A New Rowhammer Attack Exposes Vulnerability in NVIDIA’s GPU Security
A team of researchers from the University of Toronto has uncovered a sophisticated new attack that can bypass even the most advanced security measures on NVIDIA graphics processing units (GPUs). Dubbed GPUThor, this rowhammer attack exploits vulnerabilities in ECC protection, granting attackers root-level access to targeted systems. The implications are alarming, as these attacks could have devastating consequences for AI model training and cloud infrastructure.
The researchers claim that GPUThor achieves a remarkable 6.6 times more aggressor-row activations than previous attack concepts, generating between 72,000 and 377,000 flips per GB on tested GPUs with no ECC protections. This means that finding an exploitable bit flip is possible within roughly 1.1 minutes, compared to the 21.9 hours required by a previous attack. The team’s paper details how they adjusted their hammering pattern to avoid activating GDDR6’s Target Row Refresh (TRR) mitigations, making it harder for ECC to detect and correct errors.
The attack was demonstrated on Ampere-class NVIDIA workstation GPUs with GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000. These models are widely used in AI and cloud infrastructure, making them prime targets for attackers. The researchers demonstrated two key aspects of the attack: inducing a denial-of-service (DoS) state on an ECC-enabled RTX A6000, causing the GPU to reset every two hours; and escalating privileges to root level by corrupting GPU page tables.
The good news is that NVIDIA has already published an advisory providing guidance on how to defend against the attack. The company recommends enabling both SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting the sharing or execution of untrusted workloads. However, the researchers warn that complete protection will likely require stronger multi-bit ECC and hardware-level defenses in future GPUs.
To mitigate the risk, users should avoid cross-tenant GPU sharing where possible, monitor ECC error counters, and restrict untrusted CUDA workloads. While it’s unclear what specific vulnerabilities exist on other NVIDIA models, it’s essential to take proactive measures to protect against these types of attacks. By staying informed and adapting our security strategies, we can better defend ourselves against the evolving threat landscape.
Ultimately, the discovery of GPUThor highlights the ongoing cat-and-mouse game between attackers and defenders in the world of cybersecurity. As threats evolve, so too must our defenses. By working together to address these vulnerabilities, we can ensure that AI model training and cloud infrastructure remain secure from these kinds of attacks.
Source: Bleeping Computer — 2026-08-26