Academic researchers have disclosed a new Rowhammer technique, dubbed GPUThor Rowhammer, that targets NVIDIA workstation GPUs using GDDR6 memory. In experiments, the attack was able to defeat the error correction measures NVIDIA recommends against GPU Rowhammer, opening a path to denial-of-service (DoS) and privilege escalation that can reach a host root shell.
The work was developed by researchers at the University of Toronto and focuses on how carefully crafted memory access patterns can trigger bit flips even when ECC is present and enabled. While the researchers stress that ECC still raises the bar, they conclude it can no longer be treated as sufficient on its own for these scenarios.
What is GPUThor Rowhammer?
Traditional Rowhammer-style approaches rely on repeatedly activating memory regions that sit next to a “victim” row. GPUThor Rowhammer differs in a key way: it uses non-uniform hammering. Instead of activating aggressor and decoy rows at roughly the same rate, GPUThor activates the aggressor row adjacent to the victim far more frequently than the rows used to overwhelm defenses.
In practice, the researchers ran hammering campaigns for 24 hours per DRAM bank, using four Ampere-class cards. Across all targeted configurations, they induced bit flips on each tested GPU under the described conditions.
Which NVIDIA GPUs were found vulnerable?
The paper’s experiments identified several vulnerable RTX workstation models that use GDDR6 memory. The researchers report the following as impacted:
- RTX A6000 (48 GB GDDR6)
- RTX A5000 (24 GB GDDR6)
- RTX A4500 (20 GB GDDR6)
- RTX A4000 (16 GB GDDR6)
They also describe results where other NVIDIA devices did not show the same bit-flip behavior. That includes cards such as an A10, an L4, and an L40 (including GDDR6 variants), a RTX 4090 with GDDR6X, and an A30 with HBM2e. The researchers further note that they did not include certain data-center GPUs like A100 and H100 in the test set.
When can an attacker run GPUThor?
To mount the attack, the attacker must be able to launch an unprivileged CUDA kernel on the target GPU. The researchers outline two typical ways this could happen:
- As a co-tenant on a shared GPU card (for example, in a multi-tenant environment)
- As untrusted code on a system that is intended to be single-tenant
The guidance from the researchers includes avoiding cross-tenant GPU sharing, monitoring ECC error counters, and restricting untrusted CUDA workloads.
How GPUThor evades in-GPU defenses
The experiments were designed around how memory refresh protections behave for these GDDR6 parts. According to the researchers, the target row refresh (TRR) behavior likely occurs on a slower schedule than an attacker would assume if TRR triggered every refresh interval. They estimate TRR applies about once every 72 refresh intervals, and they build a hammering pattern around this timing.
Under the hood, the paper also describes behavior tied to how GPU threads execute. Accesses that are issued inside a single warp (32 threads running in lockstep) are merged at the memory controller into a single DRAM activation. In contrast, accesses issued from different warps can persist as separate activations depending on cache-line selection and row mapping.
This combination—timed aggressor triggering plus warp-level memory behavior—helps explain why GPUThor Rowhammer can succeed where earlier GPU Rowhammer patterns triggered aggressor and decoy rows too similarly.
Bit-flip rates and the role of ECC
The researchers report that with ECC disabled, their campaigns produced between 72,000 and 377,000 bit flips per gigabyte across the four tested cards. The RTX A5000 appears especially susceptible, reaching 377,552 flips per gigabyte.
They compare the results to prior related attacks, noting that the RTX A5000’s flip rate is far higher than earlier GPUHammer-style patterns and also higher than another previously cited approach known for stronger flipping on GPUs.
At an error granularity of 16 bytes, they report finding 387 double-bit flips and two triple-bit flips across the tested cards with ECC disabled. The RTX A5000 accounts for most of the double-bit flips and both triple-bit flips.
The GPUs use single-error-correct, double-error-detect SECDED ECC. The researchers observed a problematic behavior: while ECC is intended to correct one flipped bit in a protected chunk and detect two, it can mis-correct cases involving three-bit errors. That mis-correction is described as leading to silent data corruption (SDC).
