{"id":"https://openalex.org/W7166856800","doi":"https://doi.org/10.1109/sp63933.2026.00230","title":"GeForge: Hammering GDDR Memory to Forge GPU Page Tables for Fun and Profit","display_name":"GeForge: Hammering GDDR Memory to Forge GPU Page Tables for Fun and Profit","publication_year":2026,"publication_date":"2026-05-18","ids":{"openalex":"https://openalex.org/W7166856800","doi":"https://doi.org/10.1109/sp63933.2026.00230"},"language":"en","primary_location":{"id":"doi:10.1109/sp63933.2026.00230","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp63933.2026.00230","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048980193","display_name":"Junpeng Wan","orcid":null},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Junpeng Wan","raw_affiliation_strings":["Clemson University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Clemson University","institution_ids":["https://openalex.org/I8078737"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139717492","display_name":"Yanan Guo","orcid":null},"institutions":[{"id":"https://openalex.org/I5388228","display_name":"University of Rochester","ror":"https://ror.org/022kthw22","country_code":"US","type":"education","lineage":["https://openalex.org/I5388228"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yanan Guo","raw_affiliation_strings":["University of Rochester"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Rochester","institution_ids":["https://openalex.org/I5388228"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039190713","display_name":"Z K Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I177877127","display_name":"The University of Western Australia","ror":"https://ror.org/047272k79","country_code":"AU","type":"education","lineage":["https://openalex.org/I177877127"]},{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["AU","US"],"is_corresponding":false,"raw_author_name":"Zhi Zhang","raw_affiliation_strings":["Clemson University","University of Western Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Clemson University","institution_ids":["https://openalex.org/I8078737"]},{"raw_affiliation_string":"University of Western Australia","institution_ids":["https://openalex.org/I177877127"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139850523","display_name":"Zhuo Li","orcid":null},"institutions":[{"id":"https://openalex.org/I4210092001","display_name":"Hydronalix (United States)","ror":"https://ror.org/00feqrp17","country_code":"US","type":"company","lineage":["https://openalex.org/I4210092001"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhuo Li","raw_affiliation_strings":["HydroX AI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"HydroX AI","institution_ids":["https://openalex.org/I4210092001"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015662045","display_name":"Dave Tian","orcid":"https://orcid.org/0000-0002-7506-9593"},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dave Jing Tian","raw_affiliation_strings":["Purdue University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Purdue University","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5039190713","display_name":"Z K Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I177877127","display_name":"The University of Western Australia","ror":"https://ror.org/047272k79","country_code":"AU","type":"education","lineage":["https://openalex.org/I177877127"]},{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["AU","US"],"is_corresponding":false,"raw_author_name":"Zhenkai Zhang","raw_affiliation_strings":["Clemson University","University of Western Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Clemson University","institution_ids":["https://openalex.org/I8078737"]},{"raw_affiliation_string":"University of Western Australia","institution_ids":["https://openalex.org/I177877127"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":9.7403,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.98399289,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"565","last_page":"583"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10054","display_name":"Parallel Computing and Optimization Techniques","score":0.34869998693466187,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10054","display_name":"Parallel Computing and Optimization Techniques","score":0.34869998693466187,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11181","display_name":"Advanced Data Storage Technologies","score":0.09690000116825104,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10481","display_name":"Computer Graphics and Visualization Techniques","score":0.051100000739097595,"subfield":{"id":"https://openalex.org/subfields/1704","display_name":"Computer Graphics and Computer-Aided Design"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/forge","display_name":"Forge","score":0.8411999940872192},{"id":"https://openalex.org/keywords/profit","display_name":"Profit (economics)","score":0.4715999960899353},{"id":"https://openalex.org/keywords/for-profit","display_name":"For profit","score":0.3305000066757202},{"id":"https://openalex.org/keywords/profit-margin","display_name":"Profit margin","score":0.25859999656677246}],"concepts":[{"id":"https://openalex.org/C2778157309","wikidata":"https://www.wikidata.org/wiki/Q40558","display_name":"Forge","level":3,"score":0.8411999940872192},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5418999791145325},{"id":"https://openalex.org/C121684516","wikidata":"https://www.wikidata.org/wiki/Q7600677","display_name":"Computer graphics (images)","level":1,"score":0.48019999265670776},{"id":"https://openalex.org/C181622380","wikidata":"https://www.wikidata.org/wiki/Q26911","display_name":"Profit (economics)","level":2,"score":0.4715999960899353},{"id":"https://openalex.org/C199639397","wikidata":"https://www.wikidata.org/wiki/Q1788588","display_name":"Engineering