GPUThor: Rowhammer Attack Bypasses ECC on NVIDIA RTX A-Series GPUs

University of Toronto researchers have demonstrated GPUThor, a sophisticated Rowhammer-based attack targeting GDDR6 memory architectures in NVIDIA Ampere workstation GPUs, specifically the RTX A4000 through A6000 series. By utilizing non-uniform row hammering patterns, the exploit induces multi-bit flips—specifically double and triple bit errors—that exceed the correction capabilities of standard Error Correction Code (ECC) mechanisms. This bypass allows an attacker to corrupt memory page tables, facilitating a transition from unprivileged program execution to host-level root shell access. The attack demonstrates a massive increase in efficiency, reducing exploit time from nearly 22 hours to approximately 1.1 minutes, posing a significant risk to multi-tenant AI/ML cloud environments and high-performance workstations.

• Vulnerability Overview: The Failure of ECC Defenses

  • Previous Rowhammer mitigations, such as enabling ECC, were considered sufficient to prevent bit-flip exploitation.
  • GPUThor circumvents these protections by triggering non-uniform memory access patterns that cause multi-bit errors.
  • Standard ECC is architecturally limited to correcting single-bit errors; double or triple flips remain undetected or uncorrected.

• Technical Mechanics: Non-Uniform Row Hammering

  • The attack targets the GDDR6 memory architecture utilized in NVIDIA's Ampere workstation-class GPUs.
  • Researchers employed specialized hammering patterns to achieve a 500x to 23,500x increase in bit-flip frequency.
  • This optimization reduces the exploitation window from the 21.9 hours required by GPUHammer to just 1.1 minutes.

• Exploitation Path: From GPU to Host Root

  • Attackers leverage induced bit-flips to achieve Memory Page Table Corruption.
  • Corruption of page tables enables the escalation of privileges from a restricted GPU process to a host-level root shell.
  • Secondary impacts include Denial-of-Service (DoS) capabilities and triggering hardware-level crash detection to flag cards as defective.

• Scope and Affected Hardware

  • Impact is concentrated on NVIDIA Ampere workstation GPUs: RTX A4000, A4500, A5000, and A6000.
  • Server-class hardware (A100, H100) and the newer Blackwell architecture currently appear resilient to this specific vector.
  • Memory types including HBM, GDDR6X, and GDDR7 are currently considered resistant to the GPUThor method.

• Mitigation and Defensive Posture

  • Strengthen Host IOMMU and DMA isolation to restrict the potential impact of GPU-side memory corruption.
  • Monitor nvidia-smi ECC telemetry for suspicious increases in error rates that may indicate hammering attempts.
  • Note that software-level ECC enablement is insufficient; long-term remediation requires hardware-level memory redesign.