Academic researchers from the University of Toronto have disclosed a new Rowhammer attack called GPUThor targeting NVIDIA workstation GPUs equipped with GDDR6 memory. The attack defeats error correction codes (ECC), which is the primary mitigation NVIDIA recommends against GPU Rowhammer attacks. GPUThor enables both denial-of-service (DoS) and privilege escalation attacks, ultimately allowing an attacker to gain a root shell on the host system. The attack demonstrates that ECC alone is insufficient as a defense against Rowhammer-class attacks on modern GPU hardware. This research highlights significant security risks for workstation and high-performance computing environments using NVIDIA RTX A6000 GPUs, and potentially other GDDR6-based GPU products.
GPUThor is a Rowhammer attack developed by University of Toronto researchers targeting NVIDIA Ampere-class workstation GPUs with GDDR6 memory. The attack defeats Error Correction Codes (ECC), including System-Level ECC which NVIDIA previously recommended as a sufficient mitigation. The technique uses non-uniform hammering, activating aggressor rows far more frequently than decoy rows, which bypasses the Target Row Refresh (TRR) in-DRAM defense. Repeated memory accesses within a single warp (32 GPU threads running in lockstep) are merged at the memory controller into a single DRAM activation, while accesses from different warps to different cache lines in the same row survive as separate activations. The researchers determined TRR on tested GDDR6 parts applies approximately once every 72 refresh intervals, and built a six-interval hammering pattern around that schedule. Four DRAM banks were hammered for 24 hours each on four Ampere-class cards, producing 72,000 to 377,000 bit flips per gigabyte with ECC disabled. The RTX A5000 was most susceptible at 377,552 flips/GB — 23,597 times more than GPUHammer and ~500 times more than GDDRHammer. With ECC disabled, 387 double-bit flips and 2 triple-bit flips were observed. The SECDED (single-error-correct, double-error-detect) ECC used on these GPUs mis-corrects triple-bit flips, causing silent data corruption (SDC). With ECC enabled on an RTX A6000, hammering produced 11 detectable uncorrectable errors (DUE) and 1 SDC over one day (avg. one DUE every two hours), each DUE crashing all running GPU kernels. For privilege escalation, the researchers reused exploit code from GPUBreach: page tables are massaged into a vulnerable DRAM row, neighboring rows are hammered to corrupt page-frame number entries, and a second kernel accesses memory outside the process. Using triple-bit SDC, root was obtained on the host with IOMMU enabled. Using double-bit DUE (exploitable via a ~10ms lazy servicing window before GPU kill), host-side privilege escalation was achieved with IOMMU disabled by repointing a page-table entry to CPU memory and overwriting the process credential structure. End-to-end privilege escalation took 21.9 hours on the A6000. Other tested NVIDIA GPUs (A10, L4, L40 on GDDR6; RTX 4090 on GDDR6X; A30 on HBM2e) showed no bit flips, attributed to different TRR implementations. Server-class Ampere GPUs with Error Containment and Dynamic Page Offlining remain potentially vulnerable to SDC-based escalation. No patch exists; a complete fix would require stronger multi-bit error correction and in-DRAM defenses such as Refresh Management or Per-Row Activation Counting in future GPU hardware.
1. Avoid cross-tenant GPU sharing on shared NVIDIA Ampere-class GPU infrastructure. 2. Monitor ECC error counters for unusual DUE (detectable uncorrectable error) rates — a pattern of ~1 DUE every two hours may indicate an active attack. 3. Restrict untrusted CUDA workloads from executing on sensitive GPU hardware. 4. Enable System-Level ECC as a partial mitigation (raises the attack bar but is no longer sufficient alone). 5. Enable IOMMU where possible to limit the impact of privilege escalation attempts. 6. Review NVIDIA security notice (https://nvidia.custhelp.com/app/answers/detail/a_id/5873) for vendor guidance. 7. Plan for hardware-level mitigations in future GPU procurement — require Refresh Management or Per-Row Activation Counting support. 8. Monitor for public release of GPUThor attack code on November 15, 2026 (ACM CCS conference) and reassess exposure at that time. 9. For cloud providers (Google, Microsoft, AWS), review GPU multi-tenancy isolation policies for Ampere-class hardware. 10. Be aware that server-class Ampere GPUs with Error Containment and Dynamic Page Offlining may still be vulnerable to SDC-based escalation despite additional protections.
