GPU Rowhammer Breaks IOMMU Isolation, Enables Full System Takeover
GPUBreach reveals that Rowhammer bit-flips in modern GDDR6 memory can corrupt GPU page tables, granting unprivileged CUDA kernels arbitrary GPU memory read/write access. This GPU-side primitive bypasses IOMMU protections, which are assumed to isolate device memory access, and can be chained with NVIDIA driver memory-safety bugs to achieve full system compromise. This breaks the common security assumption that IOMMU prevents device-originated escalation to host memory and privileges. Systems exposing GPU compute to untrusted code, such as cloud GPU instances and multi-tenant servers, face risk beyond data corruption: attackers can gain control over the entire host and all processes sharing the GPU. Although no widespread exploits are reported yet, the public release of the research and repro code raises the risk of rapid weaponization. This vulnerability demands urgent assessment in high-risk environments where untrusted CUDA execution is allowed.