GPUThor: New Rowhammer Attack Defeats NVIDIA ECC Protection to Achieve Host Root Access

Aug 28

4 min read

Key Findings

University of Toronto researchers developed GPUThor, a Rowhammer attack that defeats ECC protection on NVIDIA RTX A-series GPUs with GDDR6 memory
Attack enables privilege escalation to root on host systems and requires only unprivileged CUDA kernel execution
Four NVIDIA GPUs confirmed vulnerable: RTX A6000, A5000, A4000, and A4500
Non-uniform hammering technique achieves 72,000 to 377,000 bit flips per gigabyte with ECC disabled, up to 23,000 times more effective than prior GPU Rowhammer attacks
Multi-bit errors bypass SECDED ECC error correction, enabling silent data corruption and privilege escalation
Exploitation time reduced from four days to 1.1 minutes using optimized hammering patterns

Background

Rowhammer attacks exploit a hardware vulnerability in DRAM where repeatedly accessing the same memory row causes bit flips in adjacent rows. While this technique has been studied extensively on CPUs, GPU implementations have received less attention. NVIDIA previously recommended enabling ECC as the primary mitigation against GPU Rowhammer attacks. GPUThor builds on earlier work by the same research team, specifically GPUHammer, which was the first successful GPU Rowhammer attack on NVIDIA hardware but was neutralized when ECC was enabled.

Technical Approach and Attack Mechanism

The key innovation in GPUThor is non-uniform hammering, which differs from prior GPU attacks that activated aggressor and decoy rows at roughly equal rates. The researchers discovered that GDDR6 Target Row Refresh defenses apply approximately once every 72 refresh intervals rather than once per interval. They exploited this by crafting a six-interval hammering pattern that distributes accesses strategically across warps and cache lines.

The researchers identified that accesses from a single warp are merged at the memory controller into a single DRAM activation, while accesses from different warps to different cache lines within the same row survive as separate activations. This allowed them to concentrate hammering pressure on specific victim rows while evading refresh-based defenses.

Results Across Tested Hardware

Testing on four Ampere-class GPUs over 24-hour campaigns produced dramatically different results. The RTX A5000 proved most vulnerable at 377,552 bit flips per gigabyte, while the A6000 achieved 72,000 flips per gigabyte. These rates far exceeded previous attempts, approaching levels demonstrated in Blacksmith, a noted DDR4 Rowhammer attack.

Multi-bit errors were particularly concerning. Across all four cards, researchers identified 387 double-bit flips and two triple-bit flips with ECC disabled. The A5000 accounted for 306 of the double-bit flips and both triple-bit flips. This matters because SECDED ECC is designed to correct single errors and detect two-bit errors, but three-bit errors result in silent data corruption where the system has no awareness of the corruption.

ECC Failure and Silent Data Corruption

Even with ECC enabled, the attack succeeded in triggering exploitable errors. On the RTX A6000 with system-level ECC active, one day of hammering produced 11 detectable uncorrectable errors and one silent data corruption incident. While detectable errors crash GPU kernels, silent data corruption passes undetected, allowing attackers to work with corrupted data.

The researchers discovered a critical timing window in NVIDIA's error handling. Double-bit errors are serviced lazily, meaning there is approximately a 10-millisecond delay between DUE detection and GPU termination. During this window, attacker kernels can still consume the corrupted data before the GPU is killed, enabling exploitation of what should be a fatal error condition.

Privilege Escalation Path

The researchers reused exploit techniques from their prior GPUBreach research to convert memory corruption into host root access. The attack manipulates GPU page tables by hammering neighboring DRAM rows to flip the page-frame number in a page table entry. A second kernel then reads memory outside its legitimate access range through the corrupted entry, reaching host memory.

With a triple-bit silent data corruption error and IOMMU enabled, attackers achieved root on the host system. With a double-bit detectable uncorrectable error on IOMMU-disabled systems, they successfully overwrote process credential structures. Initial exploitation required approximately four days of searching to locate exploitable multi-bit errors without triggering immediate detection.

Performance Timeline and Exploitation Speed

The optimization from discovery to practical exploitation was dramatic. Finding exploitable errors without detection took around four days on the A6000 using baseline techniques. An end-to-end privilege escalation originally took 21.9 hours. However, using GPUHammer's patterns reduced this to 1.1 minutes, and GPUThor's specialized patterns achieved the same result in 1.1 minutes on the same hardware.

Hardware Scope and Immunity

The vulnerability is not universal across NVIDIA's GPU lineup. Testing on RTX 4090 with GDDR6X, L40 with GDDR6, L4 with GDDR6, A10 with GDDR6, and A30 with HBM2e memory produced no bit flips using the same hammering patterns. This suggests the vulnerability is specific to GDDR6 memory implementations on certain GPU architectures, not a systemic flaw across all NVIDIA accelerators.

Mitigation Recommendations

The research team and NVIDIA recommend several defensive measures. Organizations should avoid sharing GPU resources across untrusted tenants, particularly in cloud environments. Monitoring ECC error counters for anomalous increases can detect active exploitation. Restricting execution of untrusted CUDA workloads prevents attackers from launching the initial unprivileged kernel. Enabling system-level ECC, while not providing complete protection as this research demonstrates, substantially reduces exploitation feasibility and creates detection opportunities through error monitoring.

Sources

https://thehackernews.com/2026/08/gputhor-rowhammer-defeats-ecc-on-nvidia.html
https://www.facebook.com/thehackernews/posts/%EF%B8%8F-new-gputhor-attack-defeats-ecc-on-nvidias-rtx-a6000-and-demonstrates-host-priv/1459023752928870
https://www.bleepingcomputer.com/news/security/new-gputhor-attack-defeats-nvidia-ecc-protection-for-root-access