GPUThor Bypasses NVIDIA ECC, Risks Root Access

Researchers at the University of Toronto have disclosed a new Rowhammer attack called GPUThor that can bypass error-correcting code (ECC) protections on NVIDIA GPUs, potentially enabling denial-of-service (DoS) and root-level privilege escalation. The findings, detailed in a paper published by the university, demonstrate that the attack achieves significantly higher bit-flip rates than previous concepts.

Attack Overview

GPUThor is a variation of Rowhammer, a class of attacks where memory rows are repeatedly accessed—or "hammered"—to induce bit flips in adjacent memory rows. This can corrupt data and create security vulnerabilities. The researchers from the University of Toronto adjusted the hammering pattern to avoid triggering GDDR6's Target Row Refresh (TRR) mitigations, which are designed to prevent such attacks.

By accounting for two undocumented GPU behaviors—how repeated memory requests are coalesced and how frequently TRR activates—the researchers achieved what they describe as a "far more practical" bit-flip rate compared to earlier approaches like GPUHammer and GPUBreach.

Demonstration on Ampere GPUs

The attack was demonstrated on Ampere-class NVIDIA workstation GPUs with GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000, all widely used in AI and cloud infrastructure.

The researchers reported that the new pattern generates 6.6 times more aggressor-row activations and achieves between 72,000 and 377,000 flips per GB on the tested GPUs without ECC protections. These rates are between 4,548 and 23,597 times higher than GPUHammer, their previous attack, and approach the bit-flip rates of powerful CPU Rowhammer attacks like Blacksmith.

Bit-Flip Rates and Exploitability

At GPUThor's bit-flip rates, finding an exploitable bit flip is possible within roughly 1.1 minutes, down from 21.9 hours with GPUHammer. The researchers also noted that with ECC enabled, GPUThor generated 387 double-bit errors that ECC detects but cannot correct, and two triple-bit errors, which ECC repaired incorrectly, resulting in data corruption.

Impact on AI and Cloud Infrastructure

The attack's implications are significant for AI and cloud environments. Since AI model training relies heavily on GPU power, a successful Rowhammer attack could have a devastating impact on model accuracy. The researchers highlighted that even with ECC, the attack can cause data corruption, undermining the protections NVIDIA relies on.

Denial-of-Service and Privilege Escalation

The University of Toronto researchers demonstrated two attack outcomes. First, they induced a DoS state on an ECC-enabled RTX A6000, causing the GPU to reset every two hours and terminating all workloads. Repeated attacks eventually caused the device to mark itself as requiring replacement.

More critically, they showed that by corrupting GPU page tables, an unprivileged CUDA program could gain arbitrary memory access and open a root shell on the host system, leading to root-level privilege escalation.

Defenses and Mitigations

NVIDIA has published an advisory providing guidance to mitigate the attack. The company recommends enabling both SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting the sharing or execution of untrusted workloads. NVIDIA notes that the risk varies by DRAM device, memory technology, platform design, in-DRAM defenses, and system configuration, and that no bit flips were observed on tested GDDR6X or HBM2e GPUs using the same attack patterns.

The researchers themselves recommend avoiding cross-tenant GPU sharing where possible, monitoring ECC error counters, and restricting untrusted CUDA workloads. They added that complete protection will likely require stronger multi-bit ECC and hardware-level defenses in future GPUs.

Why It Matters

GPUThor represents a significant step forward in GPU-targeted Rowhammer attacks, bypassing ECC protections that were previously considered a reliable defense. This could raise the stakes for AI and cloud providers that rely on NVIDIA GPUs, as the attack may enable root access or disrupt critical workloads. While NVIDIA has issued guidance, the researchers suggest that fully mitigating the attack may require hardware changes in future GPU generations.