GPUThor Rowhammer technique bypasses ECC on NVIDIA GPUs
Researchers from the University of Toronto have developed GPUThor, a Rowhammer attack that bypasses ECC protections on NVIDIA GPUs, achieving bit-flip rates thousands of times higher than previous methods. The attack targets Ampere-class GPUs with GDDR6 memory, including RTX A4000 to A6000 models, and can lead to denial-of-service or root privilege escalation. The technique uses non-uniform hammering patterns to avoid triggering GDDR6's Target Row Refresh mitigations.
The attack exploits undocumented behaviors in GDDR6 memory, specifically how repeated memory requests are coalesced and how frequently Target Row Refresh activates. By using non-uniform hammering patterns, the researchers avoided triggering these mitigations. The technique was tested on Ampere-class workstation GPUs including RTX A4000 through A6000 models, which are common in AI and cloud infrastructure.
The researchers reported their findings to NVIDIA in late April, and the company issued an advisory in August recommending enabling both SYS-ECC and additional protections. While demonstrated on specific models, the researchers note that server-class A100 GPUs and even newer Blackwell and HBM3/e or GDDR7 GPUs may face similar risks, though features like RAS Repair can slow the attack.
This attack could have significant implications for organizations relying on GPU infrastructure for AI training and cloud services. If exploited, it could corrupt AI models, cause costly downtime, or grant attackers root access to sensitive systems. While the attack requires local access to run CUDA programs, the prevalence of these GPUs in shared cloud environments may increase exposure. Organizations may need to reassess security controls around GPU-accessible workloads.