Researchers from the **University of Toronto** have disclosed **GPUThor**, a sophisticated Rowhammer attack that achieves significantly higher and more practical bit-flip rates compared to previous concepts like **GPUHammer** or **GPUBreach**. These earlier attacks were largely rendered irrelevant with the introduction of ECC on **NVIDIA** GPUs. The **GPUThor** attack has been successfully demonstrated against **Ampere**-class **NVIDIA** workstation GPUs with **GDDR6** memory, specifically targeting the **RTX A4000**, **RTX A4500**, **RTX A5000**, and **RTX A6000**. These models are widely deployed in critical AI and cloud computing environments. ### Understanding the GPUThor Attack Improvement Rowhammer attacks exploit a vulnerability in DRAM where repeatedly accessing (or "hammering") a memory row can induce bit flips in adjacent rows. This can lead to data corruption and significant security risks. Given the heavy reliance of AI model training on GPU power, a successful Rowhammer attack could severely compromise model accuracy and integrity. To counter such threats, **NVIDIA** implements mitigations like **SECDED ECC**, designed to correct single-bit errors and detect double-bit errors within monitored memory blocks. However, the **University of Toronto** researchers refined **GPUThor** to employ a non-uniform hammering pattern. This specific pattern allows the attack to evade the **GDDR6**'s **Target Row Refresh (TRR)** mitigations, a crucial defense mechanism.  The researchers achieved this by analyzing and accounting for two previously undocumented GPU behaviors: how repeated memory requests are coalesced and the frequency at which **TRR** activates. This adjustment dramatically improves the attack's efficacy, generating 6.6 times more aggressor-row activations. On tested GPUs without ECC protections, **GPUThor** achieved between 72,000 and 377,000 flips per GB.  These bit-flip rates are between 4,548 and 23,597 times higher than those observed with **GPUHammer**, approaching the severity of powerful CPU Rowhammer attacks like **Blacksmith**. With **GPUThor**'s improved rates, an exploitable bit flip can be found in approximately 1.1 minutes, a stark reduction from **GPUHammer**'s 21.9 hours. Even with ECC enabled, **GPUThor** generated 387 double-bit errors that **ECC** could detect but not correct, along with two triple-bit errors that **ECC** incorrectly repaired, leading to data corruption. ### DoS and Privilege Escalation Capabilities The **University of Toronto** researchers demonstrated that **GPUThor** can induce a DoS state on an **ECC**-enabled **RTX A6000**, causing the GPU to reset every two hours and terminate all ongoing workloads. Repeated attacks on the same card can eventually lead to the device marking itself as requiring replacement. More concerning is the potential for privilege escalation to root level. The researchers claim this is achievable by corrupting GPU page tables, granting an unprivileged **CUDA** program arbitrary memory access and ultimately opening a root shell on the host system. ### Defense Strategies Against GPUThor Beyond the four confirmed vulnerable models, the researchers warn that privilege escalation could still affect server-class **Ampere** GPUs (e.g., **A100**) due to their reliance on **SECDED**-level **ECC**, despite some limitations that improve resilience to DoS conditions. For some **Blackwell** GPUs, the **RAS Repair** resilience feature might make a **GPUThor** attack more time-consuming but does not entirely prevent it. The **GPUThor** paper, published yesterday, further suggests that even **HBM3/e** and **GDDR7** GPUs with on-die **ECC** could be vulnerable if multi-bit flips are triggered. The researchers reported their findings to **NVIDIA** on April 29, leading to an advisory published by the company on August 21, providing guidance on mitigation. **NVIDIA** recommends enabling both **SYS-ECC** and **IOMMU/DMA** isolation, actively monitoring GPU error telemetry, and restricting the sharing or execution of untrusted workloads. The company notes that the risk varies depending on the DRAM device, memory technology, platform design, in-DRAM defenses, and system configuration, with no bit flips observed on tested **GDDR6X** or **HBM2e** GPUs using the same attack patterns. The researchers advise avoiding cross-tenant GPU sharing where feasible, diligently monitoring **ECC** error counters, and restricting untrusted **CUDA** workloads. They emphasize that comprehensive protection will likely necessitate stronger multi-bit **ECC** and enhanced hardware-level defenses in future GPU generations.