A recent study by researchers from the University of Toronto has unveiled a significant vulnerability in NVIDIA RTX A6000 GPUs, highlighting a new Rowhammer attack named GPUThor. This technique bypasses the error correction codes (ECC) recommended by NVIDIA, leading to potential denial-of-service and privilege escalation attacks. The researchers demonstrated that hammering four DRAM banks for 24 hours on Ampere-class cards could induce bit flips, thereby compromising the system's security.
The attack primarily affects GPUs with GDDR6 memory, particularly the RTX A5000 and A6000 models. By enabling attackers to launch unprivileged CUDA kernels, this vulnerability poses a serious threat in scenarios involving cross-tenant GPU sharing. The team advises against such practices and recommends monitoring ECC error counters and restricting untrusted CUDA workloads. NVIDIA has acknowledged the vulnerability, noting that enabling system-level ECC could mitigate the issue, though it is not foolproof.
GPUThor introduces a non-uniform hammering approach, which activates aggressor rows more frequently than decoy rows, circumventing memory defenses like Target Row Refresh. The study recorded between 72,000 to 377,000 bit flips per gigabyte on the affected GPUs with ECC disabled, with the RTX A5000 showing the highest susceptibility. Notably, GPUThor's technique can lead to silent data corruption through mis-corrected errors, even when ECC is active.
The researchers were able to achieve host root access by exploiting double and triple-bit errors, using techniques from previous research such as GPUBreach. Despite the alarming findings, there is currently no patch available to counteract the GPUThor attack. The research team suggests that future hardware should incorporate stronger multi-bit error correction and enhanced in-DRAM defenses to prevent such vulnerabilities. The attack code is scheduled for public release in November 2026, coinciding with the ACM Conference on Computer and Communications Security.