GPUThor Attack Bypasses ECC on NVIDIA Workstation GPUs, Enables Root Access
Researchers have developed GPUThor, a novel Rowhammer attack that bypasses ECC protections on NVIDIA workstation GPUs with GDDR6 memory, leading to denial-of-service and privilege escalation to root access.
Academic researchers have detailed a sophisticated Rowhammer attack, dubbed GPUThor, that targets NVIDIA workstation GPUs equipped with GDDR6 memory. This attack is particularly concerning as it successfully bypasses Error Correction Codes (ECC), the very mitigation recommended by NVIDIA to defend against GPU-based Rowhammer exploits. The successful exploitation allows for denial-of-service (DoS) conditions and, more critically, privilege escalation to a root shell on affected systems.
The research, conducted by scientists at the University of Toronto, involved an intensive 24-hour hammering process across four DRAM banks on four different Ampere-class NVIDIA GPUs. This prolonged activity induced bit flips in the memory chips, demonstrating a significant vulnerability in high-end graphics hardware. The affected GPUs include the NVIDIA RTX A6000 (48 GB GDDR6), RTX A5000 (24 GB GDDR6), RTX A4500 (20 GB GDDR6), and RTX A4000 (16 GB GDDR6).
To execute the GPUThor attack, an attacker needs the ability to launch an unprivileged CUDA kernel on the target GPU. This could be achieved by an unprivileged user on a single-tenant machine or by a co-tenant sharing a GPU. The researchers strongly advise against cross-tenant GPU sharing and recommend vigilant monitoring of ECC error counters, alongside restricting untrusted CUDA workloads to mitigate the risk.
NVIDIA acknowledged the threat in a July 2025 security notice, stating that while System-Level ECC mitigates the Rowhammer problem, the researchers demonstrated a successful exploitation on an NVIDIA A6000 GPU where ECC was not enabled. This follows the team's earlier work, GPUHammer, which was the first GPU Rowhammer attack demonstrated on NVIDIA hardware. GPUHammer was neutralized by enabling ECC, highlighting its effectiveness against simpler Rowhammer variants.
GPUThor distinguishes itself through a technique called non-uniform hammering. Unlike prior GPU attacks that activated aggressor and decoy rows at similar rates, GPUThor activates the aggressor row adjacent to the victim row far more frequently. This strategy is designed to overwhelm the memory's Target Row Refresh (TRR) defense mechanism. The researchers observed that repeated memory accesses within a single warp (a group of 32 threads) are consolidated by the memory controller into a single DRAM activation, a behavior exploited by GPUThor to increase the hammering intensity.
The research further suggests that the TRR implementation on these GDDR6 memory chips may apply only once every 72 refresh intervals, rather than the standard once per interval. By building a six-interval pattern around this schedule, GPUThor significantly increased the rate of bit flips. Across the tested cards with ECC disabled, the attack generated between 72,000 and 377,000 bit flips per gigabyte. The RTX A5000 proved to be the most susceptible, recording an astonishing 377,552 flips per gigabyte, vastly exceeding previous GPU Rowhammer attack rates.
The implications of these bit flips are severe. While the GPU's single-error-correct, double-error-detect (SECDED) ECC can correct single-bit errors and detect double-bit errors, the researchers found that triple-bit errors resulted in silent data corruption (SDC). Even double-bit errors, if not immediately corrected, could lead to exploitable conditions. When ECC was enabled on an RTX A6000, the attack caused detectable, uncorrectable errors (DUEs) approximately once every two hours, aborting all running kernels and rendering the GPU unusable until a reset.
For privilege escalation, the researchers leveraged code from their previous GPUBreach research. By corrupting page table entries through bit flips, they could gain access to memory outside the intended process. The attack successfully achieved root access on systems with IOMMU enabled using SDCs, and host-side privilege escalation on systems with IOMMU disabled by overwriting process credential structures. The researchers noted that DUEs are serviced lazily, leaving a critical time window for exploitation. While locating exploitable multi-bit errors took days with earlier methods, GPUThor reduced this to minutes, demonstrating a significant leap in attack efficiency.