A new, highly sophisticated Rowhammer attack, dubbed GPUThor, has been revealed to effectively bypass Error Correcting Code (ECC) protections on NVIDIA’s Ampere-class workstation GPUs, enabling both denial-of-service (DoS) and root-level privilege escalation. This development signifies a critical vulnerability in GDDR6 memory architectures, previously thought to be robustly shielded against such memory-fault attacks.
Architectural Vulnerability and Attack Mechanism
GPUThor builds upon prior Rowhammer research, including GPUHammer and GPUBreach, by refining the hammering pattern to exploit undocumented behaviors within NVIDIA’s GPU memory subsystem. Rowhammer attacks induce bit flips in DRAM by repeatedly accessing adjacent memory rows, leveraging a physical side-effect of memory cell interaction. Modern GDDR6 memory implements Target Row Refresh (TRR) as a mitigation, alongside NVIDIA’s SECDED ECC for single-bit error correction and double-bit error detection.
The core innovation of GPUThor lies in its non-uniform hammering pattern, which disproportionately targets “aggressor” rows while maintaining sufficient “decoy” activity to evade TRR. This specialized technique also accounts for how the GPU coalesces repeated memory requests and the specific frequency of TRR activation, effectively circumventing both hardware mitigations. The attack requires the capability to launch an unprivileged CUDA kernel on the target GPU.
| Specification | Detail |
|---|---|
| Attack Vector | Rowhammer (Memory-fault) |
| Targeted GPUs | NVIDIA Ampere-class Workstation GPUs (RTX A4000, A4500, A5000, A6000) |
| Memory Type | GDDR6 (ECC-enabled and non-ECC) |
| Primary Evasion | NVIDIA SECDED ECC, GDDR6 Target Row Refresh (TRR) |
| Key Techniques | Non-uniform hammering pattern, exploiting undocumented memory coalescing and TRR behaviors |
| Required Privilege | Unprivileged CUDA kernel execution |
| Observed Bit Flips (no ECC) | 72,000 to 377,000 flips per GB |
| Observed ECC Errors (with ECC) | 387 detected uncorrectable double-bit errors, 2 incorrectly repaired triple-bit errors |
Concrete Data and Performance Implications
GPUThor demonstrates significantly enhanced attack efficacy compared to its predecessors. Researchers observed between 72,000 and 377,000 bit flips per GB on tested GPUs without ECC, with the RTX A5000 achieving the highest rate. This represents an increase of 4,548 to 23,597 times higher bit-flip rates compared to the prior GPUHammer attack. The optimized hammering pattern results in 6.6 times more aggressor-row activations than previous GPU Rowhammer attacks.
With ECC enabled, GPUThor induced 387 double-bit errors that were detected but uncorrectable, and critically, two triple-bit errors that ECC attempted to repair but resulted in data corruption. This level of error generation reduces the time required to find an exploitable bit flip from 21.9 hours (GPUHammer) to approximately 1.1 minutes with GPUThor.
The attack can manifest as a denial-of-service, causing an ECC-enabled RTX A6000 to reset approximately every two hours. More severely, researchers demonstrated root privilege escalation by corrupting GPU page tables, allowing an unprivileged CUDA program to gain arbitrary memory access and launch a root shell on the host system. While NVIDIA Ampere and later architectures feature error containment to limit the impact of uncorrectable ECC errors, GPUThor’s ability to corrupt page tables represents a systemic bypass.
- GPUThor represents a significant advancement in Rowhammer attacks, specifically targeting and bypassing NVIDIA’s SECDED ECC and GDDR6 TRR mitigations.
- The vulnerability impacts NVIDIA Ampere-class workstation GPUs utilizing GDDR6 memory, including the RTX A4000, A4500, A5000, and A6000 series.
- Consequences include denial-of-service and critical root-level privilege escalation through GPU page table corruption, underscoring systemic security risks.
- Mitigation strategies include avoiding cross-tenant GPU sharing, proactive monitoring of ECC error counters, and strictly restricting untrusted CUDA workloads.