A newly identified Rowhammer attack, dubbed GPUThor, has been shown to bypass error-correcting code (ECC) protections on NVIDIA GPUs, potentially leading to denial-of-service (DoS) conditions and root-level privilege escalation. Researchers from the University of Toronto demonstrated the attack against NVIDIA Ampere-class workstation GPUs utilizing GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000 models. These GPUs are commonly deployed in AI and cloud infrastructure environments.
Rowhammer attacks exploit a vulnerability where repeated access to memory rows can cause bit flips in adjacent memory regions. While NVIDIA employs SECDED ECC to correct single-bit errors and detect double-bit errors, GPUThor employs a non-uniform hammering pattern designed to avoid triggering GDDR6's Target Row Refresh (TRR) mitigations. This pattern was developed by accounting for undocumented GPU behaviors related to memory request coalescing and TRR activation frequency.
Compared to previous Rowhammer attack concepts, GPUThor significantly increases aggressor-row activations, achieving between 72,000 and 377,000 bit flips per GB on tested GPUs without ECC protections. This represents a 4,548 to 23,597-fold increase over the researchers' prior GPUHammer attack. At these rates, an exploitable bit flip could be found in approximately 1.1 minutes, a substantial reduction from 21.9 hours with GPUHammer.
With ECC enabled, GPUThor generated 387 double-bit errors, which ECC detects but cannot correct. Additionally, two triple-bit errors were observed, which ECC incorrectly repaired, resulting in data corruption. The researchers demonstrated that GPUThor could induce a DoS state on an ECC-enabled RTX A6000, causing the GPU to reset every two hours and terminate workloads. Repeated attacks on the same card could lead to the device marking itself as requiring replacement.
More critically, the researchers claim GPUThor can achieve root-level privilege escalation by corrupting GPU page tables. This could grant an unprivileged CUDA program arbitrary memory access and enable the opening of a root shell on the host system.
Beyond the four confirmed vulnerable models, the researchers indicate that privilege escalation may also be possible on server-class Ampere GPUs (A100), despite their improved resilience to DoS conditions, because they still rely on SECDED-level ECC. For some Blackwell GPUs, the RAS Repair resilience feature could make a GPUThor attack more time-consuming but not entirely prevent it. The researchers also suggest that HBM3/e and GDDR7 GPUs with on-die ECC might be vulnerable if multi-bit flips are triggered.
The University of Toronto researchers reported their findings to NVIDIA on April 29. NVIDIA subsequently published an advisory on August 21, providing guidance. The company recommends enabling both SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting the sharing or execution of untrusted workloads. NVIDIA noted that the risk varies depending on the DRAM device, memory technology, platform design, in-DRAM defenses, and system configuration, and stated that no bit flips were observed on tested GDDR6X or HBM2e GPUs using the same attack patterns.
The researchers advise avoiding cross-tenant GPU sharing where feasible, monitoring ECC error counters, and restricting untrusted CUDA workloads. They suggest that comprehensive protection will likely necessitate stronger multi-bit ECC and hardware-level defenses in future GPU designs.
