GPUThor: New Rowhammer Attack Defeats ECC Protection on NVIDIA GPUs

Researchers at the University of Toronto have unveiled a new variant of the Rowhammer attack, dubbed GPUThor. It defeats the error-correction (ECC) protection on NVIDIA graphics cards and makes it possible both to trigger a denial of service (DoS) and to escalate privileges to root level on the host system.

Rowhammer is a class of attacks in which repeatedly “hammering” rows of memory raises the odds of bit flips in neighboring areas, changing their state from one to zero and vice versa. For GPUs this is especially dangerous: training and running AI models rely on video memory, and corrupted data can quietly skew the result. NVIDIA counters this with a SECDED ECC mechanism that corrects single-bit errors and detects double-bit ones. It was precisely ECC that once rendered the authors' earlier proofs of concept — GPUHammer and GPUBreach — moot.

The breakthrough

The researchers reworked the “hammering” pattern, making it non-uniform and tuning the frequency so that the Target Row Refresh (TRR) mechanism of the GDDR6 memory would not kick in. To do this, they took into account two undocumented properties of the GPU: how repeat requests to memory are coalesced and how often TRR is activated. As a result, the number of accesses to the “aggressor” rows increased by a factor of 6.6, and on cards without ECC they achieved between 72,000 and 377,000 bit flips per gigabyte — thousands to tens of thousands of times more than GPUHammer, and close to the figures of powerful CPU attacks such as Blacksmith. Finding an exploitable bit now takes about 1.1 minutes instead of the previous nearly 22 hours.

With ECC enabled, the attack produced 387 double-bit errors, which the mechanism detects but does not correct, and two triple-bit ones — which ECC “fixed” incorrectly, leading to data corruption.

The fallout

The attack was validated on workstations with Ampere cards and GDDR6 memory — the RTX A4000, A4500, A5000, and A6000, widely used in AI and cloud infrastructure. On the RTX A6000 the researchers caused a DoS: the graphics card rebooted every two hours, cutting off all tasks, and after repeated failures flagged itself as needing replacement. A more serious scenario is privilege escalation: by corrupting the GPU's page tables, an unprivileged CUDA program gains arbitrary access to memory and can open a root shell on the host.

Also at risk are the server-grade A100 accelerators, which still rely on SECDED. On some Blackwell cards the RAS Repair feature makes the attack harder but does not rule it out; the authors allow that even GPUs with HBM3/e and GDDR7 memory may be vulnerable if multi-bit flips are provoked.

The finding was reported to NVIDIA on April 29, and on August 21 the company issued its recommendations: enable SYS-ECC and IOMMU/DMA isolation, monitor error telemetry, and limit the running of untrusted workloads. NVIDIA notes that on the tested cards with GDDR6X and HBM2e no bit flips were observed using the same methods. The researchers, for their part, advise avoiding shared use of a GPU by different tenants where possible, and acknowledge that full protection will require stronger multi-bit ECC and hardware measures in future generations of graphics cards.

Source: Bleeping Computer