NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs): MULTI-TENANT ISOLATION: the first demonstrated

Impact

MULTI-TENANT ISOLATION: the first demonstrated Rowhammer bit flips in GPU memory. Researchers flipped bits in GDDR6 on an NVIDIA A6000 from a co-tenant GPU workload and used a single flip to degrade a victim's neural network accuracy from around 80% to near zero. The attack does not read the victim's data - it corrupts it - which makes it an integrity attack on a co-tenant's model or training run rather than a confidentiality one, and correspondingly hard to detect from inside the victim job.

Who can reach it

A co-tenant workload on the same physical GPU with the ability to allocate and hammer memory. No privileges, no driver bug. GPUs without ECC or with ECC disabled are the exposed population.

What to do

NVIDIA's published response is to enable System-Level ECC, which is available and on by default on datacenter parts (H100, A100, and the Hopper/Blackwell line) but is off or absent on workstation-class parts. Verify with nvidia-smi -q -d ECC across the fleet and turn it on with nvidia-smi -e 1, which requires a GPU reset - so a node drain. Cost is real: ECC on these parts costs roughly 6-10% inference throughput and around 6% of usable VRAM. HBM3/HBM3e parts with on-die ECC are considered less exposed. There is no firmware patch that removes the underlying DRAM weakness.

References