Researchers from the University of Toronto have unveiled a new exploit named GPUThor, targeting NVIDIA GPUs equipped with GDDR6 memory. This attack circumvents Error Correction Codes (ECC), a primary defensive measure suggested by NVIDIA against GPU Rowhammer attacks, and facilitates denial-of-service and privilege escalation to root access.
Details of the GPUThor Attack
The GPUThor attack was crafted by systematically hammering four DRAM banks on Ampere-class cards over a 24-hour period, inducing significant bit flips. The vulnerability was confirmed on several NVIDIA models, including the RTX A6000, A5000, A4500, and A4000, all of which are equipped with GDDR6 memory.
Executing the attack requires the capability to run an unprivileged CUDA kernel on the target GPU, either through shared tenancy or by executing untrusted code on a dedicated machine. The researchers emphasize avoiding cross-tenant GPU sharing, monitoring ECC error counters, and restricting untrusted CUDA workloads as preventive measures.
Technical Insights and Outcomes
GPUThor introduces a method known as non-uniform hammering, where the aggressor row is activated more frequently than the decoy rows, overriding the Target Row Refresh (TRR) defense. This differs from previous attacks that targeted aggressor and decoy rows at similar rates. The attack demonstrated up to 377,552 bit flips per gigabyte on the RTX A5000, significantly surpassing previous records set by GPUHammer and GDDRHammer.
The researchers reported that ECC, which can correct single-bit errors and detect two-bit errors, fails to manage triple-bit errors, leading to silent data corruption (SDC). During their experiments with ECC enabled, the team documented numerous detectable, uncorrectable errors (DUE), causing operational interruptions until a system reset.
Security Implications and Future Outlook
For privilege escalation, the team adapted code from their GPUBreach research, manipulating page tables to access unauthorized memory segments. Utilizing the triple-bit SDC, they achieved root access with IOMMU enabled; with double-bit DUEs, host-side privilege escalation was possible when IOMMU was disabled.
Despite its effectiveness, the attack did not succeed on other NVIDIA models such as the A10, L4, and L40 using GDDR6, or the RTX 4090 with GDDR6X, likely due to differing TRR implementations. Future mitigation may require enhanced multi-bit error correction and more robust in-DRAM defenses.
GPUThor was disclosed to NVIDIA, Google, Microsoft, and AWS in April 2026, with a public disclosure scheduled for November 2026. While no CVE has been assigned and no real-world exploitation reported, the researchers highlight the necessity for stronger defensive measures in future GPUs.
