Full Report
A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escalation. [...]
Analysis Summary
# Vulnerability: GPUThor Rowhammer Attack on NVIDIA GPUs
## CVE Details
- **CVE ID**: Not explicitly assigned in the provided text (NVIDIA issued advisory [5873](https[:]//nvidia[.]custhelp[.]com/app/answers/detail/a_id/5873))
- **CVSS Score**: Not specified (Impact includes Root-level Privilege Escalation and DoS)
- **CWE**: CWE-1308 (Insufficient Resistance to High Side-Channel Resistance - Rowhammer)
## Affected Systems
- **Products**: NVIDIA Ampere-class Workstation GPUs and potentially Server-class GPUs.
- **Versions**: Specifically tested on GDDR6-based workstation models.
- **Configurations**:
- **Affected Models**: RTX A4000, RTX A4500, RTX A5000, RTX A6000.
- **Potentially Affected**: A100 (Server-class), Blackwell GPUs (partial resilience via RAS Repair), and potentially HBM3/e or GDDR7 GPUs.
- **Reported Safe**: GDDR6X and HBM2e GPUs (no flips observed in tests).
## Vulnerability Description
GPUThor is an advanced Rowhammer attack that bypasses Error-Correcting Code (ECC) protections (specifically SECDED - Single Error Correction, Double Error Detection). By accounting for undocumented GPU behaviors—specifically memory request coalescing and Target Row Refresh (TRR) activation intervals—researchers developed a non-uniform hammering pattern.
This pattern achieves bit-flip rates 4,500x to 23,000x higher than previous methods. On ECC-enabled systems, GPUThor can trigger:
1. **Double-bit errors**: Detected but uncorrectable, leading to crashes.
2. **Triple-bit errors**: Incorrectly "repaired" by ECC, leading to silent data corruption and potential security bypasses.
## Exploitation
- **Status**: PoC available (developed by University of Toronto researchers).
- **Complexity**: High (requires specific timing and knowledge of undocumented memory controller behaviors).
- **Attack Vector**: Local (requires the ability to run unprivileged CUDA code on the target system).
## Impact
- **Confidentiality**: **High** (Root-level privilege escalation via GPU page table corruption).
- **Integrity**: **High** (Silent data corruption through incorrectly repaired triple-bit flips).
- **Availability**: **High** (Denial-of-Service; can cause GPU resets and permanent hardware "requiring replacement" status).
## Remediation
### Patches
There is no direct software "patch" for the physical Rowhammer susceptibility of the DRAM; however, NVIDIA has issued guidance to harden systems.
### Workarounds
- **Enable System-level Protections**: Enable both **SYS-ECC** and **IOMMU/DMA isolation**.
- **Isolation**: Restrict the sharing of GPUs between different tenants (cross-tenant sharing).
- **Access Control**: Restrict the execution of untrusted or unverified CUDA workloads.
## Detection
- **Telemetry Monitoring**: Actively monitor GPU error telemetry for ECC error counters.
- **Error Patterns**: Watch for frequent GPU resets or a sudden spike in uncorrectable double-bit errors, which may indicate a Rowhammer attempt or a DoS attack in progress.
## References
- **Vendor Advisory**: [https[:]//nvidia[.]custhelp[.]com/app/answers/detail/a_id/5873]
- **Research Paper**: [https[:]//gururaj-s[.]github[.]io/assets/pdf/CCS26_GPUThor[.]pdf]
- **Project Website**: [https[:]//gputhor[.]com/]