Protecting NVIDIA GPUs from Attacks That Inject and Run Malicious Code

What is it about?

Graphics Processing Units (GPUs) are no longer used just for graphics: they have become essential to scientific computing, artificial intelligence, and many other applications. However, their security protections have not kept pace with their growing importance. In particular, modern GPUs lack some basic security mechanisms that have been standard in traditional computer processors for years. This leaves them vulnerable to attacks in which malicious users exploit memory-handling bugs to inject and execute their own code, even when existing protections are enabled. In this work, we investigate these attacks on modern NVIDIA GPUs and develop **cuDEP**, a lightweight software-based security mechanism to prevent them. Our approach ensures that areas of memory containing program instructions cannot be modified, while ordinary data cannot be executed as code. This makes it significantly harder for attackers to turn memory vulnerabilities into attacks that execute malicious instructions on the GPU. We implemented and evaluated our protection on three generations of NVIDIA GPUs: Ampere, Hopper, and Blackwell. Our solution works with the existing GPU software ecosystem, including precompiled libraries, and introduces less than 0.5% average runtime overhead. Our findings demonstrate that it is possible to bring fundamental security protections to modern GPUs without requiring hardware modifications. More broadly, this work highlights the importance of treating GPU security as a priority and encourages hardware manufacturers to incorporate stronger security guarantees into future GPU architectures.

Featured Image

Photo by Mariia Berezovsky on Unsplash

Photo by Mariia Berezovsky on Unsplash

Why is it important?

GPUs have become essential to modern computing, particularly for artificial intelligence and large-scale data processing, yet their security protections still lag behind those of traditional processors. This creates an important and increasingly relevant security gap. What makes our work unique is that it addresses the problem from a different perspective. Most existing GPU security solutions focus on detecting memory errors, such as attempts to access memory outside its intended boundaries. Our approach instead focuses on preventing attackers from turning these errors into successful code-injection attacks. We bring a fundamental security principle, already widely adopted in traditional processors, to modern NVIDIA GPUs without requiring hardware modifications. Importantly, we demonstrate that this protection is practical: it works across three generations of NVIDIA GPUs, remains compatible with existing software and precompiled libraries, and introduces less than 0.5% average runtime overhead. This makes it a promising approach for strengthening the security of GPU-based systems without significantly affecting their performance. As GPUs continue to power increasingly important and sensitive workloads, our work highlights a security gap that deserves greater attention and provides a concrete step towards making these platforms more secure.

Perspectives