DoS behavior when ECC is enabled
When ECC is enabled on a locally owned RTX A6000, the paper reports that hammering can still lead to errors that become visible to the system as detectable, uncorrectable errors (DUE), and sometimes to SDC as well.
One bank of hammering produced 11 detectable uncorrectable errors and one SDC over the course of a day—averaging about one DUE every two hours. Each DUE event aborts all kernels running on the GPU, effectively leaving the GPU unusable until a reset.
In other words, even if ECC is active, GPUThor Rowhammer can still cause operational disruption.
From bit flips to host privilege escalation
The most critical impact described in the disclosure is that bit flips can be turned into host-side compromise. For the escalation, the researchers re-used exploit logic from earlier work known as GPUBreach, where the goal is GPU page-table manipulation.
The escalation flow, as described in the paper, involves massaging page tables into a vulnerable shape, then hammering neighboring rows to corrupt a page-frame number inside a page-table entry. A second kernel then accesses memory outside the process through the tampered mapping.
The researchers report different escalation outcomes depending on which kind of ECC-related failure occurs:
- Using triple-bit SDC, they obtained root on the host when IOMMU is enabled.
- Using double-bit DUE, they achieved host-side privilege escalation on systems where IOMMU is disabled.
They also provide timing-based reasoning: DUE events are handled lazily in NVIDIA GPUs, leaving an estimated ~10 ms window between detection and GPU termination. During that window, corrupted data can be consumed by the attacker’s GPU kernel.
For the attacker’s workflow, locating exploitable multi-bit errors without triggering a DUE took about four days on the A6000. An end-to-end privilege escalation took about 21.9 hours on that card under their conditions; then the actual escalation reached completion in around 1.1 minutes when using either GPUHammer-like patterns or GPUThor’s patterns.
Do patches exist? And is ECC still worthwhile?
The disclosure states that GPUThor does not carry a CVE identifier, and the researchers report that no in-the-wild exploitation has been observed as of the publication date. They also report that no patch addresses the attack and that a complete fix would require stronger multi-bit error correction and in-DRAM defenses in future GPU designs, such as improved refresh management or per-row activation counting.
At the same time, the researchers do not dismiss ECC entirely. They emphasize that ECC still raises the bar, making the attack harder. However, they argue it can no longer be treated as a sufficient defense by itself against GPUThor Rowhammer-style exploitation.
Recommended mitigations
Based on the researchers’ operational guidance, the practical takeaways for organizations include:
- Avoid sharing GPUs across untrusted tenants.
- Monitor ECC error counters to detect abnormal conditions.
- Restrict or harden execution of untrusted CUDA workloads.
- Apply least-privilege controls around GPU access where possible.
Since the attack requires the ability to launch an unprivileged CUDA kernel, reducing the likelihood of that capability—especially in shared environments—remains central to risk reduction.
Why this matters
GPUThor Rowhammer highlights a broader security challenge: GPUs are not just accelerators for computation, but also complex systems with memory behaviors that attackers can sometimes model and exploit. The combination of non-uniform hammering, timing assumptions about refresh behavior, and the ability to turn memory corruption into host-level privilege escalation makes this research noteworthy.
Even when ECC is enabled, the findings show that errors can still be detectable, uncorrectable, or silent—each with different consequences. As a result, teams relying on workstation GPUs and CUDA workloads in sensitive contexts may need to revisit threat models and operational controls.
Conclusion: GPUThor Rowhammer demonstrates that certain NVIDIA RTX A-series GDDR6-equipped cards can be forced into vulnerable states despite ECC, enabling both disruption and host privilege escalation under specific conditions. While ECC remains valuable, the researchers conclude it should not be treated as a complete solution on its own.
Source: https://thehackernews.com/2026/08/gputhor-rowhammer-defeats-ecc-on-nvidia.html
