{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T00:25:36Z","timestamp":1787012736548,"version":"3.56.0"},"reference-count":61,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-2443671,OAC-2530649,CNS-2145744"],"award-info":[{"award-number":["CNS-2443671,OAC-2530649,CNS-2145744"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00230","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"565-583","source":"Crossref","is-referenced-by-count":1,"title":["GeForge: Hammering GDDR Memory to Forge GPU Page Tables for Fun and Profit"],"prefix":"10.1109","author":[{"given":"Junpeng","family":"Wan","sequence":"first","affiliation":[{"name":"Clemson University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanan","family":"Guo","sequence":"additional","affiliation":[{"name":"University of Rochester"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhi","family":"Zhang","sequence":"additional","affiliation":[{"name":"University of Western Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhuo","family":"Li","sequence":"additional","affiliation":[{"name":"HydroX AI"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dave Jing","family":"Tian","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhenkai","family":"Zhang","sequence":"additional","affiliation":[{"name":"Clemson University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2872362.2872390"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-53140-2_29"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.63"},{"key":"ref4","article-title":"CATT: Software-only Mitigation against Rowhammer Attacks","volume-title":"USENIX Security Symposium","author":"Brasser","year":"2017"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3676641.3716002"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2946816"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00089"},{"key":"ref8","article-title":"Characterizing GPU Resilience and Impact on AI\/HPC Systems","author":"Cui","year":"2025","journal-title":"Preprint"},{"key":"ref9","article-title":"SMASH: Synchronized Many-sided Rowhammer Attacks from JavaScript","volume-title":"USENIX Security Symposium","author":"De Ridder","year":"2021"},{"key":"ref10","article-title":"Thunderhammer: Rowhammer Bitflips via PCIe and Thunderbolt (USB-C)","author":"Dumitru","year":"2025","journal-title":"Preprint"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00022"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00090"},{"key":"ref13","article-title":"Pwntools: CTF Framework and Exploit Development Library","year":"2025","journal-title":"Gallopsled"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00031"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_15"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3152701.3152709"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833772"},{"key":"ref18","article-title":"Graphics double data rate 6 (GDDR6) SGRAM standard","year":"2023","journal-title":"JEDEC Solid State Technology Association"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329811"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-64171-8_24"},{"key":"ref21","article-title":"ECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory","volume-title":"USENIX Security Symposium","author":"Kamadan","year":"2025"},{"key":"ref22","first-page":"1597","article-title":"SledgeHammer: Amplifying Rowhammer via Bank-level Parallelism","volume-title":"USENIX Security Symposium","author":"Kang","year":"2024"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2014.6853210"},{"key":"ref24","first-page":"3807","article-title":"Half-Double: Hammering from the Next Row Over","volume-title":"USENIX Security Symposium","author":"Kogler","year":"2022"},{"key":"ref25","article-title":"ZebRAM: Comprehensive and Compatible Software Protection Against Rowhammer Attacks","volume-title":"USENIX Symposium on Operating Systems Design and Implementation (OSDI)","author":"Konoth","year":"2018"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00020"},{"key":"ref27","article-title":"Blaster: Characterizing the Blast Radius of Rowhammer","volume-title":"Workshop on DRAM Security (DRAMSec)","author":"Lang","year":"2023"},{"key":"ref28","doi-asserted-by":"crossref","DOI":"10.1145\/3307650.3322232","article-title":"TWiCe: Preventing Row-Hammering by Exploiting Time Window Counters","volume-title":"International Symposium on Computer Architecture (ISCA)","author":"Lee","year":"2019"},{"key":"ref29","article-title":"GPUHammer: Rowhammer Attacks on GPU Memories are Practical","volume-title":"USENIX Security Symposium","author":"Lin","year":"2025"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW51379.2020.00102"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3579371.3589063"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23194"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP63933.2026.00083"},{"key":"ref34","article-title":"Not so Refreshing: Attacking GPUs using RFM Rowhammer Mitigation","volume-title":"USENIX Security Symposium","author":"Nazaraliyev","year":"2025"},{"key":"ref35","volume-title":"The RTX 3060 was the Most Used Graphics Card by Steam Gamers thisOctober 2025","year":"2025"},{"key":"ref36","article-title":"ABACuS: AllBank Activation Counters for Scalable and LowOverhead RowHammer Mitigation","volume-title":"USENIX Security Symposium","author":"Olgun","year":"2024"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/DSN-S58398.2023.00042"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00014"},{"key":"ref39","volume-title":"Security Analysis of Hybrid Intel CPU\/FPGA Platforms Using IOMMUs Against I\/O Attacks","author":"Peglow","year":"2020"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3669940.3707278"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3470496.3527421"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00130"},{"key":"ref43","first-page":"1","article-title":"Flip Feng Shui: Hammering a Needle in the Software Stack","volume-title":"USENIX Security Symposium","author":"Razavi","year":"2016"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA57654.2024.00049"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO56248.2022.00022"},{"key":"ref46","article-title":"Exploiting the DRAM Rowhammer Bug to Gain Kernel Privileges","author":"Seaborn","year":"2015","journal-title":"Black Hat USA"},{"key":"ref47","article-title":"Throwhammer: Rowhammer Attacks over the Network and Defenses","volume-title":"USENIX Annual Technical Conference (ATC)","author":"Tatar","year":"2018"},{"key":"ref48","volume-title":"Micron Datasheet 16Gb: 2 Channels x16\/x8 GDDR6 SGRAM (MT61K512M32)","year":"2025"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978406"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93411-2_5"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2020.i3.169-195"},{"key":"ref52","first-page":"19","article-title":"One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation","volume-title":"USENIX Security Symposium","author":"Xiao","year":"2016"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA51647.2021.00037"},{"key":"ref54","first-page":"1463","article-title":"DeepHammer: Depleting the Intelligence of Deep Neural Networks Through Targeted Chain of Bit Flips","volume-title":"USENIX Security Symposium","author":"Yao","year":"2020"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/DAC.2018.8465890"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616672"},{"key":"ref57","first-page":"2101","article-title":"Invalidate+Compare: A Timer-Free GPU Cache Attack Primitive","volume-title":"USENIX Security Symposium","author":"Zhang","year":"2024"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3266444.3266454"},{"key":"ref59","article-title":"Leveraging EM SideChannel Information to Detect Rowhammer Attacks","volume-title":"IEEE Symposium on Security and Privacy (S&P)","author":"Zhang","year":"2020"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00016"},{"key":"ref61","first-page":"399414","article-title":"SoftTRR: Protect Page Tables against Rowhammer Attacks using Software-only Target Row Refresh","volume-title":"USENIX Annual Technical Conference (ATC)","author":"Zhang","year":"2022"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573423.pdf?arnumber=11573423","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:35:17Z","timestamp":1782970517000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573423\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":61,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00230","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}