Nvidia's high-end hardware, including the flagship Blackwell series GPUs, is vulnerable to the Rowhammer exploit, a persistent hardware security concern for over a decade, the company has disclosed.

In a security notice, first reported by Bleeping Computer, Nvidia revealed that researchers at the University of Toronto were able to exploit Rowhammer attacks against Nvidia GPUs successfully.

The Rowhammer exploit works by repeatedly accessing the same memory row in DRAM, causing electrical interference that can flip bits in adjacent memory rows and potentially corrupt data or bypass security measures. With modern, high-end chips featuring ever-more densely packed memory cells, they become more susceptible to such exploits, which could allow threat actors to gain unauthorized access to systems or steal sensitive information.

The researchers employed the exploit on an Nvidia A6000 GPU with GDDR6 memory, which did not have System-Level Error Correction Code (ECC) enabled.

ECC, which detects single-bit memory errors, is enabled automatically on Nvidia’s latest units by default, including its flagship Blackwell hardware that has finally found its way into the hands of customers like AWS and CoreWeave after a production delay.

Nvidia recommended users check that their System-Level ECC is enabled across their stack, either out-of-band via a system’s Baseboard Management Controller or through the in-band method through the nvidia-smi command line tool.

Among the units that the chipmaking giant recommended should have System-Level ECC enabled are Blackwell lines, including the GB200, B200, and B100, as well as the H100, H200, and GH200, along with the China-specific H20 and H800.

What did the researchers unearth?

In their investigation, the University of Toronto scientists were able to tamper with data powered by an A6000 – “drastically” reducing the accuracy of a machine learning model running on the hardware from 80 percent to 0.1 percent.

“Prior work shows that flipping the most significant bit of a floating-point exponent in FP16 model weights can drastically reduce model accuracy,” the researchers wrote.

“Based on this insight, we show that in a time-shared GPU setup, an attacker can position victim data into vulnerable DRAM rows via memory massaging and force the bit flips at such locations.

“In our proof-of-concept, with just a single bit flip, the accuracy of an ML model is degraded below 1 percent for all five tested ImageNet DNN models, resulting in up to 80 percent accuracy loss.”

The researchers employed similar Rowhammer bit flips on other GDDR6 GPUs, including the RTX 3080, but the hardware didn’t respond as drastically as the A6000, citing “variations in DRAM vendor, chip characteristics, or operating conditions like temperature.”

No impact was reported on an A100 GPU with high-bandwidth memory.

While GDDR7-based GPUs like the RTX 5090 aren’t susceptible as they feature on-die ECC, which masks single-bit flips, the researchers warn that future iterations of Rowhammer attacks could cause multi-bit flips that might be able to bypass such ECC.

“Our attack code is extensible to other Ampere GPUs and beyond, and we encourage future work to expand the test coverage,” the paper reads.

Their Nvidia Rowhammer warning comes hot off the heels of IBM researchers uncovering a series of security flaws in Nvidia’s GPU stack.

Having reverse-engineered the chipmaker’s GPU Confidential Computing (GPU-CC) feature, the researchers, alongside engineers from Ohio State University, uncovered exploits that could allow bad actors to potentially access data flowing between confidential virtual machines (VMs), and Hopper or Blackwell GPUs.