Homomorphic Encryption [33.87964584665433]
  Homomorphic Encryption (FHE) enables the processing of encrypted data without decrypting it. FHE introduces a slowdown of up to five orders of magnitude as compared to the same computation using plaintext data. We propose GME, which combines three key microarchitectural extensions along with a compile-time optimization to the current AMD CDNA GPU architecture.
  arXiv  Detail & Related papers  (2023-09-20T01:50:43Z)
• FusionAI: Decentralized Training and Deploying LLMs with Massive Consumer-Level GPUs [57.12856172329322]
  We envision a decentralized system unlocking the potential vast untapped consumer-level GPU. This system faces critical challenges, including limited CPU and GPU memory, low network bandwidth, the variability of peer and device heterogeneity.
  arXiv  Detail & Related papers  (2023-09-03T13:27:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.