drawing","level":1,"score":0.4097000062465668},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.37139999866485596},{"id":"https://openalex.org/C3019896124","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"For profit","level":2,"score":0.3305000066757202},{"id":"https://openalex.org/C112698675","wikidata":"https://www.wikidata.org/wiki/Q37038","display_name":"Advertising","level":1,"score":0.272599995136261},{"id":"https://openalex.org/C189560676","wikidata":"https://www.wikidata.org/wiki/Q1187906","display_name":"Profit margin","level":2,"score":0.25859999656677246},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.23880000412464142}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/sp63933.2026.00230","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp63933.2026.00230","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},{"id":"pmh:oai:pure.atira.dk:publications/02da7b2e-2e83-4682-864d-f8562ad0e3b3","is_oa":false,"landing_page_url":"https://research-repository.uwa.edu.au/en/publications/02da7b2e-2e83-4682-864d-f8562ad0e3b3","pdf_url":null,"source":{"id":"https://openalex.org/S4306402492","display_name":"UWA Profiles and Research Repository (UWA)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I177877127","host_organization_name":"The University of Western Australia","host_organization_lineage":["https://openalex.org/I177877127"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Wan, J, Guo, Y, Zhang, Z, Li, Z, Tian, D J & Zhang, Z 2026, GeForge : Hammering GDDR Memory to Forge GPU Page Tables for Fun and Profit. in A Oprea, C Nita-Rotaru & N Papernot (eds), Proceedings - 47th IEEE Symposium on Security and Privacy, SP 2026. Proceedings - IEEE Symposium on Security and Privacy, IEEE, Institute of Electrical and Electronics Engineers, pp. 565-583. https://doi.org/10.1109/SP63933.2026.00230","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6827894411","display_name":"CAREER: Investigating and Mitigating Information Leakage Threats in Real-World GPU-as-a-Service (GPUaaS)","funder_award_id":"2443671","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W2163563130","https://openalex.org/W2329308213","https://openalex.org/W2489077495","https://openalex.org/W2516668814","https://openalex.org/W2537014044","https://openalex.org/W2769824527","https://openalex.org/W2795222486","https://openalex.org/W2806638034","https://openalex.org/W2897639728","https://openalex.org/W2949951157","https://openalex.org/W2962654801","https://openalex.org/W2962726564","https://openalex.org/W2974891422","https://openalex.org/W2979333187","https://openalex.org/W2981860227","https://openalex.org/W3015685940","https://openalex.org/W3046609696","https://openalex.org/W3046859417","https://openalex.org/W3094572750","https://openalex.org/W3102933117","https://openalex.org/W3105648728","https://openalex.org/W3157763265","https://openalex.org/W4243908662","https://openalex.org/W4245276998","https://openalex.org/W4250888824","https://openalex.org/W4281916312","https://openalex.org/W4288057800","https://openalex.org/W4308083593","https://openalex.org/W4380875579","https://openalex.org/W4385730913","https://openalex.org/W4388858680","https://openalex.org/W4393407287","https://openalex.org/W4400499063","https://openalex.org/W4407219659","https://openalex.org/W4408902603","https://openalex.org/W7166852086"],"related_works":[],"abstract_inverted_index":{"Over":[0],"the":[1,30,79,91,154,162,216,223],"years,":[2],"Rowhammer":[3,47],"has":[4,22],"been":[5],"leveraged":[6],"to":[7,57,69,78,99,134,165,199,220],"mount":[8,179],"a":[9,19,86,126,139],"wide":[10],"range":[11],"of":[12,40,72],"attacks":[13],"against":[14],"system":[15,110],"main":[16],"memory.":[17,82,103],"While":[18],"recent":[20],"study":[21],"revealed":[23],"that":[24,49,116,143,194,212],"GPU":[25,55,66,81,92,136,146,206],"memory":[26,56,140],"is":[27],"similarly":[28],"vulnerable,":[29],"security":[31],"implications":[32],"remain":[33],"largely":[34],"under-explored.":[35],"To":[36,104],"advance":[37],"this":[38],"line":[39],"research,":[41],"we":[42,112,160,177,210],"introduce":[43],"GeForge,":[44],"an":[45,197],"end-to-end":[46],"attack":[48],"exploits":[50],"bit":[51,169],"flips":[52,170],"induced":[53],"in":[54,90,120],"achieve":[58],"system-level":[59],"compromise.":[60],"At":[61],"its":[62,97],"core,":[63],"GeForge":[64,95,106,180,195,213],"corrupts":[65],"page":[67,93,147],"tables":[68],"seize":[70],"control":[71],"address":[73,132],"translation,":[74],"enabling":[75],"arbitrary":[76],"access":[77,101],"entire":[80],"Moreover,":[83],"by":[84],"exploiting":[85],"special":[87],"mapping":[88],"feature":[89],"table,":[94],"extends":[96],"reach":[98],"directly":[100],"host":[102,224],"make":[105],"practical":[107],"under":[108],"default":[109],"settings,":[111],"develop":[113],"novel":[114],"techniques":[115,124],"eliminate":[117],"restrictive":[118],"assumptions":[119],"prior":[121,172],"work.":[122,173],"Our":[123],"include":[125],"method":[127],"for":[128],"aligning":[129],"offline-profiled":[130],"physical":[131],"mappings":[133],"runtime":[135],"allocations":[137],"and":[138,189,202],"massaging":[141],"strategy":[142],"steers":[144],"target":[145],"table":[148],"structures":[149],"into":[150],"vulnerable":[151],"locations":[152],"via":[153],"stock":[155],"driver":[156],"allocator.":[157],"In":[158],"addition,":[159],"improve":[161],"hammering":[163],"pattern":[164],"trigger":[166],"many":[167],"more":[168],"than":[171],"With":[174],"these":[175],"approaches,":[176],"successfully":[178],"on":[181,222],"widely":[182],"deployed":[183],"NVIDIA":[184],"GPUs,":[185],"including":[186],"both":[187],"workstationclass":[188],"consumer-grade":[190],"ones.":[191],"We":[192],"show":[193],"allows":[196],"attacker":[198,217],"arbitrarily":[200],"read":[201],"modify":[203],"data":[204],"across":[205],"contexts.":[207],"More":[208],"crucially,":[209],"demonstrate":[211],"can":[214],"help":[215],"escalate":[218],"privileges":[219],"root":[221],"system.":[225]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2026-07-02T00:00:00"}