Full Report
Academic researchers have disclosed a Rowhammer attack impacting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes (ECC), the mitigation NVIDIA recommends against GPU Rowhammer, and enables denial-of-service (DoS) and privilege escalation to a root shell. Dubbed GPUThor, the attack was developed by researchers at the University of Toronto, who hammered four DRAM
Analysis Summary
# Research: GPUThor: Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
## Metadata
- **Authors:** Gururaj Saileshwar et al.
- **Institution:** University of Toronto
- **Publication:** ACM Conference on Computer and Communications Security (CCS)
- **Date:** August 2026 (Reported); July 2025 (Initial Security Notice)
## Abstract
GPUThor is a sophisticated Rowhammer attack targeting NVIDIA workstation-grade GPUs equipped with GDDR6 memory. The research demonstrates that even with System-Level Error Correction Code (ECC) enabled—NVIDIA's primary recommended mitigation—adversaries can induce multi-bit flips. These flips lead to either Denial-of-Service (DoS) via Detectable Uncorrectable Errors (DUE) or, more critically, Silent Data Corruption (SDC). By leveraging SDC, the researchers achieved privilege escalation from an unprivileged CUDA kernel to a root shell on the host system.
## Research Objective
The research aims to determine if modern GPU memory (GDDR6) and its associated hardware mitigations (Target Row Refresh and ECC) are vulnerable to advanced Rowhammer patterns. Specifically, it seeks to bypass the ECC protections that previously neutralized GPU-based Rowhammer attacks.
## Methodology
### Approach
- **Non-Uniform Hammering:** Unlike previous attacks that accessed rows at equal rates, GPUThor uses non-uniform frequencies to bypass Target Row Refresh (TRR). The aggressor row is activated significantly more often than "decoy" rows intended to exhaust the TRR tracking mechanism.
- **Warp-Level Parallelism:** The researchers optimized the hammering kernels by ensuring memory accesses were issued from different warps to prevent the memory controller from merging requests, thereby maximizing DRAM activations.
- **Timing Analysis:** The team identified the TRR schedule (likely once every 72 refresh intervals) to synchronize their hammering patterns with the memory's internal defense cycles.
### Dataset/Environment
The attack was tested on four Ampere-architecture NVIDIA GPUs:
- RTX A6000 (48 GB GDDR6)
- RTX A5000 (24 GB GDDR6)
- RTX A4500 (20 GB GDDR6)
- RTX A4000 (16 GB GDDR6)
### Tools & Technologies
- **CUDA:** Used to develop the unprivileged hammering kernels.
- **GPUBreach Exploit Code:** A previously developed framework for GPU page-table privilege escalation.
## Key Findings
### Primary Results
1. **ECC Bypass:** GPUThor induces triple-bit flips that SECDED (Single Error Correction, Double Error Detection) ECC mis-corrects, leading to Silent Data Corruption (SDC).
2. **High Bit-Flip Density:** The RTX A5000 exhibited up to 377,552 flips per gigabyte—roughly 500 times more effective than the previous state-of-the-art (GDDRHammer).
3. **Root Escalation:** By corrupting Page Table Entries (PTEs) via Rowhammer, the researchers gained unauthorized access to host CPU memory and achieved a root shell.
4. **Denial of Service:** Double-bit flips trigger DUEs that crash all running kernels on the GPU, requiring a hardware reset.
### Supporting Evidence
- **RTX A5000 Stats:** Produced 306 double-bit flips and two triple-bit flips in 24 hours.
- **RTX A6000 Stats:** One bank produced 11 DUEs and one SDC over a 24-hour period (one crash every two hours).
### Novel Contributions
- **First GDDR6 ECC Bypass:** Demonstrates that ECC is insufficient against high-density GPU Rowhammer.
- **Pattern Optimization:** Introduction of non-uniform hammering patterns specifically tailored for the GDDR6 memory controller and TRR implementation.
## Technical Details
The attack exploits the way GPUs handle memory requests. By distributing accesses across different warps and specific cache lines, the researchers bypass the memory controller’s coalescing logic. Once they can reliably flip bits, they use a "massaging" technique to place sensitive Page Table Entries into vulnerable DRAM rows. A triple-bit flip in a PTE can change the Page Frame Number (PFN) to point to host memory, allowing the GPU kernel to read/write sensitive system data, including process credentials.
## Practical Implications
### For Security Practitioners
- **Multi-tenancy Risks:** Shared GPU environments (e.g., cloud AI providers) are at high risk. An unprivileged user can potentially compromise the entire host or other users' data.
- **Mitigation Failure:** Standard ECC is no longer a "silver bullet" for GPU memory integrity.
### For Defenders
- **Monitoring:** Actively monitor ECC error counters for high frequencies of corrected or uncorrectable errors, which may indicate a Rowhammer attempt.
- **Isolation:** Restrict untrusted CUDA workloads and avoid cross-tenant GPU sharing where high security is required.
- **IOMMU:** While IOMMU provides some protection, the research shows that triple-bit SDCs can still bypass these protections to achieve root.
### For Researchers
- Focus shifts toward developing "Strong ECC" or hardware-level row-activation limiting that cannot be bypassed by non-uniform patterns.
## Limitations
- **Time Intensity:** Some bit flips required up to 24 hours of continuous hammering to manifest.
- **Hardware Specificity:** The success rate varies significantly between different GPU models and individual DRAM chips.
## Comparison to Prior Work
- **vs. GPUHammer:** GPUThor is ~23,000 times more effective in terms of bit-flip density and successfully bypasses the ECC that stopped GPUHammer.
- **vs. Blacksmith:** GPUThor adapts the non-uniform hammering concepts originally proved on DDR4 (Blacksmith) to the unique architecture of GDDR6 and NVIDIA GPUs.
## Real-world Applications
- **Implementation Considerations:** Attackers require the ability to run CUDA code; however, this is common in "AI-as-a-Service" and research environments.
- **Exploitation:** Could be used for persistent stealthy data exfiltration or disrupting competitor workloads in cloud environments.
## Future Work
- **Dynamic Defenses:** Developing software-level mitigations that detect non-uniform access patterns in real-time.
- **Architecture Testing:** Testing the vulnerability of newer Blackwell-architecture GPUs and HBM (High Bandwidth Memory) used in data center chips like the H100.
## References
- NVIDIA Security Advisory: `https[://]nvidia[.]custhelp[.]com/app/answers/detail/a_id/5671`
- Full Paper: `https[://]gururaj-s[.]github[.]io/assets/pdf/CCS26_GPUThor[.]pdf`