New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
GPUThor is a Rowhammer attack by University of Toronto researchers that defeats ECC on NVIDIA RTX A4000/A5000/A6000 GPUs with GDDR6 memory, achieving up to 377,552 bit flips per gigabyte The attack uses non-uniform hammering to overwhelm Target Row Refresh (TRR) defenses by activating aggressor rows far more frequently than decoy rows, exploiting warp-level memory access merging at the GPU memory controller GPUThor enables both denial-of-service and privilege escalation to host root, using tripl
65
Hot
70
Quality
55
Impact
Analysis
TL;DR
- GPUThor is a Rowhammer attack by University of Toronto researchers that defeats ECC on NVIDIA RTX A4000/A5000/A6000 GPUs with GDDR6 memory, achieving up to 377,552 bit flips per gigabyte
- The attack uses non-uniform hammering to overwhelm Target Row Refresh (TRR) defenses by activating aggressor rows far more frequently than decoy rows, exploiting warp-level memory access merging at the GPU memory controller
- GPUThor enables both denial-of-service and privilege escalation to host root, using triple-bit silent data corruption (SDC) with IOMMU enabled and double-bit detectable uncorrectable errors (DUE) with IOMMU disabled
- NVIDIA's recommended ECC mitigation is bypassed through ECC mis-correction (3 mis-corrected bits causing SDC) and a ~10 ms lazy DUE servicing window that allows attackers to consume corrupted data before the GPU is killed
- The vulnerability is limited to specific Ampere-class GDDR6 workstation GPUs; newer memory types (GDDR6X, HBM2e) and datacenter GPUs showed no bit flips under the same attack patterns
Why It Matters
GPUThor represents a significant escalation in GPU-side physical and logical attack surfaces, demonstrating that workstation GPUs commonly deployed in multi-tenant cloud and shared computing environments are vulnerable to cross-tenant privilege escalation. The findings expose a critical gap between NVIDIA's ECC-based mitigation recommendations and the reality of ECC mis-correction and lazy error handling, directly impacting cloud providers, AI training infrastructures, and any organization running untrusted CUDA workloads on affected hardware.
Technical Details
- Non-uniform hammering technique: GPUThor exploits the fact that repeated memory accesses within a single warp (32 threads) are merged into one DRAM activation at the memory controller, while accesses from different warps to different cache lines in the same row remain separate. The attack distributes hammering across warps to maximize aggressor row activations while minimizing decoy row activations, swamping the TRR defense that typically refreshes approximately once every 72 refresh intervals on these GDDR6 parts.
- ECC defeat mechanism: The SECDED (Single Error Correct, Double Error Detect) ECC on these GPUs mis-corrects when three bits are flipped in a protected chunk, producing silent data corruption (SDC) instead of flagging an error. Over four cards with ECC disabled, campaigns produced 387 double-bit flips and 2 triple-bit flips at 16-byte granularity. With ECC enabled, the attack generated detectable uncorrectable errors (DUE) averaging one every two hours, each aborting all GPU kernels.
- Privilege escalation chain: Reusing exploit code from the earlier GPUBreach research, the attack corrupts page table entries by hammering rows adjacent to vulnerable page-table entries, redirecting a page-frame number into CPU memory. With triple-bit SDC and IOMMU enabled, host root was obtained. With double-bit DUE and IOMMU disabled, the ~10 ms lazy servicing window allows the attacker's kernel to consume corrupted data before the GPU is killed, enabling page-table repointing and credential structure overwrites.
- Performance and scope: End-to-end privilege escalation completed in 1.1 minutes on the RTX A6000. The RTX A5000 was the most susceptible card at 377,552 flips per gigabyte—23,597× GPUHammer's rate and ~500× GDDRHammer's rate. Vulnerable GPUs include RTX A6000 (48 GB), A5000 (24 GB), A4500 (20 GB), and A4000 (16 GB). No bit flips were observed on A10, L4, L40, RTX 4090 (GDDR6X), or A30 (HBM2e).
- Server-class implications: Ampere server GPUs and newer carry Error Containment and Dynamic Page Offlining, but still rely on SECDED-level ECC, meaning SDC-based escalation remains viable. RAS Repair on some Blackwell GPUs increases the time required for DUE-based exploitation but does not prevent it. The A100 and H100 were not tested.
Industry Insight
- Cloud providers and GPU-as-a-service platforms should immediately audit deployments of Ampere-class workstation GPUs (A4000-A6000) for cross-tenant co-location, as the attack requires only unprivileged CUDA kernel execution—readily achievable in shared GPU environments. Disabling cross-tenant GPU sharing and enforcing strict workload isolation are the most effective immediate mitigations.
- NVIDIA's reliance on System-Level ECC as the primary mitigation is insufficient given the demonstrated ECC mis-correction and lazy DUE handling; organizations should implement additional layers such as IOMMU enforcement, continuous ECC error counter monitoring, and runtime anomaly detection for uncorrectable error rates exceeding baseline thresholds.
- The vulnerability landscape for GPU computing is expanding beyond software-side attacks into hardware-level memory corruption, paralleling trends seen in CPU Rowhammer research. AI practitioners and infrastructure teams should treat GPU memory integrity as a first-class security concern, incorporating hardware vulnerability assessments into procurement and deployment decisions, particularly for multi-tenant and untrusted workload scenarios.
Disclaimer: The above content is generated by AI and is for reference only.
Security GPU Research
Related Articles
Cargo Thefts Have Turned Violent in Pursuit of AI Hardware
The Download: inside OpenAI's Hugging Face hack, and a new EV takes on the US
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
What the Data Says About AI in Security Operations in 2026
Learn How to Build Security Operations Ready for AI-Powered Attacks