GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer
Chris S. Lin, Yuqin Yan, Guozhen Ding, Joyce Qu, Joseph Zhu + 2 more
TLDR
GPUBreach shows GPU Rowhammer can achieve privilege escalation, enabling unprivileged access to other processes' GPU memory and CPU root control.
Key contributions
- Presents the first GPU-side privilege escalation attacks leveraging Rowhammer bit-flips on NVIDIA GPUs.
- Exploits GPU page table management to target and tamper with page tables, gaining cross-process GPU memory access.
- Demonstrates leaking cryptographic keys and stealthily tampering with ML model GPU assembly code.
- Achieves CPU-side root privilege escalation from GPU access, bypassing IOMMU protections.
Why it matters
This paper significantly expands the threat model for GPUs, demonstrating they are vulnerable to sophisticated privilege escalation attacks, not just data corruption. It highlights critical security flaws in GPU memory management and the potential for system-wide compromise, even with IOMMU. These findings necessitate re-evaluating GPU security practices.
Original Abstract
NVIDIA GPUs with GDDR memories have been shown susceptible to Rowhammer-based bit-flips, similar to CPUs. However, Rowhammer exploits on GPUs have been limited to injecting untargeted bit-flips in victim data like weights of machine learning models, to degrade model accuracy, unlike CPU exploits shown capable of privilege escalation. In this paper, we demonstrate that GPU Rowhammer exploits can be as potent as CPU Rowhammer attacks. By exploiting the GPU page table management to identify when and where new page tables are allocated, we enable an unprivileged user CUDA kernel of one process to use RowHammer bit-flips to gain access to the GPU memory of other processes or co-tenants via targeted tampering of such page-tables resident on the GPU memory. Using this newly found primitive, we demonstrate the first GPU-side privilege escalation attacks, leaking secret data such as cryptographic keys from cuPQC libraries, and even tampering with the model's GPU assembly code to degrade models more stealthily than previous attacks. We further demonstrate that GPU-side privilege escalation can lead to CPU-side privilege escalation, defeating the protections provided by the IOMMU, enabling a malicious user-level program with GPU access to gain root shell and system-wide control, even in a non-multi-tenant setting.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.